OQS_AES128_ECB_load_schedule: 18| 120|void OQS_AES128_ECB_load_schedule(const uint8_t *key, void **schedule) { 19| 120| callbacks->AES128_ECB_load_schedule(key, schedule); 20| 120|} OQS_AES128_free_schedule: 34| 120|void OQS_AES128_free_schedule(void *schedule) { 35| 120| callbacks->AES128_free_schedule(schedule); 36| 120|} OQS_AES128_ECB_enc_sch: 62| 21.4k|void OQS_AES128_ECB_enc_sch(const uint8_t *plaintext, const size_t plaintext_len, const void *schedule, uint8_t *ciphertext) { 63| 21.4k| callbacks->AES128_ECB_enc_sch(plaintext, plaintext_len, schedule, ciphertext); 64| 21.4k|} oqs_aes128_load_schedule_ni: 51| 120|void oqs_aes128_load_schedule_ni(const uint8_t *key, void **_schedule) { 52| 120| *_schedule = OQS_MEM_malloc(sizeof(aes128ctx)); 53| 120| OQS_EXIT_IF_NULLPTR(*_schedule, "AES"); ------------------ | | 82| 120| do { \ | | 83| 120| if ((x) == (void *)0) { \ | | ------------------ | | | Branch (83:9): [True: 0, False: 120] | | ------------------ | | 84| 0| fprintf(stderr, "Unexpected NULL returned from %s API. Exiting.\n", \ | | 85| 0| loc); \ | | 86| 0| exit(EXIT_FAILURE); \ | | 87| 0| } \ | | 88| 120| } while (0) | | ------------------ | | | Branch (88:12): [Folded, False: 120] | | ------------------ ------------------ 54| 120| assert(*_schedule != NULL); 55| 120| __m128i *schedule = ((aes128ctx *) *_schedule)->sk_exp; 56| 120| aes128ni_setkey_encrypt(key, schedule); 57| 120|} oqs_aes128_free_schedule_ni: 77| 120|void oqs_aes128_free_schedule_ni(void *schedule) { 78| 120| if (schedule != NULL) { ------------------ | Branch (78:6): [True: 120, False: 0] ------------------ 79| 120| OQS_MEM_secure_free(schedule, sizeof(aes128ctx)); 80| 120| } 81| 120|} oqs_aes128_enc_sch_block_ni: 135| 18.1M|void oqs_aes128_enc_sch_block_ni(const uint8_t *plaintext, const void *_schedule, uint8_t *ciphertext) { 136| 18.1M| const __m128i *schedule = ((const aes128ctx *) _schedule)->sk_exp; 137| 18.1M| aes128ni_encrypt(schedule, _mm_loadu_si128((const __m128i *)plaintext), ciphertext); 138| 18.1M|} oqs_aes128_ecb_enc_sch_ni: 140| 21.4k|void oqs_aes128_ecb_enc_sch_ni(const uint8_t *plaintext, const size_t plaintext_len, const void *schedule, uint8_t *ciphertext) { 141| 21.4k| assert(plaintext_len % 16 == 0); 142| 18.2M| for (size_t block = 0; block < plaintext_len / 16; block++) { ------------------ | Branch (142:25): [True: 18.1M, False: 21.4k] ------------------ 143| 18.1M| oqs_aes128_enc_sch_block_ni(plaintext + (16 * block), schedule, ciphertext + (16 * block)); 144| 18.1M| } 145| 21.4k|} aes128_ni.c:aes128ni_setkey_encrypt: 20| 120|static inline void aes128ni_setkey_encrypt(const unsigned char *key, __m128i rkeys[11]) { 21| 120| __m128i key0 = _mm_loadu_si128((const __m128i *)(key + 0)); 22| 120| __m128i temp0, temp1, temp4; 23| 120| int idx = 0; 24| | 25| 120| temp0 = key0; 26| | 27| | /* blockshift-based block by Cedric Bourrasset */ 28| 120|#define BLOCK1(IMM) \ 29| 120| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ 30| 120| rkeys[idx++] = temp0; \ 31| 120| temp4 = _mm_slli_si128(temp0,4); \ 32| 120| temp0 = _mm_xor_si128(temp0,temp4); \ 33| 120| temp4 = _mm_slli_si128(temp0,8); \ 34| 120| temp0 = _mm_xor_si128(temp0,temp4); \ 35| 120| temp1 = _mm_shuffle_epi32(temp1,0xff); \ 36| 120| temp0 = _mm_xor_si128(temp0,temp1) 37| | 38| 120| BLOCK1(0x01); ------------------ | | 29| 120| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ | | 30| 120| rkeys[idx++] = temp0; \ | | 31| 120| temp4 = _mm_slli_si128(temp0,4); \ | | 32| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 33| 120| temp4 = _mm_slli_si128(temp0,8); \ | | 34| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 35| 120| temp1 = _mm_shuffle_epi32(temp1,0xff); \ | | 36| 120| temp0 = _mm_xor_si128(temp0,temp1) ------------------ 39| 120| BLOCK1(0x02); ------------------ | | 29| 120| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ | | 30| 120| rkeys[idx++] = temp0; \ | | 31| 120| temp4 = _mm_slli_si128(temp0,4); \ | | 32| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 33| 120| temp4 = _mm_slli_si128(temp0,8); \ | | 34| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 35| 120| temp1 = _mm_shuffle_epi32(temp1,0xff); \ | | 36| 120| temp0 = _mm_xor_si128(temp0,temp1) ------------------ 40| 120| BLOCK1(0x04); ------------------ | | 29| 120| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ | | 30| 120| rkeys[idx++] = temp0; \ | | 31| 120| temp4 = _mm_slli_si128(temp0,4); \ | | 32| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 33| 120| temp4 = _mm_slli_si128(temp0,8); \ | | 34| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 35| 120| temp1 = _mm_shuffle_epi32(temp1,0xff); \ | | 36| 120| temp0 = _mm_xor_si128(temp0,temp1) ------------------ 41| 120| BLOCK1(0x08); ------------------ | | 29| 120| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ | | 30| 120| rkeys[idx++] = temp0; \ | | 31| 120| temp4 = _mm_slli_si128(temp0,4); \ | | 32| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 33| 120| temp4 = _mm_slli_si128(temp0,8); \ | | 34| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 35| 120| temp1 = _mm_shuffle_epi32(temp1,0xff); \ | | 36| 120| temp0 = _mm_xor_si128(temp0,temp1) ------------------ 42| 120| BLOCK1(0x10); ------------------ | | 29| 120| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ | | 30| 120| rkeys[idx++] = temp0; \ | | 31| 120| temp4 = _mm_slli_si128(temp0,4); \ | | 32| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 33| 120| temp4 = _mm_slli_si128(temp0,8); \ | | 34| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 35| 120| temp1 = _mm_shuffle_epi32(temp1,0xff); \ | | 36| 120| temp0 = _mm_xor_si128(temp0,temp1) ------------------ 43| 120| BLOCK1(0x20); ------------------ | | 29| 120| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ | | 30| 120| rkeys[idx++] = temp0; \ | | 31| 120| temp4 = _mm_slli_si128(temp0,4); \ | | 32| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 33| 120| temp4 = _mm_slli_si128(temp0,8); \ | | 34| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 35| 120| temp1 = _mm_shuffle_epi32(temp1,0xff); \ | | 36| 120| temp0 = _mm_xor_si128(temp0,temp1) ------------------ 44| 120| BLOCK1(0x40); ------------------ | | 29| 120| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ | | 30| 120| rkeys[idx++] = temp0; \ | | 31| 120| temp4 = _mm_slli_si128(temp0,4); \ | | 32| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 33| 120| temp4 = _mm_slli_si128(temp0,8); \ | | 34| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 35| 120| temp1 = _mm_shuffle_epi32(temp1,0xff); \ | | 36| 120| temp0 = _mm_xor_si128(temp0,temp1) ------------------ 45| 120| BLOCK1(0x80); ------------------ | | 29| 120| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ | | 30| 120| rkeys[idx++] = temp0; \ | | 31| 120| temp4 = _mm_slli_si128(temp0,4); \ | | 32| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 33| 120| temp4 = _mm_slli_si128(temp0,8); \ | | 34| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 35| 120| temp1 = _mm_shuffle_epi32(temp1,0xff); \ | | 36| 120| temp0 = _mm_xor_si128(temp0,temp1) ------------------ 46| 120| BLOCK1(0x1b); ------------------ | | 29| 120| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ | | 30| 120| rkeys[idx++] = temp0; \ | | 31| 120| temp4 = _mm_slli_si128(temp0,4); \ | | 32| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 33| 120| temp4 = _mm_slli_si128(temp0,8); \ | | 34| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 35| 120| temp1 = _mm_shuffle_epi32(temp1,0xff); \ | | 36| 120| temp0 = _mm_xor_si128(temp0,temp1) ------------------ 47| | BLOCK1(0x36); ------------------ | | 29| 120| temp1 = _mm_aeskeygenassist_si128(temp0, IMM); \ | | 30| 120| rkeys[idx++] = temp0; \ | | 31| 120| temp4 = _mm_slli_si128(temp0,4); \ | | 32| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 33| 120| temp4 = _mm_slli_si128(temp0,8); \ | | 34| 120| temp0 = _mm_xor_si128(temp0,temp4); \ | | 35| 120| temp1 = _mm_shuffle_epi32(temp1,0xff); \ | | 36| 120| temp0 = _mm_xor_si128(temp0,temp1) ------------------ 48| 120| rkeys[idx++] = temp0; 49| 120|} aes128_ni.c:aes128ni_encrypt: 84| 18.1M|static inline void aes128ni_encrypt(const __m128i rkeys[11], __m128i nv, unsigned char *out) { 85| 18.1M| __m128i temp = _mm_xor_si128(nv, rkeys[0]); 86| 18.1M| temp = _mm_aesenc_si128(temp, rkeys[1]); 87| 18.1M| temp = _mm_aesenc_si128(temp, rkeys[2]); 88| 18.1M| temp = _mm_aesenc_si128(temp, rkeys[3]); 89| 18.1M| temp = _mm_aesenc_si128(temp, rkeys[4]); 90| 18.1M| temp = _mm_aesenc_si128(temp, rkeys[5]); 91| 18.1M| temp = _mm_aesenc_si128(temp, rkeys[6]); 92| 18.1M| temp = _mm_aesenc_si128(temp, rkeys[7]); 93| 18.1M| temp = _mm_aesenc_si128(temp, rkeys[8]); 94| 18.1M| temp = _mm_aesenc_si128(temp, rkeys[9]); 95| 18.1M| temp = _mm_aesenclast_si128(temp, rkeys[10]); 96| 18.1M| _mm_storeu_si128((__m128i *)(out), temp); 97| 18.1M|} aes_impl.c:AES128_ECB_load_schedule: 41| 120|static void AES128_ECB_load_schedule(const uint8_t *key, void **_schedule) { 42| 120| C_OR_NI_OR_ARM( ------------------ | | 14| 120| do { \ | | 15| 120| if (OQS_CPU_has_extension(OQS_CPU_EXT_AES)) { \ | | ------------------ | | | Branch (15:11): [True: 120, False: 0] | | ------------------ | | 16| 120| stmt_ni; \ | | 17| 120| } else { \ | | 18| 0| stmt_c; \ | | 19| 0| } \ | | 20| 120| } while(0) | | ------------------ | | | Branch (20:12): [Folded, False: 120] | | ------------------ ------------------ 43| 120| oqs_aes128_load_schedule_c(key, _schedule), 44| 120| oqs_aes128_load_schedule_ni(key, _schedule), 45| 120| oqs_aes128_load_schedule_no_bitslice(key, _schedule) 46| 120| ); 47| 120|} aes_impl.c:AES128_free_schedule: 69| 120|static void AES128_free_schedule(void *schedule) { 70| 120| C_OR_NI_OR_ARM( ------------------ | | 14| 120| do { \ | | 15| 120| if (OQS_CPU_has_extension(OQS_CPU_EXT_AES)) { \ | | ------------------ | | | Branch (15:11): [True: 120, False: 0] | | ------------------ | | 16| 120| stmt_ni; \ | | 17| 120| } else { \ | | 18| 0| stmt_c; \ | | 19| 0| } \ | | 20| 120| } while(0) | | ------------------ | | | Branch (20:12): [Folded, False: 120] | | ------------------ ------------------ 71| 120| oqs_aes128_free_schedule_c(schedule), 72| 120| oqs_aes128_free_schedule_ni(schedule), 73| 120| oqs_aes128_free_schedule_no_bitslice(schedule) 74| 120| ); 75| 120|} aes_impl.c:AES128_ECB_enc_sch: 122| 21.4k|static void AES128_ECB_enc_sch(const uint8_t *plaintext, const size_t plaintext_len, const void *schedule, uint8_t *ciphertext) { 123| 21.4k| C_OR_NI_OR_ARM( ------------------ | | 14| 21.4k| do { \ | | 15| 21.4k| if (OQS_CPU_has_extension(OQS_CPU_EXT_AES)) { \ | | ------------------ | | | Branch (15:11): [True: 21.4k, False: 0] | | ------------------ | | 16| 21.4k| stmt_ni; \ | | 17| 21.4k| } else { \ | | 18| 0| stmt_c; \ | | 19| 0| } \ | | 20| 21.4k| } while(0) | | ------------------ | | | Branch (20:12): [Folded, False: 21.4k] | | ------------------ ------------------ 124| 21.4k| oqs_aes128_ecb_enc_sch_c(plaintext, plaintext_len, schedule, ciphertext), 125| 21.4k| oqs_aes128_ecb_enc_sch_ni(plaintext, plaintext_len, schedule, ciphertext), 126| 21.4k| oqs_aes128_ecb_enc_sch_armv8(plaintext, plaintext_len, schedule, ciphertext) 127| 21.4k| ); 128| 21.4k|} OQS_CPU_has_extension: 219| 36.3k|OQS_API int OQS_CPU_has_extension(OQS_CPU_EXT ext) { 220| 36.3k|#if defined(OQS_DIST_BUILD) 221| 36.3k|#if defined(OQS_USE_PTHREADS) 222| 36.3k| pthread_once(&once_control, &set_available_cpu_extensions); 223| |#else 224| | if (0 == cpu_ext_data[OQS_CPU_EXT_INIT]) { 225| | set_available_cpu_extensions(); 226| | } 227| |#endif 228| 36.3k| if (0 < ext && ext < OQS_CPU_EXT_COUNT) { ------------------ | Branch (228:6): [True: 34.4k, False: 1.87k] | Branch (228:17): [True: 34.4k, False: 0] ------------------ 229| 34.4k| return (int)cpu_ext_data[ext]; 230| 34.4k| } 231| |#else 232| | (void)ext; 233| |#endif 234| 1.87k| return 0; 235| 36.3k|} OQS_init: 237| 1.87k|OQS_API void OQS_init(void) { 238| 1.87k|#if defined(OQS_DIST_BUILD) 239| 1.87k| OQS_CPU_has_extension(OQS_CPU_EXT_INIT); 240| 1.87k|#endif 241| 1.87k|} OQS_destroy: 253| 1.87k|OQS_API void OQS_destroy(void) { 254| 1.87k|#if defined(OQS_USE_OPENSSL) 255| 1.87k| oqs_ossl_destroy(); 256| 1.87k|#endif 257| 1.87k|} OQS_MEM_cleanse: 271| 59.3k|OQS_API void OQS_MEM_cleanse(void *ptr, size_t len) { 272| 59.3k| if (ptr == NULL) { ------------------ | Branch (272:6): [True: 0, False: 59.3k] ------------------ 273| 0| return; 274| 0| } 275| 59.3k|#if defined(OQS_USE_OPENSSL) 276| 59.3k| OSSL_FUNC(OPENSSL_cleanse)(ptr, len); ------------------ | | 66| 59.3k|#define OSSL_FUNC(name) name ------------------ 277| |#elif defined(_WIN32) 278| | SecureZeroMemory(ptr, len); 279| |#elif defined(OQS_HAVE_EXPLICIT_BZERO) 280| | explicit_bzero(ptr, len); 281| |#elif defined(OQS_HAVE_EXPLICIT_MEMSET) 282| | explicit_memset(ptr, 0, len); 283| |#elif defined(__STDC_LIB_EXT1__) || defined(OQS_HAVE_MEMSET_S) 284| | if (0U < len && memset_s(ptr, (rsize_t)len, 0, (rsize_t)len) != 0) { 285| | abort(); 286| | } 287| |#else 288| | typedef void *(*memset_t)(void *, int, size_t); 289| | static volatile memset_t memset_func = memset; 290| | memset_func(ptr, 0, len); 291| |#endif 292| 59.3k|} OQS_MEM_secure_free: 294| 5.73k|OQS_API void OQS_MEM_secure_free(void *ptr, size_t len) { 295| 5.73k| if (ptr != NULL) { ------------------ | Branch (295:6): [True: 5.73k, False: 0] ------------------ 296| 5.73k| OQS_MEM_cleanse(ptr, len); 297| 5.73k| OQS_MEM_insecure_free(ptr); 298| 5.73k| } 299| 5.73k|} OQS_MEM_insecure_free: 301| 11.3k|OQS_API void OQS_MEM_insecure_free(void *ptr) { 302| 11.3k|#if defined(OQS_USE_OPENSSL) && defined(OPENSSL_VERSION_NUMBER) 303| 11.3k| OSSL_FUNC(CRYPTO_free)(ptr, OPENSSL_FILE, OPENSSL_LINE); ------------------ | | 66| 11.3k|#define OSSL_FUNC(name) name ------------------ 304| |#else 305| | free(ptr); // IGNORE memory-check 306| |#endif 307| 11.3k|} OQS_MEM_aligned_alloc: 309| 46.6k|void *OQS_MEM_aligned_alloc(size_t alignment, size_t size) { 310| 46.6k|#if defined(OQS_USE_OPENSSL) 311| | // Use OpenSSL's memory allocation functions 312| 46.6k| if (!size) { ------------------ | Branch (312:6): [True: 0, False: 46.6k] ------------------ 313| 0| return NULL; 314| 0| } 315| | // Check alignment (power of 2, and >= sizeof(void*)) and size (multiple of alignment) 316| 46.6k| if (alignment & (alignment - 1) || size & (alignment - 1) || alignment < sizeof(void *)) { ------------------ | Branch (316:6): [True: 0, False: 46.6k] | Branch (316:37): [True: 0, False: 46.6k] | Branch (316:63): [True: 0, False: 46.6k] ------------------ 317| 0| errno = EINVAL; 318| 0| return NULL; 319| 0| } 320| 46.6k| const size_t offset = alignment - 1 + sizeof(uint8_t); 321| 46.6k| if (offset > SIZE_MAX - size) { ------------------ | Branch (321:6): [True: 0, False: 46.6k] ------------------ 322| 0| return NULL; 323| 0| } 324| 46.6k| uint8_t *buffer = OSSL_FUNC(CRYPTO_malloc)(size + offset, OPENSSL_FILE, OPENSSL_LINE); ------------------ | | 66| 46.6k|#define OSSL_FUNC(name) name ------------------ 325| 46.6k| if (!buffer) { ------------------ | Branch (325:6): [True: 0, False: 46.6k] ------------------ 326| 0| return NULL; 327| 0| } 328| 46.6k| uint8_t *ptr = (uint8_t *)(((uintptr_t)(buffer) + offset) & ~(alignment - 1)); 329| 46.6k| ptrdiff_t diff = ptr - buffer; 330| 46.6k| if (diff > UINT8_MAX) { ------------------ | Branch (330:6): [True: 0, False: 46.6k] ------------------ 331| | // Free and return NULL if alignment is too large 332| 0| OSSL_FUNC(CRYPTO_free)(buffer, OPENSSL_FILE, OPENSSL_LINE); ------------------ | | 66| 0|#define OSSL_FUNC(name) name ------------------ 333| 0| errno = EINVAL; 334| 0| return NULL; 335| 0| } 336| | // Store the difference so that the free function can use it 337| 46.6k| ptr[-1] = (uint8_t)diff; 338| 46.6k| return ptr; 339| |#elif defined(OQS_HAVE_ALIGNED_ALLOC) // glibc and other implementations providing aligned_alloc 340| | return aligned_alloc(alignment, size); 341| |#else 342| | // Check alignment (power of 2, and >= sizeof(void*)) and size (multiple of alignment) 343| | if (alignment & (alignment - 1) || size & (alignment - 1) || alignment < sizeof(void *)) { 344| | errno = EINVAL; 345| | return NULL; 346| | } 347| | 348| |#if defined(OQS_HAVE_POSIX_MEMALIGN) 349| | void *ptr = NULL; 350| | const int err = posix_memalign(&ptr, alignment, size); 351| | if (err) { 352| | errno = err; 353| | ptr = NULL; 354| | } 355| | return ptr; 356| |#elif defined(OQS_HAVE_MEMALIGN) 357| | return memalign(alignment, size); 358| |#elif defined(__MINGW32__) || defined(__MINGW64__) 359| | return __mingw_aligned_malloc(size, alignment); 360| |#elif defined(_MSC_VER) 361| | return _aligned_malloc(size, alignment); 362| |#else 363| | if (!size) { 364| | return NULL; 365| | } 366| | // Overallocate to be able to align the pointer (alignment -1) and to store 367| | // the difference between the pointer returned to the user (ptr) and the 368| | // pointer returned by malloc (buffer). The difference is caped to 255 and 369| | // can be made larger if necessary, but this should be enough for all users 370| | // in liboqs. 371| | // 372| | // buffer ptr 373| | // ↓ ↓ 374| | // ...........|................... 375| | // | 376| | // diff = ptr - buffer 377| | const size_t offset = alignment - 1 + sizeof(uint8_t); 378| | if (offset > SIZE_MAX - size) { 379| | return NULL; 380| | } 381| | uint8_t *buffer = malloc(size + offset); // IGNORE memory-check 382| | if (!buffer) { 383| | return NULL; 384| | } 385| | 386| | // Align the pointer returned to the user. 387| | uint8_t *ptr = (uint8_t *)(((uintptr_t)(buffer) + offset) & ~(alignment - 1)); 388| | ptrdiff_t diff = ptr - buffer; 389| | if (diff > UINT8_MAX) { 390| | // This should never happen in our code, but just to be safe 391| | free(buffer); // IGNORE memory-check 392| | errno = EINVAL; 393| | return NULL; 394| | } 395| | // Store the difference one byte ahead the returned poitner so that free 396| | // can reconstruct buffer. 397| | ptr[-1] = diff; 398| | return ptr; 399| |#endif 400| |#endif 401| 46.6k|} OQS_MEM_aligned_free: 403| 46.6k|void OQS_MEM_aligned_free(void *ptr) { 404| 46.6k| if (ptr == NULL) { ------------------ | Branch (404:6): [True: 0, False: 46.6k] ------------------ 405| 0| return; 406| 0| } 407| 46.6k|#if defined(OQS_USE_OPENSSL) 408| | // Use OpenSSL's free function 409| 46.6k| uint8_t *u8ptr = ptr; 410| 46.6k| OSSL_FUNC(CRYPTO_free)(u8ptr - u8ptr[-1], OPENSSL_FILE, OPENSSL_LINE); ------------------ | | 66| 46.6k|#define OSSL_FUNC(name) name ------------------ 411| |#elif defined(OQS_HAVE_ALIGNED_ALLOC) || defined(OQS_HAVE_POSIX_MEMALIGN) || defined(OQS_HAVE_MEMALIGN) 412| | free(ptr); // IGNORE memory-check 413| |#elif defined(__MINGW32__) || defined(__MINGW64__) 414| | __mingw_aligned_free(ptr); 415| |#elif defined(_MSC_VER) 416| | _aligned_free(ptr); 417| |#else 418| | // Reconstruct the pointer returned from malloc using the difference 419| | // stored one byte ahead of ptr. 420| | uint8_t *u8ptr = ptr; 421| | free(u8ptr - u8ptr[-1]); // IGNORE memory-check 422| |#endif 423| 46.6k|} OQS_MEM_aligned_secure_free: 425| 46.6k|void OQS_MEM_aligned_secure_free(void *ptr, size_t len) { 426| 46.6k| OQS_MEM_cleanse(ptr, len); 427| 46.6k| OQS_MEM_aligned_free(ptr); 428| 46.6k|} OQS_MEM_malloc: 430| 9.48k|OQS_API void *OQS_MEM_malloc(size_t size) { 431| 9.48k|#if defined(OQS_USE_OPENSSL) 432| 9.48k| return OSSL_FUNC(CRYPTO_malloc)(size, OPENSSL_FILE, OPENSSL_LINE); ------------------ | | 66| 9.48k|#define OSSL_FUNC(name) name ------------------ 433| |#else 434| | return malloc(size); // IGNORE memory-check 435| |#endif 436| 9.48k|} OQS_MEM_calloc: 438| 1.87k|OQS_API void *OQS_MEM_calloc(size_t num_elements, size_t element_size) { 439| 1.87k|#if defined(OQS_USE_OPENSSL) 440| 1.87k| if (element_size != 0 && num_elements > SIZE_MAX / element_size) { ------------------ | Branch (440:6): [True: 1.87k, False: 0] | Branch (440:27): [True: 0, False: 1.87k] ------------------ 441| 0| return NULL; 442| 0| } 443| 1.87k| return OSSL_FUNC(CRYPTO_zalloc)(num_elements * element_size, ------------------ | | 66| 1.87k|#define OSSL_FUNC(name) name ------------------ 444| 1.87k| OPENSSL_FILE, OPENSSL_LINE); 445| |#else 446| | return calloc(num_elements, element_size); // IGNORE memory-check 447| |#endif 448| 1.87k|} common.c:set_available_cpu_extensions: 47| 1|static void set_available_cpu_extensions(void) { 48| | /* mark that this function has been called */ 49| 1| cpu_ext_data[OQS_CPU_EXT_INIT] = 1; 50| | 51| 1| cpuid_out leaf_1; 52| 1| cpuid(&leaf_1, 1); 53| 1| if (leaf_1.eax == 0) { ------------------ | Branch (53:6): [True: 0, False: 1] ------------------ 54| 0| return; 55| 0| } 56| | 57| 1| cpuid_out leaf_7; 58| 1| cpuid(&leaf_7, 7); 59| | 60| 1| const unsigned int has_xsave = is_bit_set(leaf_1.ecx, 26); 61| 1| const unsigned int has_osxsave = is_bit_set(leaf_1.ecx, 27); 62| 1| const uint32_t xcr0_eax = (has_xsave && has_osxsave) ? xgetbv_eax(0) : 0; ------------------ | Branch (62:29): [True: 1, False: 0] | Branch (62:42): [True: 1, False: 0] ------------------ 63| | 64| 1| cpu_ext_data[OQS_CPU_EXT_AES] = is_bit_set(leaf_1.ecx, 25); 65| 1| if (has_mask(xcr0_eax, MASK_XMM | MASK_YMM)) { ------------------ | | 14| 1|#define MASK_XMM 0x2 ------------------ if (has_mask(xcr0_eax, MASK_XMM | MASK_YMM)) { ------------------ | | 15| 1|#define MASK_YMM 0x4 ------------------ | Branch (65:6): [True: 1, False: 0] ------------------ 66| 1| cpu_ext_data[OQS_CPU_EXT_AVX] = is_bit_set(leaf_1.ecx, 28); 67| 1| cpu_ext_data[OQS_CPU_EXT_AVX2] = is_bit_set(leaf_7.ebx, 5); 68| 1| } 69| 1| cpu_ext_data[OQS_CPU_EXT_PCLMULQDQ] = is_bit_set(leaf_1.ecx, 1); 70| 1| cpu_ext_data[OQS_CPU_EXT_POPCNT] = is_bit_set(leaf_1.ecx, 23); 71| 1| cpu_ext_data[OQS_CPU_EXT_BMI1] = is_bit_set(leaf_7.ebx, 3); 72| 1| cpu_ext_data[OQS_CPU_EXT_BMI2] = is_bit_set(leaf_7.ebx, 8); 73| 1| cpu_ext_data[OQS_CPU_EXT_ADX] = is_bit_set(leaf_7.ebx, 19); 74| | 75| 1| if (has_mask(xcr0_eax, MASK_XMM)) { ------------------ | | 14| 1|#define MASK_XMM 0x2 ------------------ | Branch (75:6): [True: 1, False: 0] ------------------ 76| 1| cpu_ext_data[OQS_CPU_EXT_SSE] = is_bit_set(leaf_1.edx, 25); 77| 1| cpu_ext_data[OQS_CPU_EXT_SSE2] = is_bit_set(leaf_1.edx, 26); 78| 1| cpu_ext_data[OQS_CPU_EXT_SSE3] = is_bit_set(leaf_1.ecx, 0); 79| 1| } 80| | 81| 1| if (has_mask(xcr0_eax, MASK_XMM | MASK_YMM | MASK_MASKREG | MASK_ZMM0_15 | MASK_ZMM16_31)) { ------------------ | | 14| 1|#define MASK_XMM 0x2 ------------------ if (has_mask(xcr0_eax, MASK_XMM | MASK_YMM | MASK_MASKREG | MASK_ZMM0_15 | MASK_ZMM16_31)) { ------------------ | | 15| 1|#define MASK_YMM 0x4 ------------------ if (has_mask(xcr0_eax, MASK_XMM | MASK_YMM | MASK_MASKREG | MASK_ZMM0_15 | MASK_ZMM16_31)) { ------------------ | | 16| 1|#define MASK_MASKREG 0x20 ------------------ if (has_mask(xcr0_eax, MASK_XMM | MASK_YMM | MASK_MASKREG | MASK_ZMM0_15 | MASK_ZMM16_31)) { ------------------ | | 17| 1|#define MASK_ZMM0_15 0x40 ------------------ if (has_mask(xcr0_eax, MASK_XMM | MASK_YMM | MASK_MASKREG | MASK_ZMM0_15 | MASK_ZMM16_31)) { ------------------ | | 18| 1|#define MASK_ZMM16_31 0x80 ------------------ | Branch (81:6): [True: 0, False: 1] ------------------ 82| 0| unsigned int avx512f = is_bit_set(leaf_7.ebx, 16); 83| 0| unsigned int avx512bw = is_bit_set(leaf_7.ebx, 30); 84| 0| unsigned int avx512dq = is_bit_set(leaf_7.ebx, 17); 85| 0| if (avx512f && avx512bw && avx512dq) { ------------------ | Branch (85:7): [True: 0, False: 0] | Branch (85:18): [True: 0, False: 0] | Branch (85:30): [True: 0, False: 0] ------------------ 86| 0| cpu_ext_data[OQS_CPU_EXT_AVX512] = 1; 87| 0| } 88| 0| cpu_ext_data[OQS_CPU_EXT_VPCLMULQDQ] = is_bit_set(leaf_7.ecx, 10); 89| 0| } 90| 1|} oqs_ossl_destroy: 89| 1.87k|void oqs_ossl_destroy(void) { 90| 1.87k|#if OPENSSL_VERSION_NUMBER >= 0x30000000L 91| 1.87k|#if defined(OQS_USE_PTHREADS) 92| 1.87k| pthread_once(&free_once_control, free_ossl_objects); 93| |#else 94| | if (sha256_ptr || sha384_ptr || sha512_ptr || sha3_256_ptr || 95| | sha3_384_ptr || sha3_512_ptr || shake128_ptr || shake256_ptr || 96| | aes128_ecb_ptr || aes128_ctr_ptr || aes256_ecb_ptr || aes256_ctr_ptr) { 97| | free_ossl_objects(); 98| | } 99| |#endif 100| 1.87k|#endif 101| 1.87k|} oqs_sha512: 182| 110|const EVP_MD *oqs_sha512(void) { 183| 110|#if OPENSSL_VERSION_NUMBER >= 0x30000000L 184| 110|#if defined(OQS_USE_PTHREADS) 185| 110| if (pthread_once(&init_once_control, fetch_ossl_objects)) { ------------------ | Branch (185:6): [True: 0, False: 110] ------------------ 186| 0| return NULL; 187| 0| } 188| |#else 189| | if (!sha512_ptr) { 190| | fetch_ossl_objects(); 191| | } 192| |#endif 193| 110| return sha512_ptr; 194| |#else 195| | return OSSL_FUNC(EVP_sha512)(); 196| |#endif 197| 110|} ossl_helpers.c:free_ossl_objects: 73| 1|static void free_ossl_objects(void) { 74| 1| cleanup_evp_md(&sha256_ptr); 75| 1| cleanup_evp_md(&sha384_ptr); 76| 1| cleanup_evp_md(&sha512_ptr); 77| 1| cleanup_evp_md(&sha3_256_ptr); 78| 1| cleanup_evp_md(&sha3_384_ptr); 79| 1| cleanup_evp_md(&sha3_512_ptr); 80| 1| cleanup_evp_md(&shake128_ptr); 81| 1| cleanup_evp_md(&shake256_ptr); 82| 1| cleanup_evp_cipher(&aes128_ecb_ptr); 83| 1| cleanup_evp_cipher(&aes128_ctr_ptr); 84| 1| cleanup_evp_cipher(&aes256_ecb_ptr); 85| 1| cleanup_evp_cipher(&aes256_ctr_ptr); 86| 1|} ossl_helpers.c:cleanup_evp_md: 51| 8|static inline void cleanup_evp_md(EVP_MD **mdp) { 52| | /* Always check argument is non-NULL before calling EVP_MD_free 53| | * to avoid OpenSSL functions being used when they are 54| | * overridden with OQS_*_set_callbacks. 55| | */ 56| 8| if (*mdp) { ------------------ | Branch (56:6): [True: 0, False: 8] ------------------ 57| 0| OSSL_FUNC(EVP_MD_free)(*mdp); ------------------ | | 66| 0|#define OSSL_FUNC(name) name ------------------ 58| | *mdp = NULL; 59| 0| } 60| 8|} ossl_helpers.c:cleanup_evp_cipher: 62| 4|static inline void cleanup_evp_cipher(EVP_CIPHER **cipherp) { 63| | /* Always check argument is non-NULL before calling EVP_CIPHER_free 64| | * to avoid OpenSSL functions being used when they are 65| | * overridden with OQS_*_set_callbacks. 66| | */ 67| 4| if (*cipherp) { ------------------ | Branch (67:6): [True: 0, False: 4] ------------------ 68| 0| OSSL_FUNC(EVP_CIPHER_free)(*cipherp); ------------------ | | 66| 0|#define OSSL_FUNC(name) name ------------------ 69| | *cipherp = NULL; 70| 0| } 71| 4|} ossl_helpers.c:fetch_ossl_objects: 28| 1|static void fetch_ossl_objects(void) { 29| 1| sha256_ptr = OSSL_FUNC(EVP_MD_fetch)(NULL, "SHA256", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 30| 1| sha384_ptr = OSSL_FUNC(EVP_MD_fetch)(NULL, "SHA384", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 31| 1| sha512_ptr = OSSL_FUNC(EVP_MD_fetch)(NULL, "SHA512", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 32| | 33| 1| sha3_256_ptr = OSSL_FUNC(EVP_MD_fetch)(NULL, "SHA3-256", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 34| 1| sha3_384_ptr = OSSL_FUNC(EVP_MD_fetch)(NULL, "SHA3-384", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 35| 1| sha3_512_ptr = OSSL_FUNC(EVP_MD_fetch)(NULL, "SHA3-512", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 36| 1| shake128_ptr = OSSL_FUNC(EVP_MD_fetch)(NULL, "SHAKE128", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 37| 1| shake256_ptr = OSSL_FUNC(EVP_MD_fetch)(NULL, "SHAKE256", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 38| | 39| 1| aes128_ecb_ptr = OSSL_FUNC(EVP_CIPHER_fetch)(NULL, "AES-128-ECB", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 40| 1| aes128_ctr_ptr = OSSL_FUNC(EVP_CIPHER_fetch)(NULL, "AES-128-CTR", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 41| 1| aes256_ecb_ptr = OSSL_FUNC(EVP_CIPHER_fetch)(NULL, "AES-256-ECB", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 42| 1| aes256_ctr_ptr = OSSL_FUNC(EVP_CIPHER_fetch)(NULL, "AES-256-CTR", NULL); ------------------ | | 66| 1|#define OSSL_FUNC(name) name ------------------ 43| | 44| 1| if (!sha256_ptr || !sha384_ptr || !sha512_ptr || !sha3_256_ptr || ------------------ | Branch (44:6): [True: 0, False: 1] | Branch (44:21): [True: 0, False: 1] | Branch (44:36): [True: 0, False: 1] | Branch (44:51): [True: 0, False: 1] ------------------ 45| 1| !sha3_384_ptr || !sha3_512_ptr || !shake128_ptr || !shake256_ptr || ------------------ | Branch (45:10): [True: 0, False: 1] | Branch (45:27): [True: 0, False: 1] | Branch (45:44): [True: 0, False: 1] | Branch (45:61): [True: 0, False: 1] ------------------ 46| 1| !aes128_ecb_ptr || !aes128_ctr_ptr || !aes256_ecb_ptr || !aes256_ctr_ptr) { ------------------ | Branch (46:10): [True: 0, False: 1] | Branch (46:29): [True: 0, False: 1] | Branch (46:48): [True: 0, False: 1] | Branch (46:67): [True: 0, False: 1] ------------------ 47| | fprintf(stderr, "liboqs warning: OpenSSL initialization failure. Is provider for SHA, SHAKE, AES enabled?\n"); 48| 0| } 49| 1|} OQS_SHA3_shake128_absorb_once: 5| 489|void shake128_absorb_once(shake128incctx *state, const uint8_t *in, size_t inlen) { 6| 489| shake128_inc_ctx_reset(state); ------------------ | | 45| 489|#define shake128_inc_ctx_reset OQS_SHA3_shake128_inc_ctx_reset ------------------ 7| 489| shake128_inc_absorb(state, in, inlen); ------------------ | | 40| 489|#define shake128_inc_absorb OQS_SHA3_shake128_inc_absorb ------------------ 8| 489| shake128_inc_finalize(state); ------------------ | | 41| 489|#define shake128_inc_finalize OQS_SHA3_shake128_inc_finalize ------------------ 9| 489|} OQS_SHA3_shake128_x4_absorb_once: 5| 2.66k|void shake128x4_absorb_once(shake128x4incctx *state, const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 6| 2.66k| shake128x4_inc_ctx_reset(state); ------------------ | | 25| 2.66k|#define shake128x4_inc_ctx_reset OQS_SHA3_shake128_x4_inc_ctx_reset ------------------ 7| 2.66k| shake128x4_inc_absorb(state, in0, in1, in2, in3, inlen); ------------------ | | 20| 2.66k|#define shake128x4_inc_absorb OQS_SHA3_shake128_x4_inc_absorb ------------------ 8| 2.66k| shake128x4_inc_finalize(state); ------------------ | | 21| 2.66k|#define shake128x4_inc_finalize OQS_SHA3_shake128_x4_inc_finalize ------------------ 9| 2.66k|} OQS_SHA3_shake256_x4_absorb_once: 11| 1.53k|void shake256x4_absorb_once(shake256x4incctx *state, const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 12| 1.53k| shake256x4_inc_ctx_reset(state); ------------------ | | 34| 1.53k|#define shake256x4_inc_ctx_reset OQS_SHA3_shake256_x4_inc_ctx_reset ------------------ 13| 1.53k| shake256x4_inc_absorb(state, in0, in1, in2, in3, inlen); ------------------ | | 29| 1.53k|#define shake256x4_inc_absorb OQS_SHA3_shake256_x4_inc_absorb ------------------ 14| 1.53k| shake256x4_inc_finalize(state); ------------------ | | 30| 1.53k|#define shake256x4_inc_finalize OQS_SHA3_shake256_x4_inc_finalize ------------------ 15| 1.53k|} OQS_randombytes_custom_algorithm: 58| 1.87k|OQS_API void OQS_randombytes_custom_algorithm(void (*algorithm_ptr)(uint8_t *, size_t)) { 59| 1.87k| oqs_randombytes_algorithm = algorithm_ptr; 60| 1.87k|} OQS_randombytes: 62| 8.60k|OQS_API void OQS_randombytes(uint8_t *random_array, size_t bytes_to_read) { 63| 8.60k| oqs_randombytes_algorithm(random_array, bytes_to_read); 64| 8.60k|} OQS_SHA2_sha512: 85| 110|void OQS_SHA2_sha512(uint8_t *out, const uint8_t *in, size_t inlen) { 86| 110| callbacks->SHA2_sha512(out, in, inlen); 87| 110|} sha2_ossl.c:do_hash: 16| 110|static void do_hash(uint8_t *output, const uint8_t *input, size_t inplen, const EVP_MD *md) { 17| 110| EVP_MD_CTX *mdctx; 18| 110| unsigned int outlen; 19| 110| mdctx = OSSL_FUNC(EVP_MD_CTX_new)(); ------------------ | | 66| 110|#define OSSL_FUNC(name) name ------------------ 20| 110| OQS_EXIT_IF_NULLPTR(mdctx, "OpenSSL"); ------------------ | | 82| 110| do { \ | | 83| 110| if ((x) == (void *)0) { \ | | ------------------ | | | Branch (83:9): [True: 0, False: 110] | | ------------------ | | 84| 0| fprintf(stderr, "Unexpected NULL returned from %s API. Exiting.\n", \ | | 85| 0| loc); \ | | 86| 0| exit(EXIT_FAILURE); \ | | 87| 0| } \ | | 88| 110| } while (0) | | ------------------ | | | Branch (88:12): [Folded, False: 110] | | ------------------ ------------------ 21| 110| OQS_OPENSSL_GUARD(OSSL_FUNC(EVP_DigestInit_ex)(mdctx, md, NULL)); ------------------ | | 113| 110| do { \ | | 114| 110| if (1 != (x)) { \ | | ------------------ | | | Branch (114:9): [True: 0, False: 110] | | ------------------ | | 115| 0| fprintf(stderr, "Error return value from OpenSSL API: %d. Exiting.\n", \ | | 116| 0| x); \ | | 117| 0| OSSL_FUNC(ERR_print_errors_fp)(stderr); \ | | ------------------ | | | | 66| 0|#define OSSL_FUNC(name) name | | ------------------ | | 118| 0| exit(EXIT_FAILURE); \ | | 119| 0| } \ | | 120| 110| } while (0) | | ------------------ | | | Branch (120:12): [Folded, False: 110] | | ------------------ ------------------ 22| 110| OQS_OPENSSL_GUARD(OSSL_FUNC(EVP_DigestUpdate)(mdctx, input, inplen)); ------------------ | | 113| 110| do { \ | | 114| 110| if (1 != (x)) { \ | | ------------------ | | | Branch (114:9): [True: 0, False: 110] | | ------------------ | | 115| 0| fprintf(stderr, "Error return value from OpenSSL API: %d. Exiting.\n", \ | | 116| 0| x); \ | | 117| 0| OSSL_FUNC(ERR_print_errors_fp)(stderr); \ | | ------------------ | | | | 66| 0|#define OSSL_FUNC(name) name | | ------------------ | | 118| 0| exit(EXIT_FAILURE); \ | | 119| 0| } \ | | 120| 110| } while (0) | | ------------------ | | | Branch (120:12): [Folded, False: 110] | | ------------------ ------------------ 23| 110| OQS_OPENSSL_GUARD(OSSL_FUNC(EVP_DigestFinal_ex)(mdctx, output, &outlen)); ------------------ | | 113| 110| do { \ | | 114| 110| if (1 != (x)) { \ | | ------------------ | | | Branch (114:9): [True: 0, False: 110] | | ------------------ | | 115| 0| fprintf(stderr, "Error return value from OpenSSL API: %d. Exiting.\n", \ | | 116| 0| x); \ | | 117| 0| OSSL_FUNC(ERR_print_errors_fp)(stderr); \ | | ------------------ | | | | 66| 0|#define OSSL_FUNC(name) name | | ------------------ | | 118| 0| exit(EXIT_FAILURE); \ | | 119| 0| } \ | | 120| 110| } while (0) | | ------------------ | | | Branch (120:12): [Folded, False: 110] | | ------------------ ------------------ 24| 110| OSSL_FUNC(EVP_MD_CTX_free)(mdctx); ------------------ | | 66| 110|#define OSSL_FUNC(name) name ------------------ 25| 110|} sha2_ossl.c:SHA2_sha512: 41| 110|static void SHA2_sha512(uint8_t *output, const uint8_t *input, size_t inplen) { 42| 110| const EVP_MD *md; 43| 110| md = oqs_sha512(); 44| 110| OQS_EXIT_IF_NULLPTR(md, "OpenSSL"); ------------------ | | 82| 110| do { \ | | 83| 110| if ((x) == (void *)0) { \ | | ------------------ | | | Branch (83:9): [True: 0, False: 110] | | ------------------ | | 84| 0| fprintf(stderr, "Unexpected NULL returned from %s API. Exiting.\n", \ | | 85| 0| loc); \ | | 86| 0| exit(EXIT_FAILURE); \ | | 87| 0| } \ | | 88| 110| } while (0) | | ------------------ | | | Branch (88:12): [Folded, False: 110] | | ------------------ ------------------ 45| 110| do_hash(output, input, inplen, md); 46| 110|} OQS_SHA3_sha3_256: 15| 2.74k|void OQS_SHA3_sha3_256(uint8_t *output, const uint8_t *input, size_t inplen) { 16| 2.74k| callbacks->SHA3_sha3_256(output, input, inplen); 17| 2.74k|} OQS_SHA3_sha3_256_inc_init: 19| 3.10k|void OQS_SHA3_sha3_256_inc_init(OQS_SHA3_sha3_256_inc_ctx *state) { 20| 3.10k| callbacks->SHA3_sha3_256_inc_init(state); 21| 3.10k|} OQS_SHA3_sha3_256_inc_absorb: 23| 3.96k|void OQS_SHA3_sha3_256_inc_absorb(OQS_SHA3_sha3_256_inc_ctx *state, const uint8_t *input, size_t inlen) { 24| 3.96k| callbacks->SHA3_sha3_256_inc_absorb(state, input, inlen); 25| 3.96k|} OQS_SHA3_sha3_256_inc_finalize: 27| 3.10k|void OQS_SHA3_sha3_256_inc_finalize(uint8_t *output, OQS_SHA3_sha3_256_inc_ctx *state) { 28| 3.10k| callbacks->SHA3_sha3_256_inc_finalize(output, state); 29| 3.10k|} OQS_SHA3_sha3_256_inc_ctx_release: 31| 3.10k|void OQS_SHA3_sha3_256_inc_ctx_release(OQS_SHA3_sha3_256_inc_ctx *state) { 32| 3.10k| callbacks->SHA3_sha3_256_inc_ctx_release(state); 33| 3.10k|} OQS_SHA3_sha3_384: 43| 28|void OQS_SHA3_sha3_384(uint8_t *output, const uint8_t *input, size_t inplen) { 44| 28| callbacks->SHA3_sha3_384(output, input, inplen); 45| 28|} OQS_SHA3_sha3_384_inc_init: 47| 28|void OQS_SHA3_sha3_384_inc_init(OQS_SHA3_sha3_384_inc_ctx *state) { 48| 28| callbacks->SHA3_sha3_384_inc_init(state); 49| 28|} OQS_SHA3_sha3_384_inc_absorb: 51| 28|void OQS_SHA3_sha3_384_inc_absorb(OQS_SHA3_sha3_384_inc_ctx *state, const uint8_t *input, size_t inlen) { 52| 28| callbacks->SHA3_sha3_384_inc_absorb(state, input, inlen); 53| 28|} OQS_SHA3_sha3_384_inc_finalize: 55| 28|void OQS_SHA3_sha3_384_inc_finalize(uint8_t *output, OQS_SHA3_sha3_384_inc_ctx *state) { 56| 28| callbacks->SHA3_sha3_384_inc_finalize(output, state); 57| 28|} OQS_SHA3_sha3_384_inc_ctx_release: 59| 28|void OQS_SHA3_sha3_384_inc_ctx_release(OQS_SHA3_sha3_384_inc_ctx *state) { 60| 28| callbacks->SHA3_sha3_384_inc_ctx_release(state); 61| 28|} OQS_SHA3_sha3_512: 71| 1.12k|void OQS_SHA3_sha3_512(uint8_t *output, const uint8_t *input, size_t inplen) { 72| 1.12k| callbacks->SHA3_sha3_512(output, input, inplen); 73| 1.12k|} OQS_SHA3_sha3_512_inc_init: 75| 1.48k|void OQS_SHA3_sha3_512_inc_init(OQS_SHA3_sha3_512_inc_ctx *state) { 76| 1.48k| callbacks->SHA3_sha3_512_inc_init(state); 77| 1.48k|} OQS_SHA3_sha3_512_inc_absorb: 79| 2.34k|void OQS_SHA3_sha3_512_inc_absorb(OQS_SHA3_sha3_512_inc_ctx *state, const uint8_t *input, size_t inlen) { 80| 2.34k| callbacks->SHA3_sha3_512_inc_absorb(state, input, inlen); 81| 2.34k|} OQS_SHA3_sha3_512_inc_finalize: 83| 1.48k|void OQS_SHA3_sha3_512_inc_finalize(uint8_t *output, OQS_SHA3_sha3_512_inc_ctx *state) { 84| 1.48k| callbacks->SHA3_sha3_512_inc_finalize(output, state); 85| 1.48k|} OQS_SHA3_sha3_512_inc_ctx_release: 87| 1.48k|void OQS_SHA3_sha3_512_inc_ctx_release(OQS_SHA3_sha3_512_inc_ctx *state) { 88| 1.48k| callbacks->SHA3_sha3_512_inc_ctx_release(state); 89| 1.48k|} OQS_SHA3_shake128: 99| 110|void OQS_SHA3_shake128(uint8_t *output, size_t outlen, const uint8_t *input, size_t inplen) { 100| 110| callbacks->SHA3_shake128(output, outlen, input, inplen); 101| 110|} OQS_SHA3_shake128_inc_init: 103| 599|void OQS_SHA3_shake128_inc_init(OQS_SHA3_shake128_inc_ctx *state) { 104| 599| callbacks->SHA3_shake128_inc_init(state); 105| 599|} OQS_SHA3_shake128_inc_absorb: 107| 599|void OQS_SHA3_shake128_inc_absorb(OQS_SHA3_shake128_inc_ctx *state, const uint8_t *input, size_t inlen) { 108| 599| callbacks->SHA3_shake128_inc_absorb(state, input, inlen); 109| 599|} OQS_SHA3_shake128_inc_finalize: 111| 599|void OQS_SHA3_shake128_inc_finalize(OQS_SHA3_shake128_inc_ctx *state) { 112| 599| callbacks->SHA3_shake128_inc_finalize(state); 113| 599|} OQS_SHA3_shake128_inc_squeeze: 115| 665|void OQS_SHA3_shake128_inc_squeeze(uint8_t *output, size_t outlen, OQS_SHA3_shake128_inc_ctx *state) { 116| 665| callbacks->SHA3_shake128_inc_squeeze(output, outlen, state); 117| 665|} OQS_SHA3_shake128_inc_ctx_release: 119| 599|void OQS_SHA3_shake128_inc_ctx_release(OQS_SHA3_shake128_inc_ctx *state) { 120| 599| callbacks->SHA3_shake128_inc_ctx_release(state); 121| 599|} OQS_SHA3_shake128_inc_ctx_reset: 127| 489|void OQS_SHA3_shake128_inc_ctx_reset(OQS_SHA3_shake128_inc_ctx *state) { 128| 489| callbacks->SHA3_shake128_inc_ctx_reset(state); 129| 489|} OQS_SHA3_shake256: 131| 9.09k|void OQS_SHA3_shake256(uint8_t *output, size_t outlen, const uint8_t *input, size_t inplen) { 132| 9.09k| callbacks->SHA3_shake256(output, outlen, input, inplen); 133| 9.09k|} OQS_SHA3_shake256_inc_init: 135| 10.0k|void OQS_SHA3_shake256_inc_init(OQS_SHA3_shake256_inc_ctx *state) { 136| 10.0k| callbacks->SHA3_shake256_inc_init(state); 137| 10.0k|} OQS_SHA3_shake256_inc_absorb: 139| 11.0k|void OQS_SHA3_shake256_inc_absorb(OQS_SHA3_shake256_inc_ctx *state, const uint8_t *input, size_t inlen) { 140| 11.0k| callbacks->SHA3_shake256_inc_absorb(state, input, inlen); 141| 11.0k|} OQS_SHA3_shake256_inc_finalize: 143| 10.0k|void OQS_SHA3_shake256_inc_finalize(OQS_SHA3_shake256_inc_ctx *state) { 144| 10.0k| callbacks->SHA3_shake256_inc_finalize(state); 145| 10.0k|} OQS_SHA3_shake256_inc_squeeze: 147| 47.3k|void OQS_SHA3_shake256_inc_squeeze(uint8_t *output, size_t outlen, OQS_SHA3_shake256_inc_ctx *state) { 148| 47.3k| callbacks->SHA3_shake256_inc_squeeze(output, outlen, state); 149| 47.3k|} OQS_SHA3_shake256_inc_ctx_release: 151| 10.0k|void OQS_SHA3_shake256_inc_ctx_release(OQS_SHA3_shake256_inc_ctx *state) { 152| 10.0k| callbacks->SHA3_shake256_inc_ctx_release(state); 153| 10.0k|} OQS_SHA3_shake128_x4: 15| 27.9k|void OQS_SHA3_shake128_x4(uint8_t *out0, uint8_t *out1, uint8_t *out2, uint8_t *out3, size_t outlen, const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 16| 27.9k| callbacks->SHA3_shake128_x4(out0, out1, out2, out3, outlen, in0, in1, in2, in3, inlen); 17| 27.9k|} OQS_SHA3_shake128_x4_inc_init: 19| 29.4k|void OQS_SHA3_shake128_x4_inc_init(OQS_SHA3_shake128_x4_inc_ctx *state) { 20| 29.4k| callbacks->SHA3_shake128_x4_inc_init(state); 21| 29.4k|} OQS_SHA3_shake128_x4_inc_absorb: 23| 30.6k|void OQS_SHA3_shake128_x4_inc_absorb(OQS_SHA3_shake128_x4_inc_ctx *state, const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 24| 30.6k| callbacks->SHA3_shake128_x4_inc_absorb(state, in0, in1, in2, in3, inlen); 25| 30.6k|} OQS_SHA3_shake128_x4_inc_finalize: 27| 30.6k|void OQS_SHA3_shake128_x4_inc_finalize(OQS_SHA3_shake128_x4_inc_ctx *state) { 28| 30.6k| callbacks->SHA3_shake128_x4_inc_finalize(state); 29| 30.6k|} OQS_SHA3_shake128_x4_inc_squeeze: 31| 31.7k|void OQS_SHA3_shake128_x4_inc_squeeze(uint8_t *out0, uint8_t *out1, uint8_t *out2, uint8_t *out3, size_t outlen, OQS_SHA3_shake128_x4_inc_ctx *state) { 32| 31.7k| callbacks->SHA3_shake128_x4_inc_squeeze(out0, out1, out2, out3, outlen, state); 33| 31.7k|} OQS_SHA3_shake128_x4_inc_ctx_release: 35| 29.4k|void OQS_SHA3_shake128_x4_inc_ctx_release(OQS_SHA3_shake128_x4_inc_ctx *state) { 36| 29.4k| callbacks->SHA3_shake128_x4_inc_ctx_release(state); 37| 29.4k|} OQS_SHA3_shake128_x4_inc_ctx_reset: 43| 2.66k|void OQS_SHA3_shake128_x4_inc_ctx_reset(OQS_SHA3_shake128_x4_inc_ctx *state) { 44| 2.66k| callbacks->SHA3_shake128_x4_inc_ctx_reset(state); 45| 2.66k|} OQS_SHA3_shake256_x4: 47| 432|void OQS_SHA3_shake256_x4(uint8_t *out0, uint8_t *out1, uint8_t *out2, uint8_t *out3, size_t outlen, const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 48| 432| callbacks->SHA3_shake256_x4(out0, out1, out2, out3, outlen, in0, in1, in2, in3, inlen); 49| 432|} OQS_SHA3_shake256_x4_inc_init: 51| 1.96k|void OQS_SHA3_shake256_x4_inc_init(OQS_SHA3_shake256_x4_inc_ctx *state) { 52| 1.96k| callbacks->SHA3_shake256_x4_inc_init(state); 53| 1.96k|} OQS_SHA3_shake256_x4_inc_absorb: 55| 1.96k|void OQS_SHA3_shake256_x4_inc_absorb(OQS_SHA3_shake256_x4_inc_ctx *state, const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 56| 1.96k| callbacks->SHA3_shake256_x4_inc_absorb(state, in0, in1, in2, in3, inlen); 57| 1.96k|} OQS_SHA3_shake256_x4_inc_finalize: 59| 1.96k|void OQS_SHA3_shake256_x4_inc_finalize(OQS_SHA3_shake256_x4_inc_ctx *state) { 60| 1.96k| callbacks->SHA3_shake256_x4_inc_finalize(state); 61| 1.96k|} OQS_SHA3_shake256_x4_inc_squeeze: 63| 1.96k|void OQS_SHA3_shake256_x4_inc_squeeze(uint8_t *out0, uint8_t *out1, uint8_t *out2, uint8_t *out3, size_t outlen, OQS_SHA3_shake256_x4_inc_ctx *state) { 64| 1.96k| callbacks->SHA3_shake256_x4_inc_squeeze(out0, out1, out2, out3, outlen, state); 65| 1.96k|} OQS_SHA3_shake256_x4_inc_ctx_release: 67| 1.96k|void OQS_SHA3_shake256_x4_inc_ctx_release(OQS_SHA3_shake256_x4_inc_ctx *state) { 68| 1.96k| callbacks->SHA3_shake256_x4_inc_ctx_release(state); 69| 1.96k|} OQS_SHA3_shake256_x4_inc_ctx_reset: 75| 1.53k|void OQS_SHA3_shake256_x4_inc_ctx_reset(OQS_SHA3_shake256_x4_inc_ctx *state) { 76| 1.53k| callbacks->SHA3_shake256_x4_inc_ctx_reset(state); 77| 1.53k|} KeccakP1600times4_InitializeAll_avx2: 108| 35.5k|void KeccakP1600times4_InitializeAll(void *states) { 109| 35.5k| memset(states, 0, KeccakP1600times4_statesSizeInBytes_avx2); ------------------ | | 27| 35.5k|#define KeccakP1600times4_statesSizeInBytes_avx2 800 ------------------ 110| 35.5k|} KeccakP1600times4_AddByte_avx2: 112| 260k|void KeccakP1600times4_AddByte(void *states, unsigned int instanceIndex, unsigned char byte, unsigned int offset) { 113| 260k| ((unsigned char *)states)[instanceIndex * 8 + (offset / 8) * 4 * 8 + offset % 8] ^= byte; 114| 260k|} KeccakP1600times4_AddBytes_avx2: 116| 130k|void KeccakP1600times4_AddBytes(void *states, unsigned int instanceIndex, const unsigned char *data, unsigned int offset, unsigned int length) { 117| 130k| unsigned int sizeLeft = length; 118| 130k| unsigned int lanePosition = offset / SnP_laneLengthInBytes; ------------------ | | 91| 130k|#define SnP_laneLengthInBytes 8 ------------------ 119| 130k| unsigned int offsetInLane = offset % SnP_laneLengthInBytes; ------------------ | | 91| 130k|#define SnP_laneLengthInBytes 8 ------------------ 120| 130k| unsigned int bytesInLane; 121| 130k| const unsigned char *curData = data; 122| 130k| uint64_t *statesAsLanes = (uint64_t *)states; 123| 130k| uint64_t lane; 124| | 125| 130k| if ((sizeLeft > 0) && (offsetInLane != 0)) { ------------------ | Branch (125:6): [True: 130k, False: 0] | Branch (125:24): [True: 0, False: 130k] ------------------ 126| 0| bytesInLane = SnP_laneLengthInBytes - offsetInLane; ------------------ | | 91| 0|#define SnP_laneLengthInBytes 8 ------------------ 127| 0| if (bytesInLane > sizeLeft) { ------------------ | Branch (127:7): [True: 0, False: 0] ------------------ 128| 0| bytesInLane = sizeLeft; 129| 0| } 130| 0| lane = 0; 131| 0| memcpy((unsigned char *)&lane + offsetInLane, curData, bytesInLane); 132| 0| statesAsLanes[laneIndex(instanceIndex, lanePosition)] ^= lane; ------------------ | | 44| 0|#define laneIndex(instanceIndex, lanePosition) ((lanePosition)*4 + instanceIndex) ------------------ 133| 0| sizeLeft -= bytesInLane; 134| 0| lanePosition++; 135| 0| curData += bytesInLane; 136| 0| } 137| | 138| 427k| while (sizeLeft >= SnP_laneLengthInBytes) { ------------------ | | 91| 427k|#define SnP_laneLengthInBytes 8 ------------------ | Branch (138:9): [True: 297k, False: 130k] ------------------ 139| 297k| lane = load64(curData); 140| 297k| statesAsLanes[laneIndex(instanceIndex, lanePosition)] ^= lane; ------------------ | | 44| 297k|#define laneIndex(instanceIndex, lanePosition) ((lanePosition)*4 + instanceIndex) ------------------ 141| 297k| sizeLeft -= SnP_laneLengthInBytes; ------------------ | | 91| 297k|#define SnP_laneLengthInBytes 8 ------------------ 142| 297k| lanePosition++; 143| 297k| curData += SnP_laneLengthInBytes; ------------------ | | 91| 297k|#define SnP_laneLengthInBytes 8 ------------------ 144| 297k| } 145| | 146| 130k| if (sizeLeft > 0) { ------------------ | Branch (146:6): [True: 130k, False: 0] ------------------ 147| 130k| lane = 0; 148| 130k| memcpy(&lane, curData, sizeLeft); 149| 130k| statesAsLanes[laneIndex(instanceIndex, lanePosition)] ^= lane; ------------------ | | 44| 130k|#define laneIndex(instanceIndex, lanePosition) ((lanePosition)*4 + instanceIndex) ------------------ 150| 130k| } 151| 130k|} KeccakP1600times4_ExtractBytes_avx2: 296| 1.69M|void KeccakP1600times4_ExtractBytes(const void *states, unsigned int instanceIndex, unsigned char *data, unsigned int offset, unsigned int length) { 297| 1.69M| unsigned int sizeLeft = length; 298| 1.69M| unsigned int lanePosition = offset / SnP_laneLengthInBytes; ------------------ | | 91| 1.69M|#define SnP_laneLengthInBytes 8 ------------------ 299| 1.69M| unsigned int offsetInLane = offset % SnP_laneLengthInBytes; ------------------ | | 91| 1.69M|#define SnP_laneLengthInBytes 8 ------------------ 300| 1.69M| unsigned char *curData = data; 301| 1.69M| const uint64_t *statesAsLanes = (const uint64_t *)states; 302| | 303| 1.69M| if ((sizeLeft > 0) && (offsetInLane != 0)) { ------------------ | Branch (303:6): [True: 1.55M, False: 134k] | Branch (303:24): [True: 0, False: 1.55M] ------------------ 304| 0| unsigned int bytesInLane = SnP_laneLengthInBytes - offsetInLane; ------------------ | | 91| 0|#define SnP_laneLengthInBytes 8 ------------------ 305| 0| if (bytesInLane > sizeLeft) { ------------------ | Branch (305:7): [True: 0, False: 0] ------------------ 306| 0| bytesInLane = sizeLeft; 307| 0| } 308| 0| memcpy( curData, ((const unsigned char *)&statesAsLanes[laneIndex(instanceIndex, lanePosition)]) + offsetInLane, bytesInLane); ------------------ | | 44| 0|#define laneIndex(instanceIndex, lanePosition) ((lanePosition)*4 + instanceIndex) ------------------ 309| 0| sizeLeft -= bytesInLane; 310| 0| lanePosition++; 311| 0| curData += bytesInLane; 312| 0| } 313| | 314| 33.8M| while (sizeLeft >= SnP_laneLengthInBytes) { ------------------ | | 91| 33.8M|#define SnP_laneLengthInBytes 8 ------------------ | Branch (314:9): [True: 32.2M, False: 1.69M] ------------------ 315| 32.2M| store64(curData, statesAsLanes[laneIndex(instanceIndex, lanePosition)]); ------------------ | | 44| 32.2M|#define laneIndex(instanceIndex, lanePosition) ((lanePosition)*4 + instanceIndex) ------------------ 316| 32.2M| sizeLeft -= SnP_laneLengthInBytes; ------------------ | | 91| 32.2M|#define SnP_laneLengthInBytes 8 ------------------ 317| 32.2M| lanePosition++; 318| 32.2M| curData += SnP_laneLengthInBytes; ------------------ | | 91| 32.2M|#define SnP_laneLengthInBytes 8 ------------------ 319| 32.2M| } 320| | 321| 1.69M| if (sizeLeft > 0) { ------------------ | Branch (321:6): [True: 0, False: 1.69M] ------------------ 322| 0| memcpy( curData, &statesAsLanes[laneIndex(instanceIndex, lanePosition)], sizeLeft); ------------------ | | 44| 0|#define laneIndex(instanceIndex, lanePosition) ((lanePosition)*4 + instanceIndex) ------------------ 323| 0| } 324| 1.69M|} KeccakP1600times4_PermuteAll_24rounds_avx2: 833| 389k|void KeccakP1600times4_PermuteAll_24rounds(void *states) { 834| 389k| V256 *statesAsLanes = (V256 *)states; 835| 389k| declareABCDE ------------------ | | 479| 389k| V256 Aba, Abe, Abi, Abo, Abu; \ | | 480| 389k| V256 Aga, Age, Agi, Ago, Agu; \ | | 481| 389k| V256 Aka, Ake, Aki, Ako, Aku; \ | | 482| 389k| V256 Ama, Ame, Ami, Amo, Amu; \ | | 483| 389k| V256 Asa, Ase, Asi, Aso, Asu; \ | | 484| 389k| V256 Bba, Bbe, Bbi, Bbo, Bbu; \ | | 485| 389k| V256 Bga, Bge, Bgi, Bgo, Bgu; \ | | 486| 389k| V256 Bka, Bke, Bki, Bko, Bku; \ | | 487| 389k| V256 Bma, Bme, Bmi, Bmo, Bmu; \ | | 488| 389k| V256 Bsa, Bse, Bsi, Bso, Bsu; \ | | 489| 389k| V256 Ca, Ce, Ci, Co, Cu; \ | | 490| 389k| V256 Ca1, Ce1, Ci1, Co1, Cu1; \ | | 491| 389k| V256 Da, De, Di, Do, Du; \ | | 492| 389k| V256 Eba, Ebe, Ebi, Ebo, Ebu; \ | | 493| 389k| V256 Ega, Ege, Egi, Ego, Egu; \ | | 494| 389k| V256 Eka, Eke, Eki, Eko, Eku; \ | | 495| 389k| V256 Ema, Eme, Emi, Emo, Emu; \ | | 496| 389k| V256 Esa, Ese, Esi, Eso, Esu; \ ------------------ 836| | 837| 389k| copyFromState(A, statesAsLanes) ------------------ | | 750| 389k| X##ba = LOAD256(state[ 0]); \ | | ------------------ | | | | 48| 389k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 751| 389k| X##be = LOAD256(state[ 1]); \ | | ------------------ | | | | 48| 389k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 752| 389k| X##bi = LOAD256(state[ 2]); \ | | ------------------ | | | | 48| 389k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 753| 389k| X##bo = LOAD256(state[ 3]); \ | | ------------------ | | | | 48| 389k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 754| 389k| X##bu = LOAD256(state[ 4]); \ | | ------------------ | | | | 48| 389k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 755| 389k| X##ga = LOAD256(state[ 5]); \ | | ------------------ | | | | 48| 389k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 756| 389k| X##ge = LOAD256(state[ 6]); \ | | ------------------ | | | | 48| 389k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 757| 389k| X##gi = LOAD256(state[ 7]); \ | | ------------------ | | | | 48| 389k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 758| 389k| X##go = LOAD256(state[ 8]); \ | | ------------------ | | | | 48| 389k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 759| 389k| X##gu = LOAD256(state[ 9]); \ | | ------------------ | | | | 48| 389k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 760| 389k| X##ka = LOAD256(state[10]); \ | | ------------------ | | | | 48| 389k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 761| 389k| X##ke = LOAD256(state[11]); \ | | ------------------ | | | | 48| 389k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 762| 389k| X##ki = LOAD256(state[12]); \ | | ------------------ | | | | 48| 389k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 763| 389k| X##ko = LOAD256(state[13]); \ | | ------------------ | | | | 48| 389k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 764| 389k| X##ku = LOAD256(state[14]); \ | | ------------------ | | | | 48| 389k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 765| 389k| X##ma = LOAD256(state[15]); \ | | ------------------ | | | | 48| 389k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 766| 389k| X##me = LOAD256(state[16]); \ | | ------------------ | | | | 48| 389k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 767| 389k| X##mi = LOAD256(state[17]); \ | | ------------------ | | | | 48| 389k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 768| 389k| X##mo = LOAD256(state[18]); \ | | ------------------ | | | | 48| 389k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 769| 389k| X##mu = LOAD256(state[19]); \ | | ------------------ | | | | 48| 389k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 770| 389k| X##sa = LOAD256(state[20]); \ | | ------------------ | | | | 48| 389k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 771| 389k| X##se = LOAD256(state[21]); \ | | ------------------ | | | | 48| 389k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 772| 389k| X##si = LOAD256(state[22]); \ | | ------------------ | | | | 48| 389k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 773| 389k| X##so = LOAD256(state[23]); \ | | ------------------ | | | | 48| 389k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ | | 774| 389k| X##su = LOAD256(state[24]); \ | | ------------------ | | | | 48| 389k|#define LOAD256(a) _mm256_load_si256((const V256 *)&(a)) | | ------------------ ------------------ 838| 389k| rounds24 ------------------ | | 19| 389k| prepareTheta \ | | ------------------ | | | | 499| 389k| Ca = XOR256(Aba, XOR256(Aga, XOR256(Aka, XOR256(Ama, Asa)))); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 500| 389k| Ce = XOR256(Abe, XOR256(Age, XOR256(Ake, XOR256(Ame, Ase)))); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 501| 389k| Ci = XOR256(Abi, XOR256(Agi, XOR256(Aki, XOR256(Ami, Asi)))); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 502| 389k| Co = XOR256(Abo, XOR256(Ago, XOR256(Ako, XOR256(Amo, Aso)))); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 503| 389k| Cu = XOR256(Abu, XOR256(Agu, XOR256(Aku, XOR256(Amu, Asu)))); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 20| 389k| thetaRhoPiChiIotaPrepareTheta( 0, A, E) \ | | ------------------ | | | | 508| 389k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 389k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 389k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 389k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 389k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 389k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 389k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 389k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 389k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 389k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 389k|\ | | | | 519| 389k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 389k| Bba = A##ba; \ | | | | 521| 389k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 389k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 389k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 389k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 389k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 389k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 389k| Ca = E##ba; \ | | | | 528| 389k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 389k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 389k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 389k| Ce = E##be; \ | | | | 532| 389k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 389k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 389k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 389k| Ci = E##bi; \ | | | | 536| 389k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 389k| Co = E##bo; \ | | | | 538| 389k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 389k| Cu = E##bu; \ | | | | 540| 389k|\ | | | | 541| 389k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 389k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 389k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 389k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 389k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 389k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 389k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 389k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 389k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 389k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 389k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 389k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 389k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 389k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 389k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 389k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 389k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 389k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 389k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 389k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 389k|\ | | | | 562| 389k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 389k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 389k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 389k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 389k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 389k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 389k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 389k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 389k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 389k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 389k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 389k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 389k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 389k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 389k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 389k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 389k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 389k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 389k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 389k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 389k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 389k|\ | | | | 583| 389k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 389k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 389k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 389k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 389k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 389k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 389k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 389k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 389k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 389k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 389k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 389k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 389k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 389k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 389k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 389k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 389k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 389k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 389k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 389k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 389k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 389k|\ | | | | 604| 389k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 389k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 389k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 389k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 389k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 389k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 389k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 389k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 389k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 389k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 389k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 389k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 389k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 389k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 389k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 389k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 389k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 389k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 389k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 389k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 21| 389k| thetaRhoPiChiIotaPrepareTheta( 1, E, A) \ | | ------------------ | | | | 508| 389k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 389k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 389k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 389k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 389k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 389k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 389k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 389k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 389k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 389k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 389k|\ | | | | 519| 389k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 389k| Bba = A##ba; \ | | | | 521| 389k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 389k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 389k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 389k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 389k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 389k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 389k| Ca = E##ba; \ | | | | 528| 389k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 389k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 389k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 389k| Ce = E##be; \ | | | | 532| 389k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 389k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 389k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 389k| Ci = E##bi; \ | | | | 536| 389k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 389k| Co = E##bo; \ | | | | 538| 389k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 389k| Cu = E##bu; \ | | | | 540| 389k|\ | | | | 541| 389k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 389k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 389k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 389k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 389k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 389k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 389k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 389k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 389k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 389k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 389k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 389k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 389k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 389k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 389k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 389k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 389k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 389k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 389k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 389k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 389k|\ | | | | 562| 389k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 389k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 389k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 389k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 389k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 389k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 389k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 389k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 389k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 389k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 389k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 389k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 389k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 389k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 389k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 389k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 389k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 389k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 389k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 389k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 389k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 389k|\ | | | | 583| 389k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 389k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 389k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 389k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 389k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 389k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 389k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 389k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 389k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 389k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 389k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 389k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 389k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 389k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 389k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 389k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 389k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 389k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 389k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 389k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 389k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 389k|\ | | | | 604| 389k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 389k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 389k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 389k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 389k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 389k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 389k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 389k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 389k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 389k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 389k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 389k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 389k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 389k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 389k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 389k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 389k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 389k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 389k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 389k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 22| 389k| thetaRhoPiChiIotaPrepareTheta( 2, A, E) \ | | ------------------ | | | | 508| 389k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 389k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 389k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 389k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 389k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 389k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 389k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 389k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 389k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 389k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 389k|\ | | | | 519| 389k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 389k| Bba = A##ba; \ | | | | 521| 389k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 389k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 389k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 389k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 389k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 389k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 389k| Ca = E##ba; \ | | | | 528| 389k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 389k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 389k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 389k| Ce = E##be; \ | | | | 532| 389k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 389k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 389k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 389k| Ci = E##bi; \ | | | | 536| 389k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 389k| Co = E##bo; \ | | | | 538| 389k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 389k| Cu = E##bu; \ | | | | 540| 389k|\ | | | | 541| 389k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 389k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 389k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 389k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 389k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 389k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 389k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 389k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 389k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 389k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 389k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 389k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 389k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 389k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 389k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 389k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 389k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 389k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 389k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 389k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 389k|\ | | | | 562| 389k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 389k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 389k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 389k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 389k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 389k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 389k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 389k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 389k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 389k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 389k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 389k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 389k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 389k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 389k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 389k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 389k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 389k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 389k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 389k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 389k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 389k|\ | | | | 583| 389k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 389k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 389k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 389k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 389k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 389k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 389k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 389k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 389k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 389k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 389k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 389k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 389k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 389k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 389k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 389k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 389k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 389k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 389k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 389k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 389k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 389k|\ | | | | 604| 389k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 389k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 389k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 389k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 389k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 389k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 389k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 389k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 389k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 389k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 389k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 389k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 389k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 389k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 389k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 389k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 389k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 389k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 389k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 389k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 23| 389k| thetaRhoPiChiIotaPrepareTheta( 3, E, A) \ | | ------------------ | | | | 508| 389k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 389k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 389k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 389k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 389k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 389k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 389k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 389k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 389k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 389k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 389k|\ | | | | 519| 389k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 389k| Bba = A##ba; \ | | | | 521| 389k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 389k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 389k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 389k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 389k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 389k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 389k| Ca = E##ba; \ | | | | 528| 389k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 389k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 389k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 389k| Ce = E##be; \ | | | | 532| 389k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 389k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 389k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 389k| Ci = E##bi; \ | | | | 536| 389k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 389k| Co = E##bo; \ | | | | 538| 389k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 389k| Cu = E##bu; \ | | | | 540| 389k|\ | | | | 541| 389k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 389k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 389k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 389k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 389k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 389k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 389k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 389k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 389k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 389k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 389k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 389k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 389k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 389k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 389k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 389k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 389k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 389k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 389k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 389k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 389k|\ | | | | 562| 389k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 389k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 389k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 389k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 389k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 389k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 389k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 389k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 389k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 389k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 389k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 389k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 389k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 389k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 389k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 389k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 389k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 389k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 389k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 389k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 389k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 389k|\ | | | | 583| 389k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 389k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 389k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 389k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 389k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 389k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 389k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 389k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 389k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 389k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 389k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 389k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 389k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 389k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 389k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 389k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 389k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 389k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 389k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 389k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 389k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 389k|\ | | | | 604| 389k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 389k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 389k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 389k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 389k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 389k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 389k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 389k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 389k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 389k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 389k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 389k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 389k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 389k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 389k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 389k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 389k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 389k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 389k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 389k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 24| 389k| thetaRhoPiChiIotaPrepareTheta( 4, A, E) \ | | ------------------ | | | | 508| 389k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 389k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 389k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 389k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 389k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 389k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 389k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 389k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 389k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 389k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 389k|\ | | | | 519| 389k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 389k| Bba = A##ba; \ | | | | 521| 389k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 389k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 389k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 389k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 389k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 389k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 389k| Ca = E##ba; \ | | | | 528| 389k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 389k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 389k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 389k| Ce = E##be; \ | | | | 532| 389k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 389k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 389k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 389k| Ci = E##bi; \ | | | | 536| 389k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 389k| Co = E##bo; \ | | | | 538| 389k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 389k| Cu = E##bu; \ | | | | 540| 389k|\ | | | | 541| 389k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 389k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 389k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 389k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 389k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 389k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 389k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 389k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 389k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 389k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 389k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 389k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 389k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 389k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 389k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 389k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 389k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 389k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 389k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 389k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 389k|\ | | | | 562| 389k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 389k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 389k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 389k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 389k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 389k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 389k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 389k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 389k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 389k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 389k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 389k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 389k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 389k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 389k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 389k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 389k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 389k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 389k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 389k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 389k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 389k|\ | | | | 583| 389k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 389k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 389k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 389k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 389k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 389k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 389k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 389k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 389k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 389k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 389k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 389k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 389k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 389k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 389k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 389k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 389k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 389k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 389k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 389k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 389k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 389k|\ | | | | 604| 389k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 389k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 389k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 389k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 389k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 389k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 389k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 389k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 389k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 389k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 389k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 389k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 389k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 389k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 389k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 389k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 389k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 389k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 389k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 389k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 25| 389k| thetaRhoPiChiIotaPrepareTheta( 5, E, A) \ | | ------------------ | | | | 508| 389k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 389k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 389k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 389k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 389k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 389k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 389k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 389k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 389k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 389k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 389k|\ | | | | 519| 389k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 389k| Bba = A##ba; \ | | | | 521| 389k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 389k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 389k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 389k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 389k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 389k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 389k| Ca = E##ba; \ | | | | 528| 389k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 389k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 389k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 389k| Ce = E##be; \ | | | | 532| 389k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 389k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 389k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 389k| Ci = E##bi; \ | | | | 536| 389k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 389k| Co = E##bo; \ | | | | 538| 389k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 389k| Cu = E##bu; \ | | | | 540| 389k|\ | | | | 541| 389k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 389k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 389k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 389k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 389k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 389k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 389k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 389k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 389k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 389k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 389k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 389k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 389k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 389k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 389k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 389k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 389k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 389k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 389k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 389k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 389k|\ | | | | 562| 389k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 389k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 389k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 389k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 389k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 389k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 389k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 389k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 389k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 389k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 389k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 389k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 389k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 389k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 389k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 389k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 389k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 389k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 389k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 389k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 389k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 389k|\ | | | | 583| 389k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 389k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 389k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 389k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 389k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 389k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 389k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 389k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 389k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 389k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 389k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 389k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 389k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 389k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 389k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 389k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 389k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 389k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 389k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 389k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 389k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 389k|\ | | | | 604| 389k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 389k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 389k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 389k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 389k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 389k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 389k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 389k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 389k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 389k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 389k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 389k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 389k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 389k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 389k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 389k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 389k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 389k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 389k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 389k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 26| 389k| thetaRhoPiChiIotaPrepareTheta( 6, A, E) \ | | ------------------ | | | | 508| 389k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 389k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 389k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 389k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 389k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 389k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 389k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 389k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 389k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 389k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 389k|\ | | | | 519| 389k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 389k| Bba = A##ba; \ | | | | 521| 389k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 389k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 389k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 389k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 389k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 389k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 389k| Ca = E##ba; \ | | | | 528| 389k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 389k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 389k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 389k| Ce = E##be; \ | | | | 532| 389k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 389k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 389k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 389k| Ci = E##bi; \ | | | | 536| 389k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 389k| Co = E##bo; \ | | | | 538| 389k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 389k| Cu = E##bu; \ | | | | 540| 389k|\ | | | | 541| 389k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 389k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 389k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 389k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 389k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 389k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 389k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 389k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 389k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 389k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 389k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 389k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 389k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 389k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 389k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 389k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 389k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 389k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 389k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 389k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 389k|\ | | | | 562| 389k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 389k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 389k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 389k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 389k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 389k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 389k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 389k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 389k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 389k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 389k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 389k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 389k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 389k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 389k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 389k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 389k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 389k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 389k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 389k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 389k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 389k|\ | | | | 583| 389k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 389k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 389k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 389k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 389k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 389k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 389k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 389k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 389k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 389k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 389k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 389k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 389k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 389k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 389k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 389k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 389k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 389k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 389k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 389k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 389k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 389k|\ | | | | 604| 389k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 389k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 389k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 389k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 389k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 389k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 389k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 389k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 389k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 389k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 389k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 389k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 389k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 389k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 389k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 389k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 389k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 389k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 389k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 389k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 27| 389k| thetaRhoPiChiIotaPrepareTheta( 7, E, A) \ | | ------------------ | | | | 508| 389k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 389k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 389k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 389k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 389k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 389k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 389k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 389k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 389k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 389k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 389k|\ | | | | 519| 389k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 389k| Bba = A##ba; \ | | | | 521| 389k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 389k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 389k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 389k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 389k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 389k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 389k| Ca = E##ba; \ | | | | 528| 389k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 389k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 389k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 389k| Ce = E##be; \ | | | | 532| 389k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 389k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 389k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 389k| Ci = E##bi; \ | | | | 536| 389k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 389k| Co = E##bo; \ | | | | 538| 389k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 389k| Cu = E##bu; \ | | | | 540| 389k|\ | | | | 541| 389k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 389k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 389k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 389k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 389k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 389k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 389k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 389k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 389k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 389k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 389k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 389k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 389k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 389k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 389k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 389k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 389k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 389k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 389k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 389k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 389k|\ | | | | 562| 389k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 389k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 389k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 389k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 389k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 389k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 389k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 389k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 389k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 389k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 389k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 389k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 389k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 389k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 389k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 389k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 389k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 389k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 389k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 389k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 389k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 389k|\ | | | | 583| 389k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 389k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 389k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 389k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 389k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 389k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 389k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 389k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 389k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 389k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 389k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 389k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 389k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 389k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 389k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 389k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 389k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 389k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 389k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 389k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 389k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 389k|\ | | | | 604| 389k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 389k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 389k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 389k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 389k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 389k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 389k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 389k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 389k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 389k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 389k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 389k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 389k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 389k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 389k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 389k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 389k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 389k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 389k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 389k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 28| 389k| thetaRhoPiChiIotaPrepareTheta( 8, A, E) \ | | ------------------ | | | | 508| 389k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 389k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 389k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 389k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 389k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 389k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 389k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 389k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 389k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 389k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 389k|\ | | | | 519| 389k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 389k| Bba = A##ba; \ | | | | 521| 389k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 389k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 389k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 389k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 389k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 389k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 389k| Ca = E##ba; \ | | | | 528| 389k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 389k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 389k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 389k| Ce = E##be; \ | | | | 532| 389k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 389k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 389k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 389k| Ci = E##bi; \ | | | | 536| 389k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 389k| Co = E##bo; \ | | | | 538| 389k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 389k| Cu = E##bu; \ | | | | 540| 389k|\ | | | | 541| 389k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 389k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 389k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 389k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 389k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 389k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 389k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 389k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 389k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 389k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 389k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 389k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 389k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 389k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 389k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 389k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 389k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 389k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 389k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 389k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 389k|\ | | | | 562| 389k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 389k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 389k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 389k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 389k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 389k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 389k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 389k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 389k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 389k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 389k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 389k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 389k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 389k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 389k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 389k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 389k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 389k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 389k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 389k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 389k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 389k|\ | | | | 583| 389k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 389k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 389k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 389k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 389k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 389k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 389k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 389k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 389k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 389k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 389k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 389k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 389k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 389k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 389k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 389k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 389k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 389k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 389k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 389k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 389k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 389k|\ | | | | 604| 389k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 389k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 389k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 389k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 389k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 389k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 389k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 389k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 389k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 389k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 389k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 389k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 389k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 389k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 389k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 389k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 389k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 389k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 389k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 389k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 29| 389k| thetaRhoPiChiIotaPrepareTheta( 9, E, A) \ | | ------------------ | | | | 508| 389k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 389k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 389k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 389k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 389k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 389k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 389k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 389k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 389k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 389k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 389k|\ | | | | 519| 389k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 389k| Bba = A##ba; \ | | | | 521| 389k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 389k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 389k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 389k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 389k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 389k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 389k| Ca = E##ba; \ | | | | 528| 389k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 389k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 389k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 389k| Ce = E##be; \ | | | | 532| 389k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 389k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 389k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 389k| Ci = E##bi; \ | | | | 536| 389k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 389k| Co = E##bo; \ | | | | 538| 389k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 389k| Cu = E##bu; \ | | | | 540| 389k|\ | | | | 541| 389k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 389k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 389k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 389k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 389k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 389k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 389k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 389k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 389k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 389k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 389k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 389k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 389k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 389k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 389k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 389k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 389k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 389k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 389k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 389k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 389k|\ | | | | 562| 389k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 389k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 389k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 389k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 389k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 389k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 389k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 389k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 389k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 389k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 389k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 389k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 389k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 389k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 389k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 389k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 389k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 389k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 389k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 389k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 389k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 389k|\ | | | | 583| 389k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 389k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 389k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 389k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 389k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 389k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 389k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 389k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 389k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 389k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 389k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 389k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 389k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 389k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 389k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 389k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 389k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 389k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 389k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 389k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 389k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 389k|\ | | | | 604| 389k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 389k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 389k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 389k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 389k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 389k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 389k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 389k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 389k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 389k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 389k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 389k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 389k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 389k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 389k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 389k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 389k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 389k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 389k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 389k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 30| 389k| thetaRhoPiChiIotaPrepareTheta(10, A, E) \ | | ------------------ | | | | 508| 389k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 389k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 389k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 389k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 389k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 389k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 389k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 389k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 389k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 389k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 389k|\ | | | | 519| 389k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 389k| Bba = A##ba; \ | | | | 521| 389k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 389k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 389k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 389k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 389k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 389k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 389k| Ca = E##ba; \ | | | | 528| 389k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 389k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 389k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 389k| Ce = E##be; \ | | | | 532| 389k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 389k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 389k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 389k| Ci = E##bi; \ | | | | 536| 389k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 389k| Co = E##bo; \ | | | | 538| 389k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 389k| Cu = E##bu; \ | | | | 540| 389k|\ | | | | 541| 389k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 389k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 389k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 389k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 389k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 389k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 389k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 389k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 389k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 389k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 389k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 389k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 389k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 389k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 389k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 389k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 389k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 389k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 389k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 389k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 389k|\ | | | | 562| 389k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 389k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 389k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 389k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 389k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 389k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 389k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 389k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 389k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 389k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 389k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 389k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 389k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 389k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 389k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 389k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 389k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 389k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 389k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 389k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 389k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 389k|\ | | | | 583| 389k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 389k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 389k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 389k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 389k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 389k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 389k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 389k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 389k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 389k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 389k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 389k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 389k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 389k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 389k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 389k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 389k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 389k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 389k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 389k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 389k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 389k|\ | | | | 604| 389k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 389k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 389k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 389k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 389k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 389k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 389k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 389k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 389k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 389k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 389k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 389k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 389k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 389k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 389k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 389k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 389k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 389k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 389k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 389k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 31| 389k| thetaRhoPiChiIotaPrepareTheta(11, E, A) \ | | ------------------ | | | | 508| 389k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 389k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 389k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 389k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 389k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 389k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 389k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 389k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 389k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 389k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 389k|\ | | | | 519| 389k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 389k| Bba = A##ba; \ | | | | 521| 389k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 389k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 389k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 389k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 389k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 389k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 389k| Ca = E##ba; \ | | | | 528| 389k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 389k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 389k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 389k| Ce = E##be; \ | | | | 532| 389k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 389k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 389k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 389k| Ci = E##bi; \ | | | | 536| 389k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 389k| Co = E##bo; \ | | | | 538| 389k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 389k| Cu = E##bu; \ | | | | 540| 389k|\ | | | | 541| 389k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 389k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 389k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 389k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 389k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 389k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 389k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 389k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 389k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 389k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 389k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 389k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 389k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 389k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 389k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 389k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 389k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 389k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 389k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 389k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 389k|\ | | | | 562| 389k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 389k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 389k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 389k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 389k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 389k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 389k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 389k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 389k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 389k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 389k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 389k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 389k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 389k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 389k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 389k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 389k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 389k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 389k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 389k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 389k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 389k|\ | | | | 583| 389k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 389k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 389k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 389k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 389k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 389k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 389k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 389k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 389k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 389k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 389k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 389k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 389k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 389k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 389k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 389k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 389k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 389k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 389k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 389k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 389k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 389k|\ | | | | 604| 389k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 389k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 389k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 389k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 389k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 389k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 389k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 389k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 389k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 389k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 389k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 389k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 389k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 389k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 389k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 389k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 389k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 389k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 389k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 389k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 32| 389k| thetaRhoPiChiIotaPrepareTheta(12, A, E) \ | | ------------------ | | | | 508| 389k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 389k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 389k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 389k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 389k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 389k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 389k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 389k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 389k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 389k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 389k|\ | | | | 519| 389k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 389k| Bba = A##ba; \ | | | | 521| 389k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 389k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 389k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 389k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 389k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 389k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 389k| Ca = E##ba; \ | | | | 528| 389k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 389k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 389k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 389k| Ce = E##be; \ | | | | 532| 389k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 389k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 389k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 389k| Ci = E##bi; \ | | | | 536| 389k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 389k| Co = E##bo; \ | | | | 538| 389k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 389k| Cu = E##bu; \ | | | | 540| 389k|\ | | | | 541| 389k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 389k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 389k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 389k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 389k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 389k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 389k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 389k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 389k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 389k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 389k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 389k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 389k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 389k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 389k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 389k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 389k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 389k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 389k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 389k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 389k|\ | | | | 562| 389k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 389k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 389k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 389k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 389k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 389k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 389k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 389k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 389k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 389k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 389k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 389k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 389k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 389k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 389k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 389k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 389k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 389k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 389k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 389k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 389k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 389k|\ | | | | 583| 389k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 389k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 389k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 389k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 389k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 389k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 389k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 389k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 389k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 389k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 389k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 389k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 389k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 389k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 389k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 389k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 389k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 389k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 389k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 389k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 389k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 389k|\ | | | | 604| 389k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 389k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 389k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 389k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 389k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 389k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 389k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 389k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 389k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 389k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 389k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 389k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 389k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 389k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 389k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 389k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 389k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 389k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 389k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 389k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 33| 389k| thetaRhoPiChiIotaPrepareTheta(13, E, A) \ | | ------------------ | | | | 508| 389k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 389k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 389k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 389k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 389k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 389k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 389k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 389k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 389k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 389k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 389k|\ | | | | 519| 389k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 389k| Bba = A##ba; \ | | | | 521| 389k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 389k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 389k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 389k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 389k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 389k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 389k| Ca = E##ba; \ | | | | 528| 389k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 389k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 389k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 389k| Ce = E##be; \ | | | | 532| 389k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 389k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 389k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 389k| Ci = E##bi; \ | | | | 536| 389k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 389k| Co = E##bo; \ | | | | 538| 389k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 389k| Cu = E##bu; \ | | | | 540| 389k|\ | | | | 541| 389k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 389k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 389k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 389k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 389k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 389k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 389k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 389k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 389k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 389k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 389k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 389k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 389k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 389k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 389k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 389k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 389k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 389k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 389k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 389k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 389k|\ | | | | 562| 389k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 389k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 389k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 389k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 389k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 389k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 389k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 389k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 389k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 389k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 389k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 389k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 389k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 389k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 389k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 389k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 389k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 389k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 389k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 389k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 389k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 389k|\ | | | | 583| 389k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 389k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 389k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 389k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 389k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 389k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 389k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 389k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 389k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 389k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 389k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 389k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 389k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 389k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 389k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 389k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 389k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 389k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 389k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 389k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 389k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 389k|\ | | | | 604| 389k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 389k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 389k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 389k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 389k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 389k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 389k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 389k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 389k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 389k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 389k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 389k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 389k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 389k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 389k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 389k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 389k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 389k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 389k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 389k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 34| 389k| thetaRhoPiChiIotaPrepareTheta(14, A, E) \ | | ------------------ | | | | 508| 389k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 389k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 389k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 389k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 389k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 389k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 389k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 389k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 389k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 389k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 389k|\ | | | | 519| 389k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 389k| Bba = A##ba; \ | | | | 521| 389k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 389k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 389k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 389k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 389k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 389k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 389k| Ca = E##ba; \ | | | | 528| 389k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 389k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 389k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 389k| Ce = E##be; \ | | | | 532| 389k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 389k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 389k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 389k| Ci = E##bi; \ | | | | 536| 389k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 389k| Co = E##bo; \ | | | | 538| 389k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 389k| Cu = E##bu; \ | | | | 540| 389k|\ | | | | 541| 389k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 389k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 389k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 389k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 389k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 389k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 389k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 389k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 389k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 389k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 389k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 389k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 389k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 389k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 389k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 389k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 389k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 389k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 389k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 389k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 389k|\ | | | | 562| 389k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 389k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 389k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 389k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 389k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 389k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 389k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 389k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 389k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 389k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 389k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 389k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 389k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 389k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 389k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 389k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 389k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 389k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 389k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 389k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 389k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 389k|\ | | | | 583| 389k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 389k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 389k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 389k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 389k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 389k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 389k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 389k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 389k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 389k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 389k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 389k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 389k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 389k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 389k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 389k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 389k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 389k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 389k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 389k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 389k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 389k|\ | | | | 604| 389k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 389k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 389k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 389k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 389k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 389k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 389k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 389k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 389k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 389k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 389k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 389k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 389k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 389k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 389k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 389k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 389k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 389k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 389k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 389k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 35| 389k| thetaRhoPiChiIotaPrepareTheta(15, E, A) \ | | ------------------ | | | | 508| 389k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 389k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 389k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 389k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 389k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 389k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 389k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 389k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 389k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 389k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 389k|\ | | | | 519| 389k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 389k| Bba = A##ba; \ | | | | 521| 389k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 389k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 389k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 389k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 389k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 389k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 389k| Ca = E##ba; \ | | | | 528| 389k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 389k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 389k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 389k| Ce = E##be; \ | | | | 532| 389k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 389k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 389k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 389k| Ci = E##bi; \ | | | | 536| 389k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 389k| Co = E##bo; \ | | | | 538| 389k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 389k| Cu = E##bu; \ | | | | 540| 389k|\ | | | | 541| 389k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 389k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 389k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 389k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 389k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 389k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 389k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 389k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 389k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 389k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 389k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 389k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 389k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 389k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 389k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 389k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 389k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 389k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 389k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 389k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 389k|\ | | | | 562| 389k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 389k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 389k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 389k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 389k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 389k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 389k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 389k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 389k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 389k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 389k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 389k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 389k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 389k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 389k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 389k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 389k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 389k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 389k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 389k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 389k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 389k|\ | | | | 583| 389k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 389k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 389k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 389k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 389k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 389k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 389k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 389k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 389k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 389k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 389k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 389k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 389k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 389k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 389k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 389k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 389k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 389k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 389k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 389k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 389k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 389k|\ | | | | 604| 389k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 389k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 389k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 389k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 389k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 389k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 389k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 389k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 389k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 389k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 389k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 389k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 389k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 389k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 389k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 389k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 389k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 389k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 389k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 389k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 36| 389k| thetaRhoPiChiIotaPrepareTheta(16, A, E) \ | | ------------------ | | | | 508| 389k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 389k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 389k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 389k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 389k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 389k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 389k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 389k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 389k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 389k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 389k|\ | | | | 519| 389k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 389k| Bba = A##ba; \ | | | | 521| 389k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 389k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 389k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 389k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 389k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 389k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 389k| Ca = E##ba; \ | | | | 528| 389k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 389k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 389k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 389k| Ce = E##be; \ | | | | 532| 389k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 389k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 389k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 389k| Ci = E##bi; \ | | | | 536| 389k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 389k| Co = E##bo; \ | | | | 538| 389k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 389k| Cu = E##bu; \ | | | | 540| 389k|\ | | | | 541| 389k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 389k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 389k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 389k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 389k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 389k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 389k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 389k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 389k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 389k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 389k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 389k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 389k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 389k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 389k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 389k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 389k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 389k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 389k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 389k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 389k|\ | | | | 562| 389k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 389k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 389k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 389k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 389k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 389k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 389k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 389k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 389k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 389k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 389k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 389k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 389k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 389k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 389k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 389k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 389k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 389k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 389k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 389k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 389k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 389k|\ | | | | 583| 389k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 389k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 389k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 389k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 389k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 389k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 389k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 389k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 389k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 389k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 389k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 389k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 389k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 389k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 389k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 389k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 389k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 389k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 389k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 389k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 389k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 389k|\ | | | | 604| 389k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 389k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 389k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 389k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 389k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 389k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 389k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 389k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 389k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 389k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 389k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 389k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 389k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 389k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 389k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 389k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 389k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 389k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 389k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 389k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 37| 389k| thetaRhoPiChiIotaPrepareTheta(17, E, A) \ | | ------------------ | | | | 508| 389k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 389k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 389k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 389k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 389k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 389k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 389k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 389k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 389k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 389k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 389k|\ | | | | 519| 389k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 389k| Bba = A##ba; \ | | | | 521| 389k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 389k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 389k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 389k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 389k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 389k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 389k| Ca = E##ba; \ | | | | 528| 389k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 389k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 389k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 389k| Ce = E##be; \ | | | | 532| 389k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 389k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 389k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 389k| Ci = E##bi; \ | | | | 536| 389k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 389k| Co = E##bo; \ | | | | 538| 389k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 389k| Cu = E##bu; \ | | | | 540| 389k|\ | | | | 541| 389k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 389k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 389k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 389k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 389k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 389k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 389k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 389k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 389k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 389k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 389k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 389k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 389k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 389k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 389k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 389k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 389k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 389k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 389k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 389k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 389k|\ | | | | 562| 389k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 389k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 389k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 389k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 389k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 389k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 389k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 389k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 389k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 389k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 389k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 389k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 389k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 389k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 389k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 389k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 389k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 389k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 389k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 389k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 389k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 389k|\ | | | | 583| 389k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 389k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 389k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 389k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 389k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 389k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 389k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 389k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 389k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 389k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 389k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 389k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 389k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 389k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 389k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 389k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 389k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 389k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 389k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 389k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 389k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 389k|\ | | | | 604| 389k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 389k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 389k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 389k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 389k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 389k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 389k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 389k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 389k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 389k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 389k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 389k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 389k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 389k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 389k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 389k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 389k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 389k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 389k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 389k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 38| 389k| thetaRhoPiChiIotaPrepareTheta(18, A, E) \ | | ------------------ | | | | 508| 389k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 389k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 389k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 389k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 389k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 389k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 389k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 389k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 389k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 389k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 389k|\ | | | | 519| 389k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 389k| Bba = A##ba; \ | | | | 521| 389k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 389k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 389k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 389k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 389k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 389k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 389k| Ca = E##ba; \ | | | | 528| 389k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 389k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 389k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 389k| Ce = E##be; \ | | | | 532| 389k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 389k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 389k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 389k| Ci = E##bi; \ | | | | 536| 389k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 389k| Co = E##bo; \ | | | | 538| 389k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 389k| Cu = E##bu; \ | | | | 540| 389k|\ | | | | 541| 389k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 389k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 389k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 389k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 389k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 389k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 389k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 389k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 389k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 389k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 389k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 389k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 389k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 389k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 389k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 389k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 389k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 389k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 389k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 389k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 389k|\ | | | | 562| 389k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 389k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 389k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 389k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 389k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 389k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 389k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 389k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 389k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 389k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 389k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 389k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 389k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 389k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 389k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 389k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 389k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 389k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 389k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 389k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 389k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 389k|\ | | | | 583| 389k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 389k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 389k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 389k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 389k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 389k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 389k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 389k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 389k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 389k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 389k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 389k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 389k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 389k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 389k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 389k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 389k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 389k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 389k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 389k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 389k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 389k|\ | | | | 604| 389k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 389k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 389k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 389k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 389k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 389k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 389k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 389k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 389k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 389k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 389k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 389k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 389k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 389k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 389k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 389k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 389k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 389k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 389k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 389k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 39| 389k| thetaRhoPiChiIotaPrepareTheta(19, E, A) \ | | ------------------ | | | | 508| 389k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 389k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 389k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 389k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 389k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 389k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 389k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 389k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 389k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 389k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 389k|\ | | | | 519| 389k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 389k| Bba = A##ba; \ | | | | 521| 389k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 389k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 389k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 389k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 389k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 389k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 389k| Ca = E##ba; \ | | | | 528| 389k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 389k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 389k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 389k| Ce = E##be; \ | | | | 532| 389k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 389k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 389k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 389k| Ci = E##bi; \ | | | | 536| 389k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 389k| Co = E##bo; \ | | | | 538| 389k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 389k| Cu = E##bu; \ | | | | 540| 389k|\ | | | | 541| 389k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 389k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 389k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 389k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 389k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 389k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 389k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 389k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 389k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 389k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 389k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 389k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 389k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 389k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 389k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 389k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 389k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 389k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 389k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 389k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 389k|\ | | | | 562| 389k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 389k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 389k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 389k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 389k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 389k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 389k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 389k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 389k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 389k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 389k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 389k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 389k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 389k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 389k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 389k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 389k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 389k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 389k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 389k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 389k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 389k|\ | | | | 583| 389k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 389k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 389k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 389k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 389k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 389k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 389k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 389k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 389k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 389k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 389k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 389k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 389k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 389k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 389k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 389k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 389k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 389k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 389k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 389k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 389k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 389k|\ | | | | 604| 389k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 389k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 389k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 389k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 389k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 389k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 389k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 389k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 389k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 389k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 389k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 389k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 389k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 389k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 389k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 389k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 389k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 389k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 389k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 389k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 40| 389k| thetaRhoPiChiIotaPrepareTheta(20, A, E) \ | | ------------------ | | | | 508| 389k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 389k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 389k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 389k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 389k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 389k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 389k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 389k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 389k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 389k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 389k|\ | | | | 519| 389k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 389k| Bba = A##ba; \ | | | | 521| 389k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 389k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 389k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 389k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 389k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 389k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 389k| Ca = E##ba; \ | | | | 528| 389k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 389k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 389k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 389k| Ce = E##be; \ | | | | 532| 389k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 389k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 389k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 389k| Ci = E##bi; \ | | | | 536| 389k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 389k| Co = E##bo; \ | | | | 538| 389k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 389k| Cu = E##bu; \ | | | | 540| 389k|\ | | | | 541| 389k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 389k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 389k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 389k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 389k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 389k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 389k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 389k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 389k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 389k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 389k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 389k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 389k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 389k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 389k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 389k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 389k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 389k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 389k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 389k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 389k|\ | | | | 562| 389k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 389k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 389k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 389k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 389k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 389k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 389k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 389k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 389k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 389k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 389k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 389k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 389k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 389k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 389k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 389k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 389k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 389k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 389k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 389k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 389k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 389k|\ | | | | 583| 389k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 389k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 389k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 389k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 389k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 389k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 389k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 389k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 389k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 389k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 389k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 389k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 389k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 389k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 389k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 389k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 389k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 389k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 389k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 389k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 389k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 389k|\ | | | | 604| 389k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 389k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 389k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 389k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 389k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 389k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 389k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 389k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 389k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 389k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 389k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 389k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 389k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 389k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 389k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 389k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 389k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 389k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 389k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 389k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 41| 389k| thetaRhoPiChiIotaPrepareTheta(21, E, A) \ | | ------------------ | | | | 508| 389k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 389k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 389k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 389k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 389k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 389k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 389k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 389k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 389k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 389k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 389k|\ | | | | 519| 389k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 389k| Bba = A##ba; \ | | | | 521| 389k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 389k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 389k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 389k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 389k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 389k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 389k| Ca = E##ba; \ | | | | 528| 389k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 389k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 389k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 389k| Ce = E##be; \ | | | | 532| 389k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 389k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 389k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 389k| Ci = E##bi; \ | | | | 536| 389k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 389k| Co = E##bo; \ | | | | 538| 389k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 389k| Cu = E##bu; \ | | | | 540| 389k|\ | | | | 541| 389k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 389k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 389k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 389k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 389k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 389k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 389k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 389k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 389k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 389k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 389k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 389k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 389k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 389k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 389k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 389k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 389k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 389k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 389k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 389k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 389k|\ | | | | 562| 389k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 389k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 389k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 389k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 389k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 389k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 389k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 389k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 389k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 389k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 389k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 389k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 389k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 389k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 389k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 389k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 389k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 389k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 389k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 389k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 389k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 389k|\ | | | | 583| 389k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 389k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 389k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 389k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 389k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 389k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 389k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 389k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 389k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 389k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 389k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 389k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 389k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 389k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 389k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 389k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 389k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 389k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 389k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 389k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 389k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 389k|\ | | | | 604| 389k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 389k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 389k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 389k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 389k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 389k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 389k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 389k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 389k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 389k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 389k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 389k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 389k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 389k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 389k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 389k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 389k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 389k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 389k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 389k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 42| 389k| thetaRhoPiChiIotaPrepareTheta(22, A, E) \ | | ------------------ | | | | 508| 389k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 509| 389k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 510| 389k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 511| 389k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 512| 389k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 513| 389k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 514| 389k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 515| 389k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 516| 389k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 517| 389k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 518| 389k|\ | | | | 519| 389k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 520| 389k| Bba = A##ba; \ | | | | 521| 389k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 522| 389k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 523| 389k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 524| 389k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 525| 389k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 526| 389k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 527| 389k| Ca = E##ba; \ | | | | 528| 389k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 529| 389k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 530| 389k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 531| 389k| Ce = E##be; \ | | | | 532| 389k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 533| 389k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 534| 389k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 535| 389k| Ci = E##bi; \ | | | | 536| 389k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 537| 389k| Co = E##bo; \ | | | | 538| 389k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 539| 389k| Cu = E##bu; \ | | | | 540| 389k|\ | | | | 541| 389k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 542| 389k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 543| 389k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 544| 389k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 545| 389k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 546| 389k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 547| 389k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 548| 389k| XOReq256(Ca, E##ga); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 549| 389k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 550| 389k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 551| 389k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 552| 389k| XOReq256(Ce, E##ge); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 553| 389k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 554| 389k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 555| 389k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 556| 389k| XOReq256(Ci, E##gi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 557| 389k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 558| 389k| XOReq256(Co, E##go); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 559| 389k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 560| 389k| XOReq256(Cu, E##gu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 561| 389k|\ | | | | 562| 389k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 563| 389k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 564| 389k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 565| 389k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 566| 389k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 567| 389k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 568| 389k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 569| 389k| XOReq256(Ca, E##ka); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 570| 389k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 571| 389k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 389k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 572| 389k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 573| 389k| XOReq256(Ce, E##ke); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 574| 389k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 575| 389k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 576| 389k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 577| 389k| XOReq256(Ci, E##ki); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 578| 389k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 579| 389k| XOReq256(Co, E##ko); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 580| 389k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 581| 389k| XOReq256(Cu, E##ku); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 582| 389k|\ | | | | 583| 389k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 584| 389k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 585| 389k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 586| 389k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 587| 389k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 588| 389k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 589| 389k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 590| 389k| XOReq256(Ca, E##ma); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 591| 389k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 592| 389k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 593| 389k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 594| 389k| XOReq256(Ce, E##me); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 595| 389k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 596| 389k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 389k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 597| 389k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 598| 389k| XOReq256(Ci, E##mi); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 599| 389k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 600| 389k| XOReq256(Co, E##mo); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 601| 389k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 602| 389k| XOReq256(Cu, E##mu); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 603| 389k|\ | | | | 604| 389k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 605| 389k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 606| 389k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 607| 389k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 608| 389k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 609| 389k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 610| 389k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 611| 389k| XOReq256(Ca, E##sa); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 612| 389k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 613| 389k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 614| 389k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 615| 389k| XOReq256(Ce, E##se); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 616| 389k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 617| 389k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 618| 389k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 619| 389k| XOReq256(Ci, E##si); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 620| 389k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 621| 389k| XOReq256(Co, E##so); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 622| 389k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 623| 389k| XOReq256(Cu, E##su); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ | | 43| 389k| thetaRhoPiChiIota(23, E, A) \ | | ------------------ | | | | 629| 389k| ROL64in256(Ce1, Ce, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 630| 389k| Da = XOR256(Cu, Ce1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 631| 389k| ROL64in256(Ci1, Ci, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 632| 389k| De = XOR256(Ca, Ci1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 633| 389k| ROL64in256(Co1, Co, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 634| 389k| Di = XOR256(Ce, Co1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 635| 389k| ROL64in256(Cu1, Cu, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 636| 389k| Do = XOR256(Ci, Cu1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 637| 389k| ROL64in256(Ca1, Ca, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 638| 389k| Du = XOR256(Co, Ca1); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 639| 389k|\ | | | | 640| 389k| XOReq256(A##ba, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 641| 389k| Bba = A##ba; \ | | | | 642| 389k| XOReq256(A##ge, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 643| 389k| ROL64in256(Bbe, A##ge, 44); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 644| 389k| XOReq256(A##ki, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 645| 389k| ROL64in256(Bbi, A##ki, 43); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 646| 389k| E##ba = XOR256(Bba, ANDnu256(Bbe, Bbi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 647| 389k| XOReq256(E##ba, CONST256_64(KeccakF1600RoundConstants[i])); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 648| 389k| XOReq256(A##mo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 649| 389k| ROL64in256(Bbo, A##mo, 21); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 650| 389k| E##be = XOR256(Bbe, ANDnu256(Bbi, Bbo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 651| 389k| XOReq256(A##su, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 652| 389k| ROL64in256(Bbu, A##su, 14); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 653| 389k| E##bi = XOR256(Bbi, ANDnu256(Bbo, Bbu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 654| 389k| E##bo = XOR256(Bbo, ANDnu256(Bbu, Bba)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 655| 389k| E##bu = XOR256(Bbu, ANDnu256(Bba, Bbe)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 656| 389k|\ | | | | 657| 389k| XOReq256(A##bo, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 658| 389k| ROL64in256(Bga, A##bo, 28); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 659| 389k| XOReq256(A##gu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 660| 389k| ROL64in256(Bge, A##gu, 20); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 661| 389k| XOReq256(A##ka, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 662| 389k| ROL64in256(Bgi, A##ka, 3); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 663| 389k| E##ga = XOR256(Bga, ANDnu256(Bge, Bgi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 664| 389k| XOReq256(A##me, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 665| 389k| ROL64in256(Bgo, A##me, 45); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 666| 389k| E##ge = XOR256(Bge, ANDnu256(Bgi, Bgo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 667| 389k| XOReq256(A##si, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 668| 389k| ROL64in256(Bgu, A##si, 61); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 669| 389k| E##gi = XOR256(Bgi, ANDnu256(Bgo, Bgu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 670| 389k| E##go = XOR256(Bgo, ANDnu256(Bgu, Bga)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 671| 389k| E##gu = XOR256(Bgu, ANDnu256(Bga, Bge)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 672| 389k|\ | | | | 673| 389k| XOReq256(A##be, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 674| 389k| ROL64in256(Bka, A##be, 1); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 675| 389k| XOReq256(A##gi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 676| 389k| ROL64in256(Bke, A##gi, 6); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 677| 389k| XOReq256(A##ko, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 678| 389k| ROL64in256(Bki, A##ko, 25); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 679| 389k| E##ka = XOR256(Bka, ANDnu256(Bke, Bki)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 680| 389k| XOReq256(A##mu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 681| 389k| ROL64in256_8(Bko, A##mu); \ | | | | ------------------ | | | | | | 52| 389k|#define ROL64in256_8(d, a) d = _mm256_shuffle_epi8(a, rho8.v) | | | | ------------------ | | | | 682| 389k| E##ke = XOR256(Bke, ANDnu256(Bki, Bko)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 683| 389k| XOReq256(A##sa, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 684| 389k| ROL64in256(Bku, A##sa, 18); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 685| 389k| E##ki = XOR256(Bki, ANDnu256(Bko, Bku)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 686| 389k| E##ko = XOR256(Bko, ANDnu256(Bku, Bka)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 687| 389k| E##ku = XOR256(Bku, ANDnu256(Bka, Bke)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 688| 389k|\ | | | | 689| 389k| XOReq256(A##bu, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 690| 389k| ROL64in256(Bma, A##bu, 27); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 691| 389k| XOReq256(A##ga, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 692| 389k| ROL64in256(Bme, A##ga, 36); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 693| 389k| XOReq256(A##ke, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 694| 389k| ROL64in256(Bmi, A##ke, 10); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 695| 389k| E##ma = XOR256(Bma, ANDnu256(Bme, Bmi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 696| 389k| XOReq256(A##mi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 697| 389k| ROL64in256(Bmo, A##mi, 15); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 698| 389k| E##me = XOR256(Bme, ANDnu256(Bmi, Bmo)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 699| 389k| XOReq256(A##so, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 700| 389k| ROL64in256_56(Bmu, A##so); \ | | | | ------------------ | | | | | | 53| 389k|#define ROL64in256_56(d, a) d = _mm256_shuffle_epi8(a, rho56.v) | | | | ------------------ | | | | 701| 389k| E##mi = XOR256(Bmi, ANDnu256(Bmo, Bmu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 702| 389k| E##mo = XOR256(Bmo, ANDnu256(Bmu, Bma)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 703| 389k| E##mu = XOR256(Bmu, ANDnu256(Bma, Bme)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 704| 389k|\ | | | | 705| 389k| XOReq256(A##bi, Di); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 706| 389k| ROL64in256(Bsa, A##bi, 62); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 707| 389k| XOReq256(A##go, Do); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 708| 389k| ROL64in256(Bse, A##go, 55); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 709| 389k| XOReq256(A##ku, Du); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 710| 389k| ROL64in256(Bsi, A##ku, 39); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 711| 389k| E##sa = XOR256(Bsa, ANDnu256(Bse, Bsi)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 712| 389k| XOReq256(A##ma, Da); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 713| 389k| ROL64in256(Bso, A##ma, 41); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 714| 389k| E##se = XOR256(Bse, ANDnu256(Bsi, Bso)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 715| 389k| XOReq256(A##se, De); \ | | | | ------------------ | | | | | | 66| 389k|#define XOReq256(a, b) a = _mm256_xor_si256(a, b) | | | | ------------------ | | | | 716| 389k| ROL64in256(Bsu, A##se, 2); \ | | | | ------------------ | | | | | | 51| 389k|#define ROL64in256(d, a, o) d = _mm256_or_si256(_mm256_slli_epi64(a, o), _mm256_srli_epi64(a, 64-(o))) | | | | ------------------ | | | | 717| 389k| E##si = XOR256(Bsi, ANDnu256(Bso, Bsu)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 718| 389k| E##so = XOR256(Bso, ANDnu256(Bsu, Bsa)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | | | 719| 389k| E##su = XOR256(Bsu, ANDnu256(Bsa, Bse)); \ | | | | ------------------ | | | | | | 65| 389k|#define XOR256(a, b) _mm256_xor_si256(a, b) | | | | ------------------ | | ------------------ ------------------ 839| 389k| copyToState(statesAsLanes, A) ------------------ | | 777| 389k| STORE256(state[ 0], X##ba); \ | | ------------------ | | | | 62| 389k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 778| 389k| STORE256(state[ 1], X##be); \ | | ------------------ | | | | 62| 389k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 779| 389k| STORE256(state[ 2], X##bi); \ | | ------------------ | | | | 62| 389k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 780| 389k| STORE256(state[ 3], X##bo); \ | | ------------------ | | | | 62| 389k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 781| 389k| STORE256(state[ 4], X##bu); \ | | ------------------ | | | | 62| 389k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 782| 389k| STORE256(state[ 5], X##ga); \ | | ------------------ | | | | 62| 389k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 783| 389k| STORE256(state[ 6], X##ge); \ | | ------------------ | | | | 62| 389k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 784| 389k| STORE256(state[ 7], X##gi); \ | | ------------------ | | | | 62| 389k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 785| 389k| STORE256(state[ 8], X##go); \ | | ------------------ | | | | 62| 389k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 786| 389k| STORE256(state[ 9], X##gu); \ | | ------------------ | | | | 62| 389k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 787| 389k| STORE256(state[10], X##ka); \ | | ------------------ | | | | 62| 389k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 788| 389k| STORE256(state[11], X##ke); \ | | ------------------ | | | | 62| 389k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 789| 389k| STORE256(state[12], X##ki); \ | | ------------------ | | | | 62| 389k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 790| 389k| STORE256(state[13], X##ko); \ | | ------------------ | | | | 62| 389k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 791| 389k| STORE256(state[14], X##ku); \ | | ------------------ | | | | 62| 389k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 792| 389k| STORE256(state[15], X##ma); \ | | ------------------ | | | | 62| 389k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 793| 389k| STORE256(state[16], X##me); \ | | ------------------ | | | | 62| 389k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 794| 389k| STORE256(state[17], X##mi); \ | | ------------------ | | | | 62| 389k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 795| 389k| STORE256(state[18], X##mo); \ | | ------------------ | | | | 62| 389k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 796| 389k| STORE256(state[19], X##mu); \ | | ------------------ | | | | 62| 389k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 797| 389k| STORE256(state[20], X##sa); \ | | ------------------ | | | | 62| 389k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 798| 389k| STORE256(state[21], X##se); \ | | ------------------ | | | | 62| 389k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 799| 389k| STORE256(state[22], X##si); \ | | ------------------ | | | | 62| 389k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 800| 389k| STORE256(state[23], X##so); \ | | ------------------ | | | | 62| 389k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ | | 801| 389k| STORE256(state[24], X##su); \ | | ------------------ | | | | 62| 389k|#define STORE256(a, b) _mm256_store_si256((V256 *)&(a), b) | | ------------------ ------------------ 840| 389k|} KeccakP-1600-times4-SIMD256.c:load64: 93| 297k|static inline uint64_t load64(const unsigned char *x) { 94| 297k| return (uint64_t) x[0] \ 95| 297k| | (uint64_t) x[1] << 0x08 \ 96| 297k| | (uint64_t) x[2] << 0x10 \ 97| 297k| | (uint64_t) x[3] << 0x18 \ 98| 297k| | (uint64_t) x[4] << 0x20 \ 99| 297k| | (uint64_t) x[5] << 0x28 \ 100| 297k| | (uint64_t) x[6] << 0x30 \ 101| 297k| | (uint64_t) x[7] << 0x38; 102| 297k|} KeccakP-1600-times4-SIMD256.c:store64: 104| 32.2M|static void store64(unsigned char *out, uint64_t in) { 105| 32.2M| memcpy(out, &in, sizeof(uint64_t)); 106| 32.2M|} xkcp_sha3.c:SHA3_sha3_256: 202| 2.74k|static void SHA3_sha3_256(uint8_t *output, const uint8_t *input, size_t inlen) { 203| 2.74k| OQS_SHA3_sha3_256_inc_ctx s; 204| 2.74k| OQS_SHA3_sha3_256_inc_init(&s); 205| 2.74k| OQS_SHA3_sha3_256_inc_absorb(&s, input, inlen); 206| 2.74k| OQS_SHA3_sha3_256_inc_finalize(output, &s); 207| 2.74k| OQS_SHA3_sha3_256_inc_ctx_release(&s); 208| 2.74k|} xkcp_sha3.c:SHA3_sha3_256_inc_init: 210| 3.10k|static void SHA3_sha3_256_inc_init(OQS_SHA3_sha3_256_inc_ctx *state) { 211| 3.10k| state->ctx = OQS_MEM_aligned_alloc(KECCAK_CTX_ALIGNMENT, KECCAK_CTX_BYTES); ------------------ | | 24| 3.10k|#define KECCAK_CTX_ALIGNMENT 32 ------------------ state->ctx = OQS_MEM_aligned_alloc(KECCAK_CTX_ALIGNMENT, KECCAK_CTX_BYTES); ------------------ | | 26| 3.10k|#define KECCAK_CTX_BYTES (KECCAK_CTX_ALIGNMENT * \ | | ------------------ | | | | 24| 3.10k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | 27| 3.10k| ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 25| 3.10k|#define _KECCAK_CTX_BYTES (200+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 3.10k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 3.10k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ ------------------ 212| | 213| 3.10k| OQS_EXIT_IF_NULLPTR(state->ctx, "SHA3"); ------------------ | | 82| 3.10k| do { \ | | 83| 3.10k| if ((x) == (void *)0) { \ | | ------------------ | | | Branch (83:9): [True: 0, False: 3.10k] | | ------------------ | | 84| 0| fprintf(stderr, "Unexpected NULL returned from %s API. Exiting.\n", \ | | 85| 0| loc); \ | | 86| 0| exit(EXIT_FAILURE); \ | | 87| 0| } \ | | 88| 3.10k| } while (0) | | ------------------ | | | Branch (88:12): [Folded, False: 3.10k] | | ------------------ ------------------ 214| 3.10k| keccak_inc_reset((uint64_t *)state->ctx); 215| 3.10k|} xkcp_sha3.c:keccak_inc_reset: 96| 15.8k|static void keccak_inc_reset(uint64_t *s) { 97| 15.8k|#if OQS_USE_PTHREADS 98| 15.8k| pthread_once(&dispatch_once_control, Keccak_Dispatch); 99| |#else 100| | if (Keccak_Initialize_ptr == NULL) { 101| | Keccak_Dispatch(); 102| | } 103| |#endif 104| 15.8k| (*Keccak_Initialize_ptr)(s); 105| 15.8k| s[25] = 0; 106| 15.8k|} xkcp_sha3.c:Keccak_Dispatch: 42| 1|static void Keccak_Dispatch(void) { 43| |// TODO: Simplify this when we have a Windows-compatible AVX2 implementation of SHA3 44| 1|#if defined(OQS_DIST_X86_64_BUILD) 45| 1|#if defined(OQS_ENABLE_SHA3_xkcp_low_avx2) 46| 1|#if defined(OQS_USE_SHA3_AVX512VL) 47| 1| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX512)) { ------------------ | Branch (47:6): [True: 0, False: 1] ------------------ 48| 0| extern const struct OQS_SHA3_callbacks sha3_avx512vl_callbacks; 49| | 50| 0| sha3_default_callbacks = sha3_avx512vl_callbacks; 51| 0| } 52| 1|#endif 53| 1| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (53:6): [True: 1, False: 0] ------------------ 54| 1| Keccak_Initialize_ptr = &KeccakP1600_Initialize_avx2; 55| 1| Keccak_AddByte_ptr = &KeccakP1600_AddByte_avx2; 56| 1| Keccak_AddBytes_ptr = &KeccakP1600_AddBytes_avx2; 57| 1| Keccak_Permute_ptr = &KeccakP1600_Permute_24rounds_avx2; 58| 1| Keccak_ExtractBytes_ptr = &KeccakP1600_ExtractBytes_avx2; 59| 1| Keccak_FastLoopAbsorb_ptr = &KeccakF1600_FastLoop_Absorb_avx2; 60| 1| } else { 61| 0| Keccak_Initialize_ptr = &KeccakP1600_Initialize_plain64; 62| 0| Keccak_AddByte_ptr = &KeccakP1600_AddByte_plain64; 63| 0| Keccak_AddBytes_ptr = &KeccakP1600_AddBytes_plain64; 64| 0| Keccak_Permute_ptr = &KeccakP1600_Permute_24rounds_plain64; 65| 0| Keccak_ExtractBytes_ptr = &KeccakP1600_ExtractBytes_plain64; 66| 0| Keccak_FastLoopAbsorb_ptr = &KeccakF1600_FastLoop_Absorb_plain64; 67| 0| } 68| |#else // Windows 69| | Keccak_Initialize_ptr = &KeccakP1600_Initialize_plain64; 70| | Keccak_AddByte_ptr = &KeccakP1600_AddByte_plain64; 71| | Keccak_AddBytes_ptr = &KeccakP1600_AddBytes_plain64; 72| | Keccak_Permute_ptr = &KeccakP1600_Permute_24rounds_plain64; 73| | Keccak_ExtractBytes_ptr = &KeccakP1600_ExtractBytes_plain64; 74| | Keccak_FastLoopAbsorb_ptr = &KeccakF1600_FastLoop_Absorb_plain64; 75| |#endif 76| |#else 77| | Keccak_Initialize_ptr = &KeccakP1600_Initialize; 78| | Keccak_AddByte_ptr = &KeccakP1600_AddByte; 79| | Keccak_AddBytes_ptr = &KeccakP1600_AddBytes; 80| | Keccak_Permute_ptr = &KeccakP1600_Permute_24rounds; 81| | Keccak_ExtractBytes_ptr = &KeccakP1600_ExtractBytes; 82| | Keccak_FastLoopAbsorb_ptr = &KeccakF1600_FastLoop_Absorb; 83| |#endif 84| 1|} xkcp_sha3.c:SHA3_sha3_256_inc_absorb: 217| 3.96k|static void SHA3_sha3_256_inc_absorb(OQS_SHA3_sha3_256_inc_ctx *state, const uint8_t *input, size_t inlen) { 218| 3.96k| keccak_inc_absorb((uint64_t *)state->ctx, OQS_SHA3_SHA3_256_RATE, input, inlen); ------------------ | | 30| 3.96k|#define OQS_SHA3_SHA3_256_RATE 136 ------------------ 219| 3.96k|} xkcp_sha3.c:keccak_inc_absorb: 123| 18.0k| size_t mlen) { 124| 18.0k| uint64_t c = r - s[25]; 125| | 126| 18.0k| if (s[25] && mlen >= c) { ------------------ | Branch (126:6): [True: 2.60k, False: 15.4k] | Branch (126:15): [True: 412, False: 2.18k] ------------------ 127| 412| (*Keccak_AddBytes_ptr)(s, m, (unsigned int)s[25], (unsigned int)c); 128| 412| (*Keccak_Permute_ptr)(s); 129| 412| mlen -= c; 130| 412| m += c; 131| 412| s[25] = 0; 132| 412| } 133| | 134| |#ifdef KeccakF1600_FastLoop_supported 135| | if (mlen >= r) { 136| | c = (*Keccak_FastLoop_Absorb_ptr)(s, r / 8, m, mlen); 137| | mlen -= c; 138| | m += c; 139| | } 140| |#else 141| 99.7k| while (mlen >= r) { ------------------ | Branch (141:9): [True: 81.7k, False: 18.0k] ------------------ 142| 81.7k| (*Keccak_AddBytes_ptr)(s, m, 0, r); 143| 81.7k| (*Keccak_Permute_ptr)(s); 144| 81.7k| mlen -= r; 145| 81.7k| m += r; 146| 81.7k| } 147| 18.0k|#endif 148| | 149| 18.0k| (*Keccak_AddBytes_ptr)(s, m, (unsigned int)s[25], (unsigned int)mlen); 150| 18.0k| s[25] += mlen; 151| 18.0k|} xkcp_sha3.c:SHA3_sha3_256_inc_finalize: 221| 3.10k|static void SHA3_sha3_256_inc_finalize(uint8_t *output, OQS_SHA3_sha3_256_inc_ctx *state) { 222| 3.10k| keccak_inc_finalize((uint64_t *)state->ctx, OQS_SHA3_SHA3_256_RATE, 0x06); ------------------ | | 30| 3.10k|#define OQS_SHA3_SHA3_256_RATE 136 ------------------ 223| 3.10k| keccak_inc_squeeze(output, 32, (uint64_t *)state->ctx, OQS_SHA3_SHA3_256_RATE); ------------------ | | 30| 3.10k|#define OQS_SHA3_SHA3_256_RATE 136 ------------------ 224| 3.10k|} xkcp_sha3.c:keccak_inc_finalize: 166| 15.3k|static void keccak_inc_finalize(uint64_t *s, uint32_t r, uint8_t p) { 167| | /* After keccak_inc_absorb, we are guaranteed that s[25] < r, 168| | so we can always use one more byte for p in the current state. */ 169| 15.3k| (*Keccak_AddByte_ptr)(s, p, (unsigned int)s[25]); 170| 15.3k| (*Keccak_AddByte_ptr)(s, 0x80, (unsigned int)(r - 1)); 171| 15.3k| s[25] = 0; 172| 15.3k|} xkcp_sha3.c:keccak_inc_squeeze: 188| 52.6k| uint64_t *s, uint32_t r) { 189| 1.36M| while (outlen > s[25]) { ------------------ | Branch (189:9): [True: 1.31M, False: 52.6k] ------------------ 190| 1.31M| (*Keccak_ExtractBytes_ptr)(s, h, (unsigned int)(r - s[25]), (unsigned int)s[25]); 191| 1.31M| (*Keccak_Permute_ptr)(s); 192| 1.31M| h += s[25]; 193| 1.31M| outlen -= s[25]; 194| 1.31M| s[25] = r; 195| 1.31M| } 196| 52.6k| (*Keccak_ExtractBytes_ptr)(s, h, (unsigned int)(r - s[25]), (unsigned int)outlen); 197| 52.6k| s[25] -= outlen; 198| 52.6k|} xkcp_sha3.c:SHA3_sha3_256_inc_ctx_release: 226| 3.10k|static void SHA3_sha3_256_inc_ctx_release(OQS_SHA3_sha3_256_inc_ctx *state) { 227| 3.10k| OQS_MEM_aligned_secure_free(state->ctx, KECCAK_CTX_BYTES); ------------------ | | 26| 3.10k|#define KECCAK_CTX_BYTES (KECCAK_CTX_ALIGNMENT * \ | | ------------------ | | | | 24| 3.10k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | 27| 3.10k| ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 25| 3.10k|#define _KECCAK_CTX_BYTES (200+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 3.10k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 3.10k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ ------------------ 228| 3.10k|} xkcp_sha3.c:SHA3_sha3_384: 240| 28|static void SHA3_sha3_384(uint8_t *output, const uint8_t *input, size_t inlen) { 241| 28| OQS_SHA3_sha3_384_inc_ctx s; 242| 28| OQS_SHA3_sha3_384_inc_init(&s); 243| 28| OQS_SHA3_sha3_384_inc_absorb(&s, input, inlen); 244| 28| OQS_SHA3_sha3_384_inc_finalize(output, &s); 245| 28| OQS_SHA3_sha3_384_inc_ctx_release(&s); 246| 28|} xkcp_sha3.c:SHA3_sha3_384_inc_init: 248| 28|static void SHA3_sha3_384_inc_init(OQS_SHA3_sha3_384_inc_ctx *state) { 249| 28| state->ctx = OQS_MEM_aligned_alloc(KECCAK_CTX_ALIGNMENT, KECCAK_CTX_BYTES); ------------------ | | 24| 28|#define KECCAK_CTX_ALIGNMENT 32 ------------------ state->ctx = OQS_MEM_aligned_alloc(KECCAK_CTX_ALIGNMENT, KECCAK_CTX_BYTES); ------------------ | | 26| 28|#define KECCAK_CTX_BYTES (KECCAK_CTX_ALIGNMENT * \ | | ------------------ | | | | 24| 28|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | 27| 28| ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 25| 28|#define _KECCAK_CTX_BYTES (200+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 28|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 28|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ ------------------ 250| 28| OQS_EXIT_IF_NULLPTR(state->ctx, "SHA3"); ------------------ | | 82| 28| do { \ | | 83| 28| if ((x) == (void *)0) { \ | | ------------------ | | | Branch (83:9): [True: 0, False: 28] | | ------------------ | | 84| 0| fprintf(stderr, "Unexpected NULL returned from %s API. Exiting.\n", \ | | 85| 0| loc); \ | | 86| 0| exit(EXIT_FAILURE); \ | | 87| 0| } \ | | 88| 28| } while (0) | | ------------------ | | | Branch (88:12): [Folded, False: 28] | | ------------------ ------------------ 251| 28| keccak_inc_reset((uint64_t *)state->ctx); 252| 28|} xkcp_sha3.c:SHA3_sha3_384_inc_absorb: 253| 28|static void SHA3_sha3_384_inc_absorb(OQS_SHA3_sha3_384_inc_ctx *state, const uint8_t *input, size_t inlen) { 254| 28| keccak_inc_absorb((uint64_t *)state->ctx, OQS_SHA3_SHA3_384_RATE, input, inlen); ------------------ | | 99| 28|#define OQS_SHA3_SHA3_384_RATE 104 ------------------ 255| 28|} xkcp_sha3.c:SHA3_sha3_384_inc_finalize: 257| 28|static void SHA3_sha3_384_inc_finalize(uint8_t *output, OQS_SHA3_sha3_384_inc_ctx *state) { 258| 28| keccak_inc_finalize((uint64_t *)state->ctx, OQS_SHA3_SHA3_384_RATE, 0x06); ------------------ | | 99| 28|#define OQS_SHA3_SHA3_384_RATE 104 ------------------ 259| 28| keccak_inc_squeeze(output, 48, (uint64_t *)state->ctx, OQS_SHA3_SHA3_384_RATE); ------------------ | | 99| 28|#define OQS_SHA3_SHA3_384_RATE 104 ------------------ 260| 28|} xkcp_sha3.c:SHA3_sha3_384_inc_ctx_release: 262| 28|static void SHA3_sha3_384_inc_ctx_release(OQS_SHA3_sha3_384_inc_ctx *state) { 263| 28| OQS_MEM_aligned_secure_free(state->ctx, KECCAK_CTX_BYTES); ------------------ | | 26| 28|#define KECCAK_CTX_BYTES (KECCAK_CTX_ALIGNMENT * \ | | ------------------ | | | | 24| 28|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | 27| 28| ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 25| 28|#define _KECCAK_CTX_BYTES (200+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 28|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 28|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ ------------------ 264| 28|} xkcp_sha3.c:SHA3_sha3_512: 276| 1.12k|static void SHA3_sha3_512(uint8_t *output, const uint8_t *input, size_t inlen) { 277| 1.12k| OQS_SHA3_sha3_512_inc_ctx s; 278| 1.12k| OQS_SHA3_sha3_512_inc_init(&s); 279| 1.12k| OQS_SHA3_sha3_512_inc_absorb(&s, input, inlen); 280| 1.12k| OQS_SHA3_sha3_512_inc_finalize(output, &s); 281| 1.12k| OQS_SHA3_sha3_512_inc_ctx_release(&s); 282| 1.12k|} xkcp_sha3.c:SHA3_sha3_512_inc_init: 284| 1.48k|static void SHA3_sha3_512_inc_init(OQS_SHA3_sha3_512_inc_ctx *state) { 285| 1.48k| state->ctx = OQS_MEM_aligned_alloc(KECCAK_CTX_ALIGNMENT, KECCAK_CTX_BYTES); ------------------ | | 24| 1.48k|#define KECCAK_CTX_ALIGNMENT 32 ------------------ state->ctx = OQS_MEM_aligned_alloc(KECCAK_CTX_ALIGNMENT, KECCAK_CTX_BYTES); ------------------ | | 26| 1.48k|#define KECCAK_CTX_BYTES (KECCAK_CTX_ALIGNMENT * \ | | ------------------ | | | | 24| 1.48k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | 27| 1.48k| ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 25| 1.48k|#define _KECCAK_CTX_BYTES (200+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 1.48k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 1.48k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ ------------------ 286| 1.48k| OQS_EXIT_IF_NULLPTR(state->ctx, "SHA3"); ------------------ | | 82| 1.48k| do { \ | | 83| 1.48k| if ((x) == (void *)0) { \ | | ------------------ | | | Branch (83:9): [True: 0, False: 1.48k] | | ------------------ | | 84| 0| fprintf(stderr, "Unexpected NULL returned from %s API. Exiting.\n", \ | | 85| 0| loc); \ | | 86| 0| exit(EXIT_FAILURE); \ | | 87| 0| } \ | | 88| 1.48k| } while (0) | | ------------------ | | | Branch (88:12): [Folded, False: 1.48k] | | ------------------ ------------------ 287| 1.48k| keccak_inc_reset((uint64_t *)state->ctx); 288| 1.48k|} xkcp_sha3.c:SHA3_sha3_512_inc_absorb: 290| 2.34k|static void SHA3_sha3_512_inc_absorb(OQS_SHA3_sha3_512_inc_ctx *state, const uint8_t *input, size_t inlen) { 291| 2.34k| keccak_inc_absorb((uint64_t *)state->ctx, OQS_SHA3_SHA3_512_RATE, input, inlen); ------------------ | | 168| 2.34k|#define OQS_SHA3_SHA3_512_RATE 72 ------------------ 292| 2.34k|} xkcp_sha3.c:SHA3_sha3_512_inc_finalize: 294| 1.48k|static void SHA3_sha3_512_inc_finalize(uint8_t *output, OQS_SHA3_sha3_512_inc_ctx *state) { 295| 1.48k| keccak_inc_finalize((uint64_t *)state->ctx, OQS_SHA3_SHA3_512_RATE, 0x06); ------------------ | | 168| 1.48k|#define OQS_SHA3_SHA3_512_RATE 72 ------------------ 296| 1.48k| keccak_inc_squeeze(output, 64, (uint64_t *)state->ctx, OQS_SHA3_SHA3_512_RATE); ------------------ | | 168| 1.48k|#define OQS_SHA3_SHA3_512_RATE 72 ------------------ 297| 1.48k|} xkcp_sha3.c:SHA3_sha3_512_inc_ctx_release: 299| 1.48k|static void SHA3_sha3_512_inc_ctx_release(OQS_SHA3_sha3_512_inc_ctx *state) { 300| 1.48k| OQS_MEM_aligned_secure_free(state->ctx, KECCAK_CTX_BYTES); ------------------ | | 26| 1.48k|#define KECCAK_CTX_BYTES (KECCAK_CTX_ALIGNMENT * \ | | ------------------ | | | | 24| 1.48k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | 27| 1.48k| ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 25| 1.48k|#define _KECCAK_CTX_BYTES (200+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 1.48k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 1.48k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ ------------------ 301| 1.48k|} xkcp_sha3.c:SHA3_shake128: 313| 110|static void SHA3_shake128(uint8_t *output, size_t outlen, const uint8_t *input, size_t inlen) { 314| 110| OQS_SHA3_shake128_inc_ctx s; 315| 110| OQS_SHA3_shake128_inc_init(&s); 316| 110| OQS_SHA3_shake128_inc_absorb(&s, input, inlen); 317| 110| OQS_SHA3_shake128_inc_finalize(&s); 318| 110| OQS_SHA3_shake128_inc_squeeze(output, outlen, &s); 319| 110| OQS_SHA3_shake128_inc_ctx_release(&s); 320| 110|} xkcp_sha3.c:SHA3_shake128_inc_init: 324| 599|static void SHA3_shake128_inc_init(OQS_SHA3_shake128_inc_ctx *state) { 325| 599| state->ctx = OQS_MEM_aligned_alloc(KECCAK_CTX_ALIGNMENT, KECCAK_CTX_BYTES); ------------------ | | 24| 599|#define KECCAK_CTX_ALIGNMENT 32 ------------------ state->ctx = OQS_MEM_aligned_alloc(KECCAK_CTX_ALIGNMENT, KECCAK_CTX_BYTES); ------------------ | | 26| 599|#define KECCAK_CTX_BYTES (KECCAK_CTX_ALIGNMENT * \ | | ------------------ | | | | 24| 599|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | 27| 599| ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 25| 599|#define _KECCAK_CTX_BYTES (200+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 599|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 599|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ ------------------ 326| 599| OQS_EXIT_IF_NULLPTR(state->ctx, "SHA3"); ------------------ | | 82| 599| do { \ | | 83| 599| if ((x) == (void *)0) { \ | | ------------------ | | | Branch (83:9): [True: 0, False: 599] | | ------------------ | | 84| 0| fprintf(stderr, "Unexpected NULL returned from %s API. Exiting.\n", \ | | 85| 0| loc); \ | | 86| 0| exit(EXIT_FAILURE); \ | | 87| 0| } \ | | 88| 599| } while (0) | | ------------------ | | | Branch (88:12): [Folded, False: 599] | | ------------------ ------------------ 327| 599| keccak_inc_reset((uint64_t *)state->ctx); 328| 599|} xkcp_sha3.c:SHA3_shake128_inc_absorb: 330| 599|static void SHA3_shake128_inc_absorb(OQS_SHA3_shake128_inc_ctx *state, const uint8_t *input, size_t inlen) { 331| 599| keccak_inc_absorb((uint64_t *)state->ctx, OQS_SHA3_SHAKE128_RATE, input, inlen); ------------------ | | 239| 599|#define OQS_SHA3_SHAKE128_RATE 168 ------------------ 332| 599|} xkcp_sha3.c:SHA3_shake128_inc_finalize: 334| 599|static void SHA3_shake128_inc_finalize(OQS_SHA3_shake128_inc_ctx *state) { 335| 599| keccak_inc_finalize((uint64_t *)state->ctx, OQS_SHA3_SHAKE128_RATE, 0x1F); ------------------ | | 239| 599|#define OQS_SHA3_SHAKE128_RATE 168 ------------------ 336| 599|} xkcp_sha3.c:SHA3_shake128_inc_squeeze: 338| 665|static void SHA3_shake128_inc_squeeze(uint8_t *output, size_t outlen, OQS_SHA3_shake128_inc_ctx *state) { 339| 665| keccak_inc_squeeze(output, outlen, (uint64_t *)state->ctx, OQS_SHA3_SHAKE128_RATE); ------------------ | | 239| 665|#define OQS_SHA3_SHAKE128_RATE 168 ------------------ 340| 665|} xkcp_sha3.c:SHA3_shake128_inc_ctx_release: 346| 599|static void SHA3_shake128_inc_ctx_release(OQS_SHA3_shake128_inc_ctx *state) { 347| 599| OQS_MEM_aligned_secure_free(state->ctx, KECCAK_CTX_BYTES); ------------------ | | 26| 599|#define KECCAK_CTX_BYTES (KECCAK_CTX_ALIGNMENT * \ | | ------------------ | | | | 24| 599|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | 27| 599| ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 25| 599|#define _KECCAK_CTX_BYTES (200+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 599|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 599|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ ------------------ 348| 599|} xkcp_sha3.c:SHA3_shake128_inc_ctx_reset: 350| 489|static void SHA3_shake128_inc_ctx_reset(OQS_SHA3_shake128_inc_ctx *state) { 351| 489| keccak_inc_reset((uint64_t *)state->ctx); 352| 489|} xkcp_sha3.c:SHA3_shake256: 356| 9.09k|static void SHA3_shake256(uint8_t *output, size_t outlen, const uint8_t *input, size_t inlen) { 357| 9.09k| OQS_SHA3_shake256_inc_ctx s; 358| 9.09k| OQS_SHA3_shake256_inc_init(&s); 359| 9.09k| OQS_SHA3_shake256_inc_absorb(&s, input, inlen); 360| 9.09k| OQS_SHA3_shake256_inc_finalize(&s); 361| 9.09k| OQS_SHA3_shake256_inc_squeeze(output, outlen, &s); 362| 9.09k| OQS_SHA3_shake256_inc_ctx_release(&s); 363| 9.09k|} xkcp_sha3.c:SHA3_shake256_inc_init: 367| 10.0k|static void SHA3_shake256_inc_init(OQS_SHA3_shake256_inc_ctx *state) { 368| 10.0k| state->ctx = OQS_MEM_aligned_alloc(KECCAK_CTX_ALIGNMENT, KECCAK_CTX_BYTES); ------------------ | | 24| 10.0k|#define KECCAK_CTX_ALIGNMENT 32 ------------------ state->ctx = OQS_MEM_aligned_alloc(KECCAK_CTX_ALIGNMENT, KECCAK_CTX_BYTES); ------------------ | | 26| 10.0k|#define KECCAK_CTX_BYTES (KECCAK_CTX_ALIGNMENT * \ | | ------------------ | | | | 24| 10.0k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | 27| 10.0k| ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 25| 10.0k|#define _KECCAK_CTX_BYTES (200+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 10.0k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 10.0k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ ------------------ 369| 10.0k| OQS_EXIT_IF_NULLPTR(state->ctx, "SHA3"); ------------------ | | 82| 10.0k| do { \ | | 83| 10.0k| if ((x) == (void *)0) { \ | | ------------------ | | | Branch (83:9): [True: 0, False: 10.0k] | | ------------------ | | 84| 0| fprintf(stderr, "Unexpected NULL returned from %s API. Exiting.\n", \ | | 85| 0| loc); \ | | 86| 0| exit(EXIT_FAILURE); \ | | 87| 0| } \ | | 88| 10.0k| } while (0) | | ------------------ | | | Branch (88:12): [Folded, False: 10.0k] | | ------------------ ------------------ 370| 10.0k| keccak_inc_reset((uint64_t *)state->ctx); 371| 10.0k|} xkcp_sha3.c:SHA3_shake256_inc_absorb: 373| 11.0k|static void SHA3_shake256_inc_absorb(OQS_SHA3_shake256_inc_ctx *state, const uint8_t *input, size_t inlen) { 374| 11.0k| keccak_inc_absorb((uint64_t *)state->ctx, OQS_SHA3_SHAKE256_RATE, input, inlen); ------------------ | | 320| 11.0k|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 375| 11.0k|} xkcp_sha3.c:SHA3_shake256_inc_finalize: 377| 10.0k|static void SHA3_shake256_inc_finalize(OQS_SHA3_shake256_inc_ctx *state) { 378| 10.0k| keccak_inc_finalize((uint64_t *)state->ctx, OQS_SHA3_SHAKE256_RATE, 0x1F); ------------------ | | 320| 10.0k|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 379| 10.0k|} xkcp_sha3.c:SHA3_shake256_inc_squeeze: 381| 47.3k|static void SHA3_shake256_inc_squeeze(uint8_t *output, size_t outlen, OQS_SHA3_shake256_inc_ctx *state) { 382| 47.3k| keccak_inc_squeeze(output, outlen, state->ctx, OQS_SHA3_SHAKE256_RATE); ------------------ | | 320| 47.3k|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 383| 47.3k|} xkcp_sha3.c:SHA3_shake256_inc_ctx_release: 385| 10.0k|static void SHA3_shake256_inc_ctx_release(OQS_SHA3_shake256_inc_ctx *state) { 386| 10.0k| OQS_MEM_aligned_secure_free(state->ctx, KECCAK_CTX_BYTES); ------------------ | | 26| 10.0k|#define KECCAK_CTX_BYTES (KECCAK_CTX_ALIGNMENT * \ | | ------------------ | | | | 24| 10.0k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | 27| 10.0k| ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 25| 10.0k|#define _KECCAK_CTX_BYTES (200+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 10.0k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_CTX_BYTES + KECCAK_CTX_ALIGNMENT - 1)/KECCAK_CTX_ALIGNMENT)) | | ------------------ | | | | 24| 10.0k|#define KECCAK_CTX_ALIGNMENT 32 | | ------------------ ------------------ 387| 10.0k|} xkcp_sha3x4.c:SHA3_shake128_x4: 167| 27.9k|static void SHA3_shake128_x4(uint8_t *out0, uint8_t *out1, uint8_t *out2, uint8_t *out3, size_t outlen, const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 168| 27.9k| OQS_SHA3_shake128_x4_inc_ctx s; 169| 27.9k| OQS_SHA3_shake128_x4_inc_init(&s); 170| 27.9k| OQS_SHA3_shake128_x4_inc_absorb(&s, in0, in1, in2, in3, inlen); 171| 27.9k| OQS_SHA3_shake128_x4_inc_finalize(&s); 172| 27.9k| OQS_SHA3_shake128_x4_inc_squeeze(out0, out1, out2, out3, outlen, &s); 173| 27.9k| OQS_SHA3_shake128_x4_inc_ctx_release(&s); 174| 27.9k|} xkcp_sha3x4.c:SHA3_shake128_x4_inc_init: 178| 29.4k|static void SHA3_shake128_x4_inc_init(OQS_SHA3_shake128_x4_inc_ctx *state) { 179| 29.4k| state->ctx = OQS_MEM_aligned_alloc(KECCAK_X4_CTX_ALIGNMENT, KECCAK_X4_CTX_BYTES); ------------------ | | 19| 29.4k|#define KECCAK_X4_CTX_ALIGNMENT 32 ------------------ state->ctx = OQS_MEM_aligned_alloc(KECCAK_X4_CTX_ALIGNMENT, KECCAK_X4_CTX_BYTES); ------------------ | | 21| 29.4k|#define KECCAK_X4_CTX_BYTES (KECCAK_X4_CTX_ALIGNMENT * \ | | ------------------ | | | | 19| 29.4k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ | | 22| 29.4k| ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 20| 29.4k|#define _KECCAK_X4_CTX_BYTES (800+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 19| 29.4k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 19| 29.4k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ ------------------ 180| 29.4k| OQS_EXIT_IF_NULLPTR(state->ctx, "SHA3x4"); ------------------ | | 82| 29.4k| do { \ | | 83| 29.4k| if ((x) == (void *)0) { \ | | ------------------ | | | Branch (83:9): [True: 0, False: 29.4k] | | ------------------ | | 84| 0| fprintf(stderr, "Unexpected NULL returned from %s API. Exiting.\n", \ | | 85| 0| loc); \ | | 86| 0| exit(EXIT_FAILURE); \ | | 87| 0| } \ | | 88| 29.4k| } while (0) | | ------------------ | | | Branch (88:12): [Folded, False: 29.4k] | | ------------------ ------------------ 181| 29.4k| keccak_x4_inc_reset((uint64_t *)state->ctx); 182| 29.4k|} xkcp_sha3x4.c:keccak_x4_inc_reset: 76| 35.5k|static void keccak_x4_inc_reset(uint64_t *s) { 77| 35.5k|#if OQS_USE_PTHREADS 78| 35.5k| pthread_once(&dispatch_once_control, Keccak_X4_Dispatch); 79| |#else 80| | if (Keccak_X4_Initialize_ptr == NULL) { 81| | Keccak_X4_Dispatch(); 82| | } 83| |#endif 84| 35.5k| (*Keccak_X4_Initialize_ptr)(s); 85| 35.5k| s[100] = 0; 86| 35.5k|} xkcp_sha3x4.c:Keccak_X4_Dispatch: 36| 1|static void Keccak_X4_Dispatch(void) { 37| |// TODO: Simplify this when we have a Windows-compatible AVX2 implementation of SHA3 38| 1|#if defined(OQS_DIST_X86_64_BUILD) 39| 1|#if defined(OQS_ENABLE_SHA3_xkcp_low_avx2) 40| 1|#if defined(OQS_USE_SHA3_AVX512VL) 41| 1| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX512)) { ------------------ | Branch (41:6): [True: 0, False: 1] ------------------ 42| 0| extern const struct OQS_SHA3_x4_callbacks sha3_x4_avx512vl_callbacks; 43| | 44| 0| sha3_x4_default_callbacks = sha3_x4_avx512vl_callbacks; 45| 0| } 46| 1|#endif 47| 1| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (47:6): [True: 1, False: 0] ------------------ 48| 1| Keccak_X4_Initialize_ptr = &KeccakP1600times4_InitializeAll_avx2; 49| 1| Keccak_X4_AddByte_ptr = &KeccakP1600times4_AddByte_avx2; 50| 1| Keccak_X4_AddBytes_ptr = &KeccakP1600times4_AddBytes_avx2; 51| 1| Keccak_X4_Permute_ptr = &KeccakP1600times4_PermuteAll_24rounds_avx2; 52| 1| Keccak_X4_ExtractBytes_ptr = &KeccakP1600times4_ExtractBytes_avx2; 53| 1| } else { 54| 0| Keccak_X4_Initialize_ptr = &KeccakP1600times4_InitializeAll_serial; 55| 0| Keccak_X4_AddByte_ptr = &KeccakP1600times4_AddByte_serial; 56| 0| Keccak_X4_AddBytes_ptr = &KeccakP1600times4_AddBytes_serial; 57| 0| Keccak_X4_Permute_ptr = &KeccakP1600times4_PermuteAll_24rounds_serial; 58| 0| Keccak_X4_ExtractBytes_ptr = &KeccakP1600times4_ExtractBytes_serial; 59| 0| } 60| |#else // Windows 61| | Keccak_X4_Initialize_ptr = &KeccakP1600times4_InitializeAll_serial; 62| | Keccak_X4_AddByte_ptr = &KeccakP1600times4_AddByte_serial; 63| | Keccak_X4_AddBytes_ptr = &KeccakP1600times4_AddBytes_serial; 64| | Keccak_X4_Permute_ptr = &KeccakP1600times4_PermuteAll_24rounds_serial; 65| | Keccak_X4_ExtractBytes_ptr = &KeccakP1600times4_ExtractBytes_serial; 66| |#endif 67| |#else 68| | Keccak_X4_Initialize_ptr = &KeccakP1600times4_InitializeAll; 69| | Keccak_X4_AddByte_ptr = &KeccakP1600times4_AddByte; 70| | Keccak_X4_AddBytes_ptr = &KeccakP1600times4_AddBytes; 71| | Keccak_X4_Permute_ptr = &KeccakP1600times4_PermuteAll_24rounds; 72| | Keccak_X4_ExtractBytes_ptr = &KeccakP1600times4_ExtractBytes; 73| |#endif 74| 1|} xkcp_sha3x4.c:SHA3_shake128_x4_inc_absorb: 183| 30.6k|static void SHA3_shake128_x4_inc_absorb(OQS_SHA3_shake128_x4_inc_ctx *state, const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 184| 30.6k| keccak_x4_inc_absorb((uint64_t *)state->ctx, OQS_SHA3_SHAKE128_RATE, in0, in1, in2, in3, inlen); ------------------ | | 239| 30.6k|#define OQS_SHA3_SHAKE128_RATE 168 ------------------ 185| 30.6k|} xkcp_sha3x4.c:keccak_x4_inc_absorb: 89| 32.5k| const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 90| 32.5k| uint64_t c = r - s[100]; 91| | 92| 32.5k| if (s[100] && inlen >= c) { ------------------ | Branch (92:6): [True: 0, False: 32.5k] | Branch (92:16): [True: 0, False: 0] ------------------ 93| 0| (*Keccak_X4_AddBytes_ptr)(s, 0, in0, (unsigned int)s[100], (unsigned int)c); 94| 0| (*Keccak_X4_AddBytes_ptr)(s, 1, in1, (unsigned int)s[100], (unsigned int)c); 95| 0| (*Keccak_X4_AddBytes_ptr)(s, 2, in2, (unsigned int)s[100], (unsigned int)c); 96| 0| (*Keccak_X4_AddBytes_ptr)(s, 3, in3, (unsigned int)s[100], (unsigned int)c); 97| 0| (*Keccak_X4_Permute_ptr)(s); 98| 0| inlen -= c; 99| 0| in0 += c; 100| 0| in1 += c; 101| 0| in2 += c; 102| 0| in3 += c; 103| 0| s[100] = 0; 104| 0| } 105| | 106| 32.5k| while (inlen >= r) { ------------------ | Branch (106:9): [True: 0, False: 32.5k] ------------------ 107| 0| (*Keccak_X4_AddBytes_ptr)(s, 0, in0, 0, (unsigned int)r); 108| 0| (*Keccak_X4_AddBytes_ptr)(s, 1, in1, 0, (unsigned int)r); 109| 0| (*Keccak_X4_AddBytes_ptr)(s, 2, in2, 0, (unsigned int)r); 110| 0| (*Keccak_X4_AddBytes_ptr)(s, 3, in3, 0, (unsigned int)r); 111| 0| (*Keccak_X4_Permute_ptr)(s); 112| 0| inlen -= r; 113| 0| in0 += r; 114| 0| in1 += r; 115| 0| in2 += r; 116| 0| in3 += r; 117| 0| } 118| | 119| 32.5k| (*Keccak_X4_AddBytes_ptr)(s, 0, in0, (unsigned int)s[100], (unsigned int)inlen); 120| 32.5k| (*Keccak_X4_AddBytes_ptr)(s, 1, in1, (unsigned int)s[100], (unsigned int)inlen); 121| 32.5k| (*Keccak_X4_AddBytes_ptr)(s, 2, in2, (unsigned int)s[100], (unsigned int)inlen); 122| 32.5k| (*Keccak_X4_AddBytes_ptr)(s, 3, in3, (unsigned int)s[100], (unsigned int)inlen); 123| 32.5k| s[100] += inlen; 124| 32.5k|} xkcp_sha3x4.c:SHA3_shake128_x4_inc_finalize: 187| 30.6k|static void SHA3_shake128_x4_inc_finalize(OQS_SHA3_shake128_x4_inc_ctx *state) { 188| 30.6k| keccak_x4_inc_finalize((uint64_t *)state->ctx, OQS_SHA3_SHAKE128_RATE, 0x1F); ------------------ | | 239| 30.6k|#define OQS_SHA3_SHAKE128_RATE 168 ------------------ 189| 30.6k|} xkcp_sha3x4.c:keccak_x4_inc_finalize: 126| 32.5k|static void keccak_x4_inc_finalize(uint64_t *s, uint32_t r, uint8_t p) { 127| 32.5k| (*Keccak_X4_AddByte_ptr)(s, 0, p, (unsigned int)s[100]); 128| 32.5k| (*Keccak_X4_AddByte_ptr)(s, 1, p, (unsigned int)s[100]); 129| 32.5k| (*Keccak_X4_AddByte_ptr)(s, 2, p, (unsigned int)s[100]); 130| 32.5k| (*Keccak_X4_AddByte_ptr)(s, 3, p, (unsigned int)s[100]); 131| | 132| 32.5k| (*Keccak_X4_AddByte_ptr)(s, 0, 0x80, (unsigned int)(r - 1)); 133| 32.5k| (*Keccak_X4_AddByte_ptr)(s, 1, 0x80, (unsigned int)(r - 1)); 134| 32.5k| (*Keccak_X4_AddByte_ptr)(s, 2, 0x80, (unsigned int)(r - 1)); 135| 32.5k| (*Keccak_X4_AddByte_ptr)(s, 3, 0x80, (unsigned int)(r - 1)); 136| | 137| 32.5k| s[100] = 0; 138| 32.5k|} xkcp_sha3x4.c:SHA3_shake128_x4_inc_squeeze: 191| 31.7k|static void SHA3_shake128_x4_inc_squeeze(uint8_t *out0, uint8_t *out1, uint8_t *out2, uint8_t *out3, size_t outlen, OQS_SHA3_shake128_x4_inc_ctx *state) { 192| 31.7k| keccak_x4_inc_squeeze(out0, out1, out2, out3, outlen, (uint64_t *)state->ctx, OQS_SHA3_SHAKE128_RATE); ------------------ | | 239| 31.7k|#define OQS_SHA3_SHAKE128_RATE 168 ------------------ 193| 31.7k|} xkcp_sha3x4.c:keccak_x4_inc_squeeze: 141| 33.6k| size_t outlen, uint64_t *s, uint32_t r) { 142| | 143| 423k| while (outlen > s[100]) { ------------------ | Branch (143:9): [True: 389k, False: 33.6k] ------------------ 144| 389k| (*Keccak_X4_ExtractBytes_ptr)(s, 0, out0, (unsigned int)(r - s[100]), (unsigned int)s[100]); 145| 389k| (*Keccak_X4_ExtractBytes_ptr)(s, 1, out1, (unsigned int)(r - s[100]), (unsigned int)s[100]); 146| 389k| (*Keccak_X4_ExtractBytes_ptr)(s, 2, out2, (unsigned int)(r - s[100]), (unsigned int)s[100]); 147| 389k| (*Keccak_X4_ExtractBytes_ptr)(s, 3, out3, (unsigned int)(r - s[100]), (unsigned int)s[100]); 148| 389k| (*Keccak_X4_Permute_ptr)(s); 149| 389k| out0 += s[100]; 150| 389k| out1 += s[100]; 151| 389k| out2 += s[100]; 152| 389k| out3 += s[100]; 153| 389k| outlen -= s[100]; 154| 389k| s[100] = r; 155| 389k| } 156| | 157| 33.6k| (*Keccak_X4_ExtractBytes_ptr)(s, 0, out0, (unsigned int)(r - s[100]), (unsigned int)outlen); 158| 33.6k| (*Keccak_X4_ExtractBytes_ptr)(s, 1, out1, (unsigned int)(r - s[100]), (unsigned int)outlen); 159| 33.6k| (*Keccak_X4_ExtractBytes_ptr)(s, 2, out2, (unsigned int)(r - s[100]), (unsigned int)outlen); 160| 33.6k| (*Keccak_X4_ExtractBytes_ptr)(s, 3, out3, (unsigned int)(r - s[100]), (unsigned int)outlen); 161| | 162| 33.6k| s[100] -= outlen; 163| 33.6k|} xkcp_sha3x4.c:SHA3_shake128_x4_inc_ctx_release: 199| 29.4k|static void SHA3_shake128_x4_inc_ctx_release(OQS_SHA3_shake128_x4_inc_ctx *state) { 200| 29.4k| OQS_MEM_aligned_secure_free(state->ctx, KECCAK_X4_CTX_BYTES); ------------------ | | 21| 29.4k|#define KECCAK_X4_CTX_BYTES (KECCAK_X4_CTX_ALIGNMENT * \ | | ------------------ | | | | 19| 29.4k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ | | 22| 29.4k| ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 20| 29.4k|#define _KECCAK_X4_CTX_BYTES (800+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 19| 29.4k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 19| 29.4k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ ------------------ 201| 29.4k|} xkcp_sha3x4.c:SHA3_shake128_x4_inc_ctx_reset: 203| 2.66k|static void SHA3_shake128_x4_inc_ctx_reset(OQS_SHA3_shake128_x4_inc_ctx *state) { 204| 2.66k| keccak_x4_inc_reset((uint64_t *)state->ctx); 205| 2.66k|} xkcp_sha3x4.c:SHA3_shake256_x4: 209| 432|static void SHA3_shake256_x4(uint8_t *out0, uint8_t *out1, uint8_t *out2, uint8_t *out3, size_t outlen, const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 210| 432| OQS_SHA3_shake256_x4_inc_ctx s; 211| 432| OQS_SHA3_shake256_x4_inc_init(&s); 212| 432| OQS_SHA3_shake256_x4_inc_absorb(&s, in0, in1, in2, in3, inlen); 213| 432| OQS_SHA3_shake256_x4_inc_finalize(&s); 214| 432| OQS_SHA3_shake256_x4_inc_squeeze(out0, out1, out2, out3, outlen, &s); 215| 432| OQS_SHA3_shake256_x4_inc_ctx_release(&s); 216| 432|} xkcp_sha3x4.c:SHA3_shake256_x4_inc_init: 220| 1.96k|static void SHA3_shake256_x4_inc_init(OQS_SHA3_shake256_x4_inc_ctx *state) { 221| 1.96k| state->ctx = OQS_MEM_aligned_alloc(KECCAK_X4_CTX_ALIGNMENT, KECCAK_X4_CTX_BYTES); ------------------ | | 19| 1.96k|#define KECCAK_X4_CTX_ALIGNMENT 32 ------------------ state->ctx = OQS_MEM_aligned_alloc(KECCAK_X4_CTX_ALIGNMENT, KECCAK_X4_CTX_BYTES); ------------------ | | 21| 1.96k|#define KECCAK_X4_CTX_BYTES (KECCAK_X4_CTX_ALIGNMENT * \ | | ------------------ | | | | 19| 1.96k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ | | 22| 1.96k| ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 20| 1.96k|#define _KECCAK_X4_CTX_BYTES (800+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 19| 1.96k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 19| 1.96k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ ------------------ 222| 1.96k| OQS_EXIT_IF_NULLPTR(state->ctx, "SHA3x4"); ------------------ | | 82| 1.96k| do { \ | | 83| 1.96k| if ((x) == (void *)0) { \ | | ------------------ | | | Branch (83:9): [True: 0, False: 1.96k] | | ------------------ | | 84| 0| fprintf(stderr, "Unexpected NULL returned from %s API. Exiting.\n", \ | | 85| 0| loc); \ | | 86| 0| exit(EXIT_FAILURE); \ | | 87| 0| } \ | | 88| 1.96k| } while (0) | | ------------------ | | | Branch (88:12): [Folded, False: 1.96k] | | ------------------ ------------------ 223| 1.96k| keccak_x4_inc_reset((uint64_t *)state->ctx); 224| 1.96k|} xkcp_sha3x4.c:SHA3_shake256_x4_inc_absorb: 226| 1.96k|static void SHA3_shake256_x4_inc_absorb(OQS_SHA3_shake256_x4_inc_ctx *state, const uint8_t *in0, const uint8_t *in1, const uint8_t *in2, const uint8_t *in3, size_t inlen) { 227| 1.96k| keccak_x4_inc_absorb((uint64_t *)state->ctx, OQS_SHA3_SHAKE256_RATE, in0, in1, in2, in3, inlen); ------------------ | | 320| 1.96k|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 228| 1.96k|} xkcp_sha3x4.c:SHA3_shake256_x4_inc_finalize: 230| 1.96k|static void SHA3_shake256_x4_inc_finalize(OQS_SHA3_shake256_x4_inc_ctx *state) { 231| 1.96k| keccak_x4_inc_finalize((uint64_t *)state->ctx, OQS_SHA3_SHAKE256_RATE, 0x1F); ------------------ | | 320| 1.96k|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 232| 1.96k|} xkcp_sha3x4.c:SHA3_shake256_x4_inc_squeeze: 234| 1.96k|static void SHA3_shake256_x4_inc_squeeze(uint8_t *out0, uint8_t *out1, uint8_t *out2, uint8_t *out3, size_t outlen, OQS_SHA3_shake256_x4_inc_ctx *state) { 235| 1.96k| keccak_x4_inc_squeeze(out0, out1, out2, out3, outlen, (uint64_t *)state->ctx, OQS_SHA3_SHAKE256_RATE); ------------------ | | 320| 1.96k|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 236| 1.96k|} xkcp_sha3x4.c:SHA3_shake256_x4_inc_ctx_release: 242| 1.96k|static void SHA3_shake256_x4_inc_ctx_release(OQS_SHA3_shake256_x4_inc_ctx *state) { 243| 1.96k| OQS_MEM_aligned_secure_free(state->ctx, KECCAK_X4_CTX_BYTES); ------------------ | | 21| 1.96k|#define KECCAK_X4_CTX_BYTES (KECCAK_X4_CTX_ALIGNMENT * \ | | ------------------ | | | | 19| 1.96k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ | | 22| 1.96k| ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 20| 1.96k|#define _KECCAK_X4_CTX_BYTES (800+sizeof(uint64_t)) | | ------------------ | | ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 19| 1.96k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ | | ((_KECCAK_X4_CTX_BYTES + KECCAK_X4_CTX_ALIGNMENT - 1)/KECCAK_X4_CTX_ALIGNMENT)) | | ------------------ | | | | 19| 1.96k|#define KECCAK_X4_CTX_ALIGNMENT 32 | | ------------------ ------------------ 244| 1.96k|} xkcp_sha3x4.c:SHA3_shake256_x4_inc_ctx_reset: 246| 1.53k|static void SHA3_shake256_x4_inc_ctx_reset(OQS_SHA3_shake256_x4_inc_ctx *state) { 247| 1.53k| keccak_x4_inc_reset((uint64_t *)state->ctx); 248| 1.53k|} common.c:cpuid: 47| 2|static inline void cpuid(cpuid_out *out, const uint32_t eax_leaf) { 48| 2| const uint32_t ecx_leaf = 0; 49| | 50| 2|#if defined(__GNUC__) || defined(__clang__) 51| 2| uint32_t eax, ebx, ecx, edx; 52| 2| __asm__("cpuid" : "=a"(eax), "=b"(ebx), "=c"(ecx), "=d"(edx) : "a"(eax_leaf), "c"(ecx_leaf) : ); 53| 2| out->eax = eax; 54| 2| out->ebx = ebx; 55| 2| out->ecx = ecx; 56| 2| out->edx = edx; 57| |#elif defined(_MSC_VER) 58| | uint32_t output[4]; 59| | __cpuidex(output, eax_leaf, ecx_leaf); 60| | out->eax = output[0]; 61| | out->ebx = output[1]; 62| | out->ecx = output[2]; 63| | out->edx = output[3]; 64| |#else 65| |#error "Only GCC, Clang, and MSVC are supported." 66| |#endif 67| 2|} common.c:is_bit_set: 43| 13|static inline unsigned int is_bit_set(const uint32_t val, const unsigned int bit_pos) { 44| 13| return val & (1 << bit_pos) ? 1 : 0; ------------------ | Branch (44:9): [True: 13, False: 0] ------------------ 45| 13|} common.c:xgetbv_eax: 27| 1|static inline uint32_t xgetbv_eax(uint32_t xcr) { 28| 1|#if defined(__GNUC__) || defined(__clang__) 29| 1| uint32_t eax; 30| 1| __asm__ ( ".byte 0x0f, 0x01, 0xd0" : "=a"(eax) : "c"(xcr) : "edx"); 31| 1| return eax; 32| |#elif defined(_MSC_VER) 33| | return _xgetbv(xcr) & 0xFFFF; 34| |#else 35| |#error "Only GCC, Clang, and MSVC are supported." 36| |#endif 37| 1|} common.c:has_mask: 39| 3|static unsigned int has_mask(const uint32_t value, const uint32_t mask) { 40| 3| return (value & mask) == mask; 41| 3|} kem.c:sk_cleanup: 37| 14| { \ 38| 14| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 14|#define secure_clean OQS_MEM_cleanse ------------------ 39| 14| } kem.c:pad_r_cleanup: 37| 28| { \ 38| 28| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 28|#define secure_clean OQS_MEM_cleanse ------------------ 39| 28| } kem.c:seeds_cleanup: 66| 14|{ 67| 42| for(int i = 0; i < NUM_OF_SEEDS; i++) { ------------------ | | 76| 42|#define NUM_OF_SEEDS 2 ------------------ | Branch (67:18): [True: 28, False: 14] ------------------ 68| 28| seed_cleanup(&(o->seed[i])); 69| 28| } 70| 14|} kem.c:seed_cleanup: 37| 42| { \ 38| 42| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 42|#define secure_clean OQS_MEM_cleanse ------------------ 39| 42| } kem.c:m_cleanup: 37| 21| { \ 38| 21| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 21|#define secure_clean OQS_MEM_cleanse ------------------ 39| 21| } kem.c:ss_cleanup: 37| 14| { \ 38| 14| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 14|#define secure_clean OQS_MEM_cleanse ------------------ 39| 14| } kem.c:pad_e_cleanup: 37| 21| { \ 38| 21| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 21|#define secure_clean OQS_MEM_cleanse ------------------ 39| 21| } kem.c:func_k_cleanup: 37| 14| { \ 38| 14| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 14|#define secure_clean OQS_MEM_cleanse ------------------ 39| 14| } kem.c:e_cleanup: 37| 21| { \ 38| 21| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 21|#define secure_clean OQS_MEM_cleanse ------------------ 39| 21| } decode.c:pad_r_cleanup: 37| 217| { \ 38| 217| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 217|#define secure_clean OQS_MEM_cleanse ------------------ 39| 217| } decode.c:e_cleanup: 37| 14| { \ 38| 14| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 14|#define secure_clean OQS_MEM_cleanse ------------------ 39| 14| } decode.c:syndrome_cleanup: 37| 56| { \ 38| 56| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 56|#define secure_clean OQS_MEM_cleanse ------------------ 39| 56| } decode.c:upc_cleanup: 37| 49| { \ 38| 49| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 49|#define secure_clean OQS_MEM_cleanse ------------------ 39| 49| } gf2x_inv.c:pad_r_cleanup: 37| 21| { \ 38| 21| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 21|#define secure_clean OQS_MEM_cleanse ------------------ 39| 21| } gf2x_inv.c:dbl_pad_r_cleanup: 37| 7| { \ 38| 7| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 7|#define secure_clean OQS_MEM_cleanse ------------------ 39| 7| } gf2x_mul.c:dbl_pad_r_cleanup: 37| 236| { \ 38| 236| secure_clean((uint8_t *)o, sizeof(*o)); \ ------------------ | | 33| 236|#define secure_clean OQS_MEM_cleanse ------------------ 39| 236| } sampling.c:OQS_KEM_bike_l1_is_avx512_enabled: 27| 15|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 15|#if defined(OQS_DIST_X86_64_BUILD) 30| 15| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 15|} sampling.c:OQS_KEM_bike_l1_is_avx2_enabled: 16| 15|{ 17| 15|#if defined(OQS_DIST_X86_64_BUILD) 18| 15| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 15|} sampling.c:OQS_KEM_bike_l3_is_avx512_enabled: 27| 3|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 3|#if defined(OQS_DIST_X86_64_BUILD) 30| 3| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 3|} sampling.c:OQS_KEM_bike_l3_is_avx2_enabled: 16| 3|{ 17| 3|#if defined(OQS_DIST_X86_64_BUILD) 18| 3| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 3|} sampling.c:OQS_KEM_bike_l5_is_avx512_enabled: 27| 3|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 3|#if defined(OQS_DIST_X86_64_BUILD) 30| 3| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 3|} sampling.c:OQS_KEM_bike_l5_is_avx2_enabled: 16| 3|{ 17| 3|#if defined(OQS_DIST_X86_64_BUILD) 18| 3| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 3|} decode.c:OQS_KEM_bike_l1_is_avx512_enabled: 27| 5|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 5|#if defined(OQS_DIST_X86_64_BUILD) 30| 5| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 5|} decode.c:OQS_KEM_bike_l1_is_avx2_enabled: 16| 5|{ 17| 5|#if defined(OQS_DIST_X86_64_BUILD) 18| 5| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 5|} gf2x_inv.c:OQS_KEM_bike_l1_is_avx512_enabled: 27| 5|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 5|#if defined(OQS_DIST_X86_64_BUILD) 30| 5| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 5|} gf2x_inv.c:OQS_KEM_bike_l1_is_avx2_enabled: 16| 5|{ 17| 5|#if defined(OQS_DIST_X86_64_BUILD) 18| 5| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 5|} gf2x_inv.c:OQS_KEM_bike_l1_is_pclmul_enabled: 39| 5|{ 40| 5|#if defined(OQS_DIST_X86_64_BUILD) 41| 5| return OQS_CPU_has_extension(OQS_CPU_EXT_PCLMULQDQ); 42| |#elif defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 43| | return 1; 44| |#else 45| | return 0; 46| |#endif 47| 5|} gf2x_mul.c:OQS_KEM_bike_l1_is_avx512_enabled: 27| 85|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 85|#if defined(OQS_DIST_X86_64_BUILD) 30| 85| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 85|} gf2x_mul.c:OQS_KEM_bike_l1_is_avx2_enabled: 16| 85|{ 17| 85|#if defined(OQS_DIST_X86_64_BUILD) 18| 85| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 85|} gf2x_mul.c:OQS_KEM_bike_l1_is_pclmul_enabled: 39| 85|{ 40| 85|#if defined(OQS_DIST_X86_64_BUILD) 41| 85| return OQS_CPU_has_extension(OQS_CPU_EXT_PCLMULQDQ); 42| |#elif defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 43| | return 1; 44| |#else 45| | return 0; 46| |#endif 47| 85|} decode.c:OQS_KEM_bike_l3_is_avx512_enabled: 27| 1|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 1|#if defined(OQS_DIST_X86_64_BUILD) 30| 1| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 1|} decode.c:OQS_KEM_bike_l3_is_avx2_enabled: 16| 1|{ 17| 1|#if defined(OQS_DIST_X86_64_BUILD) 18| 1| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 1|} gf2x_inv.c:OQS_KEM_bike_l3_is_avx512_enabled: 27| 1|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 1|#if defined(OQS_DIST_X86_64_BUILD) 30| 1| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 1|} gf2x_inv.c:OQS_KEM_bike_l3_is_avx2_enabled: 16| 1|{ 17| 1|#if defined(OQS_DIST_X86_64_BUILD) 18| 1| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 1|} gf2x_inv.c:OQS_KEM_bike_l3_is_pclmul_enabled: 39| 1|{ 40| 1|#if defined(OQS_DIST_X86_64_BUILD) 41| 1| return OQS_CPU_has_extension(OQS_CPU_EXT_PCLMULQDQ); 42| |#elif defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 43| | return 1; 44| |#else 45| | return 0; 46| |#endif 47| 1|} gf2x_mul.c:OQS_KEM_bike_l3_is_avx512_enabled: 27| 17|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 17|#if defined(OQS_DIST_X86_64_BUILD) 30| 17| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 17|} gf2x_mul.c:OQS_KEM_bike_l3_is_avx2_enabled: 16| 17|{ 17| 17|#if defined(OQS_DIST_X86_64_BUILD) 18| 17| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 17|} gf2x_mul.c:OQS_KEM_bike_l3_is_pclmul_enabled: 39| 17|{ 40| 17|#if defined(OQS_DIST_X86_64_BUILD) 41| 17| return OQS_CPU_has_extension(OQS_CPU_EXT_PCLMULQDQ); 42| |#elif defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 43| | return 1; 44| |#else 45| | return 0; 46| |#endif 47| 17|} decode.c:OQS_KEM_bike_l5_is_avx512_enabled: 27| 1|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 1|#if defined(OQS_DIST_X86_64_BUILD) 30| 1| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 1|} decode.c:OQS_KEM_bike_l5_is_avx2_enabled: 16| 1|{ 17| 1|#if defined(OQS_DIST_X86_64_BUILD) 18| 1| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 1|} gf2x_inv.c:OQS_KEM_bike_l5_is_avx512_enabled: 27| 1|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 1|#if defined(OQS_DIST_X86_64_BUILD) 30| 1| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 1|} gf2x_inv.c:OQS_KEM_bike_l5_is_avx2_enabled: 16| 1|{ 17| 1|#if defined(OQS_DIST_X86_64_BUILD) 18| 1| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 1|} gf2x_inv.c:OQS_KEM_bike_l5_is_pclmul_enabled: 39| 1|{ 40| 1|#if defined(OQS_DIST_X86_64_BUILD) 41| 1| return OQS_CPU_has_extension(OQS_CPU_EXT_PCLMULQDQ); 42| |#elif defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 43| | return 1; 44| |#else 45| | return 0; 46| |#endif 47| 1|} gf2x_mul.c:OQS_KEM_bike_l5_is_avx512_enabled: 27| 17|{ 28| |// TODO: Determine minimal set of AVX512 features 29| 17|#if defined(OQS_DIST_X86_64_BUILD) 30| 17| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX512); 31| |#elif defined(OQS_USE_AVX512_INSTRUCTIONS) 32| | return 1; 33| |#else 34| | return 0; 35| |#endif 36| 17|} gf2x_mul.c:OQS_KEM_bike_l5_is_avx2_enabled: 16| 17|{ 17| 17|#if defined(OQS_DIST_X86_64_BUILD) 18| 17| return OQS_CPU_has_extension(OQS_CPU_EXT_AVX2); 19| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 20| | return 1; 21| |#else 22| | return 0; 23| |#endif 24| 17|} gf2x_mul.c:OQS_KEM_bike_l5_is_pclmul_enabled: 39| 17|{ 40| 17|#if defined(OQS_DIST_X86_64_BUILD) 41| 17| return OQS_CPU_has_extension(OQS_CPU_EXT_PCLMULQDQ); 42| |#elif defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 43| | return 1; 44| |#else 45| | return 0; 46| |#endif 47| 17|} OQS_KEM_bike_l1_compute_syndrome: 60| 40|{ 61| 40| DEFER_CLEANUP(pad_r_t pad_s, pad_r_cleanup); ------------------ | | 16| 40| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 62| | 63| 40| gf2x_mod_mul(&pad_s, c0, h0); ------------------ | | 60| 40|#define gf2x_mod_mul RENAME_FUNC_NAME(gf2x_mod_mul) | | ------------------ | | | | 44| 40|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 40|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 40|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 64| | 65| 40| bike_memcpy((uint8_t *)syndrome->qw, pad_s.val.raw, R_BYTES); ------------------ | | 81| 40|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 40|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 66| 40| ctx->dup(syndrome); 67| 40|} OQS_KEM_bike_l1_recompute_syndrome: 75| 35|{ 76| 35| DEFER_CLEANUP(pad_r_t tmp_c0, pad_r_cleanup); ------------------ | | 16| 35| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 77| 35| DEFER_CLEANUP(pad_r_t e0 = {0}, pad_r_cleanup); ------------------ | | 16| 35| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 78| 35| DEFER_CLEANUP(pad_r_t e1 = {0}, pad_r_cleanup); ------------------ | | 16| 35| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 79| | 80| 35| e0.val = e->val[0]; 81| 35| e1.val = e->val[1]; 82| | 83| | // tmp_c0 = pk * e1 + c0 + e0 84| 35| gf2x_mod_mul(&tmp_c0, &e1, pk); ------------------ | | 60| 35|#define gf2x_mod_mul RENAME_FUNC_NAME(gf2x_mod_mul) | | ------------------ | | | | 44| 35|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 35|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 35|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 85| 35| gf2x_mod_add(&tmp_c0, &tmp_c0, c0); ------------------ | | 123| 35|#define gf2x_mod_add RENAME_FUNC_NAME(gf2x_mod_add) | | ------------------ | | | | 44| 35|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 35|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 35|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 86| 35| gf2x_mod_add(&tmp_c0, &tmp_c0, &e0); ------------------ | | 123| 35|#define gf2x_mod_add RENAME_FUNC_NAME(gf2x_mod_add) | | ------------------ | | | | 44| 35|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 35|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 35|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 87| | 88| | // Recompute the syndrome using the updated ciphertext 89| 35| compute_syndrome(syndrome, &tmp_c0, h0, ctx); ------------------ | | 66| 35|#define compute_syndrome RENAME_FUNC_NAME(compute_syndrome) | | ------------------ | | | | 44| 35|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 35|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 35|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 90| 35|} OQS_KEM_bike_l1_decode: 237| 5|{ 238| | // Initialize the decode methods struct 239| 5| decode_ctx ctx; 240| 5| decode_ctx_init(&ctx); ------------------ | | 94| 5|#define decode_ctx_init RENAME_FUNC_NAME(decode_ctx_init) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 241| | 242| 5| DEFER_CLEANUP(e_t black_e = {0}, e_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 243| 5| DEFER_CLEANUP(e_t gray_e = {0}, e_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 244| | 245| 5| DEFER_CLEANUP(pad_r_t c0 = {0}, pad_r_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 246| 5| DEFER_CLEANUP(pad_r_t h0 = {0}, pad_r_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 247| 5| pad_r_t pk = {0}; 248| | 249| | // Pad ciphertext (c0), secret key (h0), and public key (h) 250| 5| c0.val = ct->c0; 251| 5| h0.val = sk->bin[0]; 252| 5| pk.val = sk->pk; 253| | 254| 5| DEFER_CLEANUP(syndrome_t s = {0}, syndrome_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 255| 5| DMSG(" Computing s.\n"); 256| 5| compute_syndrome(&s, &c0, &h0, &ctx); ------------------ | | 66| 5|#define compute_syndrome RENAME_FUNC_NAME(compute_syndrome) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 257| 5| ctx.dup(&s); 258| | 259| | // Reset (init) the error because it is xored in the find_err functions. 260| 5| bike_memset(e, 0, sizeof(*e)); 261| | 262| 30| for(uint32_t iter = 0; iter < MAX_IT; iter++) { ------------------ | | 53| 30|# define MAX_IT 5 ------------------ | Branch (262:26): [True: 25, False: 5] ------------------ 263| 25| const uint8_t threshold = get_threshold(&s); ------------------ | | 141| 25|#define get_threshold RENAME_FUNC_NAME(get_threshold) | | ------------------ | | | | 44| 25|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 25|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 25|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 264| | 265| 25| DMSG(" Iteration: %d\n", iter); 266| 25| DMSG(" Weight of e: %lu\n", 267| 25| r_bits_vector_weight(&e->val[0]) + r_bits_vector_weight(&e->val[1])); 268| 25| DMSG(" Weight of syndrome: %lu\n", r_bits_vector_weight((r_t *)s.qw)); 269| | 270| 25| find_err1(e, &black_e, &gray_e, &s, sk->wlist, threshold, &ctx); 271| 25| recompute_syndrome(&s, &c0, &h0, &pk, e, &ctx); ------------------ | | 67| 25|#define recompute_syndrome RENAME_FUNC_NAME(recompute_syndrome) | | ------------------ | | | | 44| 25|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 25|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 25|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 272| 25|#if defined(BGF_DECODER) 273| 25| if(iter >= 1) { ------------------ | Branch (273:8): [True: 20, False: 5] ------------------ 274| 20| continue; 275| 20| } 276| 5|#endif 277| 5| DMSG(" Weight of e: %lu\n", 278| 5| r_bits_vector_weight(&e->val[0]) + r_bits_vector_weight(&e->val[1])); 279| 5| DMSG(" Weight of syndrome: %lu\n", r_bits_vector_weight((r_t *)s.qw)); 280| | 281| 5| find_err2(e, &black_e, &s, sk->wlist, ((D + 1) / 2) + 1, &ctx); ------------------ | | 24| 5|# define D 71 ------------------ 282| 5| recompute_syndrome(&s, &c0, &h0, &pk, e, &ctx); ------------------ | | 67| 5|#define recompute_syndrome RENAME_FUNC_NAME(recompute_syndrome) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 283| | 284| 5| DMSG(" Weight of e: %lu\n", 285| 5| r_bits_vector_weight(&e->val[0]) + r_bits_vector_weight(&e->val[1])); 286| 5| DMSG(" Weight of syndrome: %lu\n", r_bits_vector_weight((r_t *)s.qw)); 287| | 288| 5| find_err2(e, &gray_e, &s, sk->wlist, ((D + 1) / 2) + 1, &ctx); ------------------ | | 24| 5|# define D 71 ------------------ 289| 5| recompute_syndrome(&s, &c0, &h0, &pk, e, &ctx); ------------------ | | 67| 5|#define recompute_syndrome RENAME_FUNC_NAME(recompute_syndrome) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 290| 5| } 291| 5|} decode.c:OQS_KEM_bike_l1_get_threshold: 103| 25|{ 104| 25| bike_static_assert(sizeof(*s) >= sizeof(r_t), syndrome_is_large_enough); ------------------ | | 33| 25| typedef char static_assertion_##MSG[(COND) ? 1 : -1] BIKE_UNUSED_ATT ------------------ 105| | 106| 25| const uint64_t syndrome_weight = r_bits_vector_weight((const r_t *)s->qw); ------------------ | | 78| 25|#define r_bits_vector_weight RENAME_FUNC_NAME(r_bits_vector_weight) | | ------------------ | | | | 44| 25|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 25|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 25|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 107| | 108| | // The threshold coefficients are defined in the spec as floating point values. 109| | // Since we want to avoid floating point operations for constant-timeness, 110| | // we use integer arithmetic to compute the threshold. 111| | // For example, in the case of Level-1 parameters, instead of having: 112| | // T0 = 13.530 and T1 = 0.0069722, 113| | // we multipy the values by 10^8 and work with integers: 114| | // T0' = 1353000000 and T1' = 697220. 115| | // Then, instead of computing the threshold by: 116| | // T0 + T1*S, 117| | // we compute: 118| | // (T0' + T1'*S)/10^8, 119| | // where S is the syndrome weight. Additionally, instead of dividing by 10^8, 120| | // we compute the result by a multiplication and a right shift (both 121| | // constant-time operations), as described in: 122| | // https://dl.acm.org/doi/pdf/10.1145/178243.178249 123| 25| uint64_t thr = THRESHOLD_COEFF0 + (THRESHOLD_COEFF1 * syndrome_weight); ------------------ | | 27| 25|# define THRESHOLD_COEFF0 1353000000ULL ------------------ uint64_t thr = THRESHOLD_COEFF0 + (THRESHOLD_COEFF1 * syndrome_weight); ------------------ | | 28| 25|# define THRESHOLD_COEFF1 697220ULL ------------------ 124| 25| MUL64HIGH(thr, thr, THRESHOLD_MUL_CONST); ------------------ | | 93| 25| do { \ | | 94| 25| uint64_t a_lo, a_hi, b_lo, b_hi; \ | | 95| 25| a_lo = a & 0xffffffff; \ | | 96| 25| b_lo = b & 0xffffffff; \ | | 97| 25| a_hi = a >> 32; \ | | 98| 25| b_hi = b >> 32; \ | | 99| 25| c = a_hi*b_hi + ((a_hi*b_lo + a_lo*b_hi) >> 32); \ | | 100| 25| } while(0) | | ------------------ | | | Branch (100:11): [Folded, False: 25] | | ------------------ ------------------ 125| 25| thr >>= THRESHOLD_SHR_CONST; ------------------ | | 30| 25|# define THRESHOLD_SHR_CONST 26 ------------------ 126| | 127| 25| const uint32_t mask = secure_l32_mask((uint32_t)thr, THRESHOLD_MIN); ------------------ | | 31| 25|# define THRESHOLD_MIN 36 ------------------ 128| 25| thr = (u32_barrier(mask) & thr) | (u32_barrier(~mask) & THRESHOLD_MIN); ------------------ | | 31| 25|# define THRESHOLD_MIN 36 ------------------ 129| | 130| 25| DMSG(" Threshold: %d\n", thr); 131| 25| return thr; 132| 25|} decode.c:find_err1: 144| 35|{ 145| | // This function uses the bit-slice-adder methodology of [5]: 146| 35| DEFER_CLEANUP(syndrome_t rotated_syndrome = {0}, syndrome_cleanup); ------------------ | | 16| 35| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 147| 35| DEFER_CLEANUP(upc_t upc, upc_cleanup); ------------------ | | 16| 35| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 148| | 149| 105| for(uint32_t i = 0; i < N0; i++) { ------------------ | | 15| 105|#define N0 2 ------------------ | Branch (149:23): [True: 70, False: 35] ------------------ 150| | // UPC must start from zero at every iteration 151| 70| bike_memset(&upc, 0, sizeof(upc)); 152| | 153| | // 1) Right-rotate the syndrome for every secret key set bit index 154| | // Then slice-add it to the UPC array. 155| 6.02k| for(size_t j = 0; j < D; j++) { ------------------ | | 24| 6.02k|# define D 71 ------------------ | Branch (155:23): [True: 5.95k, False: 70] ------------------ 156| 5.95k| ctx->rotate_right(&rotated_syndrome, syndrome, wlist[i].val[j]); ------------------ | | 77| 5.95k|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 5.95k|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5.95k|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5.95k|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 157| 5.95k| ctx->bit_sliced_adder(&upc, &rotated_syndrome, LOG2_MSB(j + 1)); ------------------ | | 77| 5.95k| ((v) == 0 \ | | ------------------ | | | Branch (77:4): [True: 0, False: 5.95k] | | ------------------ | | 78| 5.95k| ? 0 \ | | 79| 5.95k| : ((v) < 2 \ | | ------------------ | | | Branch (79:9): [True: 70, False: 5.88k] | | ------------------ | | 80| 5.95k| ? 1 \ | | 81| 5.95k| : ((v) < 4 \ | | ------------------ | | | Branch (81:14): [True: 140, False: 5.74k] | | ------------------ | | 82| 5.88k| ? 2 \ | | 83| 5.88k| : ((v) < 8 \ | | ------------------ | | | Branch (83:19): [True: 280, False: 5.46k] | | ------------------ | | 84| 5.74k| ? 3 \ | | 85| 5.74k| : ((v) < 16 \ | | ------------------ | | | Branch (85:24): [True: 560, False: 4.90k] | | ------------------ | | 86| 5.46k| ? 4 \ | | 87| 5.46k| : ((v) < 32 \ | | ------------------ | | | Branch (87:29): [True: 1.12k, False: 3.78k] | | ------------------ | | 88| 4.90k| ? 5 \ | | 89| 4.90k| : ((v) < 64 \ | | ------------------ | | | Branch (89:34): [True: 2.24k, False: 1.54k] | | ------------------ | | 90| 3.78k| ? 6 \ | | 91| 3.78k| : ((v) < 128 ? 7 \ | | ------------------ | | | Branch (91:39): [True: 1.44k, False: 100] | | ------------------ | | 92| 1.54k| : ((v) < 256 ? 8 : 9))))))))) | | ------------------ | | | Branch (92:52): [True: 100, False: 0] | | ------------------ ------------------ 158| 5.95k| } 159| | 160| | // 2) Subtract the threshold from the UPC counters 161| 70| ctx->bit_slice_full_subtract(&upc, threshold); 162| | 163| | // 3) Update the errors and the black errors vectors. 164| | // The last slice of the UPC array holds the MSB of the accumulated values 165| | // minus the threshold. Every zero bit indicates a potential error bit. 166| | // The errors values are stored in the black array and xored with the 167| | // errors Of the previous iteration. 168| 70| const r_t *last_slice = &(upc.slice[SLICES - 1].u.r.val); ------------------ | | 116| 70|#define SLICES (LOG2_MSB(D) + 1) | | ------------------ | | | | 77| 70| ((v) == 0 \ | | | | ------------------ | | | | | Branch (77:4): [Folded, False: 70] | | | | ------------------ | | | | 78| 70| ? 0 \ | | | | 79| 70| : ((v) < 2 \ | | | | ------------------ | | | | | Branch (79:9): [Folded, False: 70] | | | | ------------------ | | | | 80| 70| ? 1 \ | | | | 81| 70| : ((v) < 4 \ | | | | ------------------ | | | | | Branch (81:14): [Folded, False: 70] | | | | ------------------ | | | | 82| 70| ? 2 \ | | | | 83| 70| : ((v) < 8 \ | | | | ------------------ | | | | | Branch (83:19): [Folded, False: 70] | | | | ------------------ | | | | 84| 70| ? 3 \ | | | | 85| 70| : ((v) < 16 \ | | | | ------------------ | | | | | Branch (85:24): [Folded, False: 70] | | | | ------------------ | | | | 86| 70| ? 4 \ | | | | 87| 70| : ((v) < 32 \ | | | | ------------------ | | | | | Branch (87:29): [Folded, False: 70] | | | | ------------------ | | | | 88| 70| ? 5 \ | | | | 89| 70| : ((v) < 64 \ | | | | ------------------ | | | | | Branch (89:34): [Folded, False: 70] | | | | ------------------ | | | | 90| 70| ? 6 \ | | | | 91| 70| : ((v) < 128 ? 7 \ | | | | ------------------ | | | | | Branch (91:39): [True: 60, Folded] | | | | ------------------ | | | | 92| 70| : ((v) < 256 ? 8 : 9))))))))) | | | | ------------------ | | | | | Branch (92:52): [True: 10, Folded] | | | | ------------------ | | ------------------ ------------------ 169| 159k| for(size_t j = 0; j < R_BYTES; j++) { ------------------ | | 81| 159k|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 159k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (169:23): [True: 159k, False: 70] ------------------ 170| 159k| const uint8_t sum_msb = (~last_slice->raw[j]); 171| 159k| black_e->val[i].raw[j] = sum_msb; 172| 159k| e->val[i].raw[j] ^= sum_msb; 173| 159k| } 174| | 175| | // Ensure that the padding bits (upper bits of the last byte) are zero so 176| | // they will not be included in the multiplication and in the hash function. 177| 70| e->val[i].raw[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 81| 70|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 70|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ e->val[i].raw[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 98| 70|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 70|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 70|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 178| | 179| | // 4) Calculate the gray error array by adding "DELTA" to the UPC array. 180| | // For that we reuse the rotated_syndrome variable setting it to all "1". 181| 280| for(size_t l = 0; l < DELTA; l++) { ------------------ | | 115| 280|#define DELTA 3 ------------------ | Branch (181:23): [True: 210, False: 70] ------------------ 182| 210| bike_memset((uint8_t *)rotated_syndrome.qw, 0xff, R_BYTES); ------------------ | | 81| 210|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 210|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 183| 210| ctx->bit_sliced_adder(&upc, &rotated_syndrome, SLICES); ------------------ | | 116| 210|#define SLICES (LOG2_MSB(D) + 1) | | ------------------ | | | | 77| 210| ((v) == 0 \ | | | | ------------------ | | | | | Branch (77:4): [Folded, False: 210] | | | | ------------------ | | | | 78| 210| ? 0 \ | | | | 79| 210| : ((v) < 2 \ | | | | ------------------ | | | | | Branch (79:9): [Folded, False: 210] | | | | ------------------ | | | | 80| 210| ? 1 \ | | | | 81| 210| : ((v) < 4 \ | | | | ------------------ | | | | | Branch (81:14): [Folded, False: 210] | | | | ------------------ | | | | 82| 210| ? 2 \ | | | | 83| 210| : ((v) < 8 \ | | | | ------------------ | | | | | Branch (83:19): [Folded, False: 210] | | | | ------------------ | | | | 84| 210| ? 3 \ | | | | 85| 210| : ((v) < 16 \ | | | | ------------------ | | | | | Branch (85:24): [Folded, False: 210] | | | | ------------------ | | | | 86| 210| ? 4 \ | | | | 87| 210| : ((v) < 32 \ | | | | ------------------ | | | | | Branch (87:29): [Folded, False: 210] | | | | ------------------ | | | | 88| 210| ? 5 \ | | | | 89| 210| : ((v) < 64 \ | | | | ------------------ | | | | | Branch (89:34): [Folded, False: 210] | | | | ------------------ | | | | 90| 210| ? 6 \ | | | | 91| 210| : ((v) < 128 ? 7 \ | | | | ------------------ | | | | | Branch (91:39): [True: 180, Folded] | | | | ------------------ | | | | 92| 210| : ((v) < 256 ? 8 : 9))))))))) | | | | ------------------ | | | | | Branch (92:52): [True: 30, Folded] | | | | ------------------ | | ------------------ ------------------ 184| 210| } 185| | 186| | // 5) Update the gray list with the relevant bits that are not 187| | // set in the black list. 188| 159k| for(size_t j = 0; j < R_BYTES; j++) { ------------------ | | 81| 159k|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 159k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (188:23): [True: 159k, False: 70] ------------------ 189| 159k| const uint8_t sum_msb = (~last_slice->raw[j]); 190| 159k| gray_e->val[i].raw[j] = (~(black_e->val[i].raw[j])) & sum_msb; 191| 159k| } 192| 70| } 193| 35|} decode.c:find_err2: 203| 14|{ 204| 14| DEFER_CLEANUP(syndrome_t rotated_syndrome = {0}, syndrome_cleanup); ------------------ | | 16| 14| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 205| 14| DEFER_CLEANUP(upc_t upc, upc_cleanup); ------------------ | | 16| 14| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 206| | 207| 42| for(uint32_t i = 0; i < N0; i++) { ------------------ | | 15| 42|#define N0 2 ------------------ | Branch (207:23): [True: 28, False: 14] ------------------ 208| | // UPC must start from zero at every iteration 209| 28| bike_memset(&upc, 0, sizeof(upc)); 210| | 211| | // 1) Right-rotate the syndrome, for every index of a set bit in the secret 212| | // key. Then slice-add it to the UPC array. 213| 2.40k| for(size_t j = 0; j < D; j++) { ------------------ | | 24| 2.40k|# define D 71 ------------------ | Branch (213:23): [True: 2.38k, False: 28] ------------------ 214| 2.38k| ctx->rotate_right(&rotated_syndrome, syndrome, wlist[i].val[j]); ------------------ | | 77| 2.38k|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 2.38k|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2.38k|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2.38k|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 215| 2.38k| ctx->bit_sliced_adder(&upc, &rotated_syndrome, LOG2_MSB(j + 1)); ------------------ | | 77| 2.38k| ((v) == 0 \ | | ------------------ | | | Branch (77:4): [True: 0, False: 2.38k] | | ------------------ | | 78| 2.38k| ? 0 \ | | 79| 2.38k| : ((v) < 2 \ | | ------------------ | | | Branch (79:9): [True: 28, False: 2.35k] | | ------------------ | | 80| 2.38k| ? 1 \ | | 81| 2.38k| : ((v) < 4 \ | | ------------------ | | | Branch (81:14): [True: 56, False: 2.29k] | | ------------------ | | 82| 2.35k| ? 2 \ | | 83| 2.35k| : ((v) < 8 \ | | ------------------ | | | Branch (83:19): [True: 112, False: 2.18k] | | ------------------ | | 84| 2.29k| ? 3 \ | | 85| 2.29k| : ((v) < 16 \ | | ------------------ | | | Branch (85:24): [True: 224, False: 1.96k] | | ------------------ | | 86| 2.18k| ? 4 \ | | 87| 2.18k| : ((v) < 32 \ | | ------------------ | | | Branch (87:29): [True: 448, False: 1.51k] | | ------------------ | | 88| 1.96k| ? 5 \ | | 89| 1.96k| : ((v) < 64 \ | | ------------------ | | | Branch (89:34): [True: 896, False: 616] | | ------------------ | | 90| 1.51k| ? 6 \ | | 91| 1.51k| : ((v) < 128 ? 7 \ | | ------------------ | | | Branch (91:39): [True: 576, False: 40] | | ------------------ | | 92| 616| : ((v) < 256 ? 8 : 9))))))))) | | ------------------ | | | Branch (92:52): [True: 40, False: 0] | | ------------------ ------------------ 216| 2.38k| } 217| | 218| | // 2) Subtract the threshold from the UPC counters 219| 28| ctx->bit_slice_full_subtract(&upc, threshold); 220| | 221| | // 3) Update the errors vector. 222| | // The last slice of the UPC array holds the MSB of the accumulated values 223| | // minus the threshold. Every zero bit indicates a potential error bit. 224| 28| const r_t *last_slice = &(upc.slice[SLICES - 1].u.r.val); ------------------ | | 116| 28|#define SLICES (LOG2_MSB(D) + 1) | | ------------------ | | | | 77| 28| ((v) == 0 \ | | | | ------------------ | | | | | Branch (77:4): [Folded, False: 28] | | | | ------------------ | | | | 78| 28| ? 0 \ | | | | 79| 28| : ((v) < 2 \ | | | | ------------------ | | | | | Branch (79:9): [Folded, False: 28] | | | | ------------------ | | | | 80| 28| ? 1 \ | | | | 81| 28| : ((v) < 4 \ | | | | ------------------ | | | | | Branch (81:14): [Folded, False: 28] | | | | ------------------ | | | | 82| 28| ? 2 \ | | | | 83| 28| : ((v) < 8 \ | | | | ------------------ | | | | | Branch (83:19): [Folded, False: 28] | | | | ------------------ | | | | 84| 28| ? 3 \ | | | | 85| 28| : ((v) < 16 \ | | | | ------------------ | | | | | Branch (85:24): [Folded, False: 28] | | | | ------------------ | | | | 86| 28| ? 4 \ | | | | 87| 28| : ((v) < 32 \ | | | | ------------------ | | | | | Branch (87:29): [Folded, False: 28] | | | | ------------------ | | | | 88| 28| ? 5 \ | | | | 89| 28| : ((v) < 64 \ | | | | ------------------ | | | | | Branch (89:34): [Folded, False: 28] | | | | ------------------ | | | | 90| 28| ? 6 \ | | | | 91| 28| : ((v) < 128 ? 7 \ | | | | ------------------ | | | | | Branch (91:39): [True: 24, Folded] | | | | ------------------ | | | | 92| 28| : ((v) < 256 ? 8 : 9))))))))) | | | | ------------------ | | | | | Branch (92:52): [True: 4, Folded] | | | | ------------------ | | ------------------ ------------------ 225| 63.6k| for(size_t j = 0; j < R_BYTES; j++) { ------------------ | | 81| 63.6k|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 63.6k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (225:23): [True: 63.6k, False: 28] ------------------ 226| 63.6k| const uint8_t sum_msb = (~last_slice->raw[j]); 227| 63.6k| e->val[i].raw[j] ^= (pos_e->val[i].raw[j] & sum_msb); 228| 63.6k| } 229| | 230| | // Ensure that the padding bits (upper bits of the last byte) are zero, so 231| | // they are not included in the multiplication, and in the hash function. 232| 28| e->val[i].raw[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 81| 28|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 28|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ e->val[i].raw[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 98| 28|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 28|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 28|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 233| 28| } 234| 14|} OQS_KEM_bike_l3_compute_syndrome: 60| 8|{ 61| 8| DEFER_CLEANUP(pad_r_t pad_s, pad_r_cleanup); ------------------ | | 16| 8| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 62| | 63| 8| gf2x_mod_mul(&pad_s, c0, h0); ------------------ | | 60| 8|#define gf2x_mod_mul RENAME_FUNC_NAME(gf2x_mod_mul) | | ------------------ | | | | 44| 8|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 8|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 8|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 64| | 65| 8| bike_memcpy((uint8_t *)syndrome->qw, pad_s.val.raw, R_BYTES); ------------------ | | 81| 8|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 8|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 66| 8| ctx->dup(syndrome); 67| 8|} OQS_KEM_bike_l3_recompute_syndrome: 75| 7|{ 76| 7| DEFER_CLEANUP(pad_r_t tmp_c0, pad_r_cleanup); ------------------ | | 16| 7| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 77| 7| DEFER_CLEANUP(pad_r_t e0 = {0}, pad_r_cleanup); ------------------ | | 16| 7| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 78| 7| DEFER_CLEANUP(pad_r_t e1 = {0}, pad_r_cleanup); ------------------ | | 16| 7| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 79| | 80| 7| e0.val = e->val[0]; 81| 7| e1.val = e->val[1]; 82| | 83| | // tmp_c0 = pk * e1 + c0 + e0 84| 7| gf2x_mod_mul(&tmp_c0, &e1, pk); ------------------ | | 60| 7|#define gf2x_mod_mul RENAME_FUNC_NAME(gf2x_mod_mul) | | ------------------ | | | | 44| 7|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 7|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 7|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 85| 7| gf2x_mod_add(&tmp_c0, &tmp_c0, c0); ------------------ | | 123| 7|#define gf2x_mod_add RENAME_FUNC_NAME(gf2x_mod_add) | | ------------------ | | | | 44| 7|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 7|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 7|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 86| 7| gf2x_mod_add(&tmp_c0, &tmp_c0, &e0); ------------------ | | 123| 7|#define gf2x_mod_add RENAME_FUNC_NAME(gf2x_mod_add) | | ------------------ | | | | 44| 7|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 7|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 7|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 87| | 88| | // Recompute the syndrome using the updated ciphertext 89| 7| compute_syndrome(syndrome, &tmp_c0, h0, ctx); ------------------ | | 66| 7|#define compute_syndrome RENAME_FUNC_NAME(compute_syndrome) | | ------------------ | | | | 44| 7|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 7|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 7|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 90| 7|} OQS_KEM_bike_l3_decode: 237| 1|{ 238| | // Initialize the decode methods struct 239| 1| decode_ctx ctx; 240| 1| decode_ctx_init(&ctx); ------------------ | | 94| 1|#define decode_ctx_init RENAME_FUNC_NAME(decode_ctx_init) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 241| | 242| 1| DEFER_CLEANUP(e_t black_e = {0}, e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 243| 1| DEFER_CLEANUP(e_t gray_e = {0}, e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 244| | 245| 1| DEFER_CLEANUP(pad_r_t c0 = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 246| 1| DEFER_CLEANUP(pad_r_t h0 = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 247| 1| pad_r_t pk = {0}; 248| | 249| | // Pad ciphertext (c0), secret key (h0), and public key (h) 250| 1| c0.val = ct->c0; 251| 1| h0.val = sk->bin[0]; 252| 1| pk.val = sk->pk; 253| | 254| 1| DEFER_CLEANUP(syndrome_t s = {0}, syndrome_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 255| 1| DMSG(" Computing s.\n"); 256| 1| compute_syndrome(&s, &c0, &h0, &ctx); ------------------ | | 66| 1|#define compute_syndrome RENAME_FUNC_NAME(compute_syndrome) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 257| 1| ctx.dup(&s); 258| | 259| | // Reset (init) the error because it is xored in the find_err functions. 260| 1| bike_memset(e, 0, sizeof(*e)); 261| | 262| 6| for(uint32_t iter = 0; iter < MAX_IT; iter++) { ------------------ | | 53| 6|# define MAX_IT 5 ------------------ | Branch (262:26): [True: 5, False: 1] ------------------ 263| 5| const uint8_t threshold = get_threshold(&s); ------------------ | | 141| 5|#define get_threshold RENAME_FUNC_NAME(get_threshold) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 264| | 265| 5| DMSG(" Iteration: %d\n", iter); 266| 5| DMSG(" Weight of e: %lu\n", 267| 5| r_bits_vector_weight(&e->val[0]) + r_bits_vector_weight(&e->val[1])); 268| 5| DMSG(" Weight of syndrome: %lu\n", r_bits_vector_weight((r_t *)s.qw)); 269| | 270| 5| find_err1(e, &black_e, &gray_e, &s, sk->wlist, threshold, &ctx); 271| 5| recompute_syndrome(&s, &c0, &h0, &pk, e, &ctx); ------------------ | | 67| 5|#define recompute_syndrome RENAME_FUNC_NAME(recompute_syndrome) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 272| 5|#if defined(BGF_DECODER) 273| 5| if(iter >= 1) { ------------------ | Branch (273:8): [True: 4, False: 1] ------------------ 274| 4| continue; 275| 4| } 276| 1|#endif 277| 1| DMSG(" Weight of e: %lu\n", 278| 1| r_bits_vector_weight(&e->val[0]) + r_bits_vector_weight(&e->val[1])); 279| 1| DMSG(" Weight of syndrome: %lu\n", r_bits_vector_weight((r_t *)s.qw)); 280| | 281| 1| find_err2(e, &black_e, &s, sk->wlist, ((D + 1) / 2) + 1, &ctx); ------------------ | | 44| 1|# define D 103 ------------------ 282| 1| recompute_syndrome(&s, &c0, &h0, &pk, e, &ctx); ------------------ | | 67| 1|#define recompute_syndrome RENAME_FUNC_NAME(recompute_syndrome) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 283| | 284| 1| DMSG(" Weight of e: %lu\n", 285| 1| r_bits_vector_weight(&e->val[0]) + r_bits_vector_weight(&e->val[1])); 286| 1| DMSG(" Weight of syndrome: %lu\n", r_bits_vector_weight((r_t *)s.qw)); 287| | 288| 1| find_err2(e, &gray_e, &s, sk->wlist, ((D + 1) / 2) + 1, &ctx); ------------------ | | 44| 1|# define D 103 ------------------ 289| 1| recompute_syndrome(&s, &c0, &h0, &pk, e, &ctx); ------------------ | | 67| 1|#define recompute_syndrome RENAME_FUNC_NAME(recompute_syndrome) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 290| 1| } 291| 1|} decode.c:OQS_KEM_bike_l3_get_threshold: 103| 5|{ 104| 5| bike_static_assert(sizeof(*s) >= sizeof(r_t), syndrome_is_large_enough); ------------------ | | 33| 5| typedef char static_assertion_##MSG[(COND) ? 1 : -1] BIKE_UNUSED_ATT ------------------ 105| | 106| 5| const uint64_t syndrome_weight = r_bits_vector_weight((const r_t *)s->qw); ------------------ | | 78| 5|#define r_bits_vector_weight RENAME_FUNC_NAME(r_bits_vector_weight) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 107| | 108| | // The threshold coefficients are defined in the spec as floating point values. 109| | // Since we want to avoid floating point operations for constant-timeness, 110| | // we use integer arithmetic to compute the threshold. 111| | // For example, in the case of Level-1 parameters, instead of having: 112| | // T0 = 13.530 and T1 = 0.0069722, 113| | // we multipy the values by 10^8 and work with integers: 114| | // T0' = 1353000000 and T1' = 697220. 115| | // Then, instead of computing the threshold by: 116| | // T0 + T1*S, 117| | // we compute: 118| | // (T0' + T1'*S)/10^8, 119| | // where S is the syndrome weight. Additionally, instead of dividing by 10^8, 120| | // we compute the result by a multiplication and a right shift (both 121| | // constant-time operations), as described in: 122| | // https://dl.acm.org/doi/pdf/10.1145/178243.178249 123| 5| uint64_t thr = THRESHOLD_COEFF0 + (THRESHOLD_COEFF1 * syndrome_weight); ------------------ | | 47| 5|# define THRESHOLD_COEFF0 1525880000ULL ------------------ uint64_t thr = THRESHOLD_COEFF0 + (THRESHOLD_COEFF1 * syndrome_weight); ------------------ | | 48| 5|# define THRESHOLD_COEFF1 526500ULL ------------------ 124| 5| MUL64HIGH(thr, thr, THRESHOLD_MUL_CONST); ------------------ | | 93| 5| do { \ | | 94| 5| uint64_t a_lo, a_hi, b_lo, b_hi; \ | | 95| 5| a_lo = a & 0xffffffff; \ | | 96| 5| b_lo = b & 0xffffffff; \ | | 97| 5| a_hi = a >> 32; \ | | 98| 5| b_hi = b >> 32; \ | | 99| 5| c = a_hi*b_hi + ((a_hi*b_lo + a_lo*b_hi) >> 32); \ | | 100| 5| } while(0) | | ------------------ | | | Branch (100:11): [Folded, False: 5] | | ------------------ ------------------ 125| 5| thr >>= THRESHOLD_SHR_CONST; ------------------ | | 50| 5|# define THRESHOLD_SHR_CONST 26 ------------------ 126| | 127| 5| const uint32_t mask = secure_l32_mask((uint32_t)thr, THRESHOLD_MIN); ------------------ | | 51| 5|# define THRESHOLD_MIN 52 ------------------ 128| 5| thr = (u32_barrier(mask) & thr) | (u32_barrier(~mask) & THRESHOLD_MIN); ------------------ | | 51| 5|# define THRESHOLD_MIN 52 ------------------ 129| | 130| 5| DMSG(" Threshold: %d\n", thr); 131| 5| return thr; 132| 5|} OQS_KEM_bike_l5_compute_syndrome: 60| 8|{ 61| 8| DEFER_CLEANUP(pad_r_t pad_s, pad_r_cleanup); ------------------ | | 16| 8| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 62| | 63| 8| gf2x_mod_mul(&pad_s, c0, h0); ------------------ | | 60| 8|#define gf2x_mod_mul RENAME_FUNC_NAME(gf2x_mod_mul) | | ------------------ | | | | 44| 8|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 8|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 8|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 64| | 65| 8| bike_memcpy((uint8_t *)syndrome->qw, pad_s.val.raw, R_BYTES); ------------------ | | 81| 8|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 8|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 66| 8| ctx->dup(syndrome); 67| 8|} OQS_KEM_bike_l5_recompute_syndrome: 75| 7|{ 76| 7| DEFER_CLEANUP(pad_r_t tmp_c0, pad_r_cleanup); ------------------ | | 16| 7| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 77| 7| DEFER_CLEANUP(pad_r_t e0 = {0}, pad_r_cleanup); ------------------ | | 16| 7| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 78| 7| DEFER_CLEANUP(pad_r_t e1 = {0}, pad_r_cleanup); ------------------ | | 16| 7| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 79| | 80| 7| e0.val = e->val[0]; 81| 7| e1.val = e->val[1]; 82| | 83| | // tmp_c0 = pk * e1 + c0 + e0 84| 7| gf2x_mod_mul(&tmp_c0, &e1, pk); ------------------ | | 60| 7|#define gf2x_mod_mul RENAME_FUNC_NAME(gf2x_mod_mul) | | ------------------ | | | | 44| 7|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 7|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 7|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 85| 7| gf2x_mod_add(&tmp_c0, &tmp_c0, c0); ------------------ | | 123| 7|#define gf2x_mod_add RENAME_FUNC_NAME(gf2x_mod_add) | | ------------------ | | | | 44| 7|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 7|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 7|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 86| 7| gf2x_mod_add(&tmp_c0, &tmp_c0, &e0); ------------------ | | 123| 7|#define gf2x_mod_add RENAME_FUNC_NAME(gf2x_mod_add) | | ------------------ | | | | 44| 7|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 7|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 7|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 87| | 88| | // Recompute the syndrome using the updated ciphertext 89| 7| compute_syndrome(syndrome, &tmp_c0, h0, ctx); ------------------ | | 66| 7|#define compute_syndrome RENAME_FUNC_NAME(compute_syndrome) | | ------------------ | | | | 44| 7|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 7|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 7|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 90| 7|} OQS_KEM_bike_l5_decode: 237| 1|{ 238| | // Initialize the decode methods struct 239| 1| decode_ctx ctx; 240| 1| decode_ctx_init(&ctx); ------------------ | | 94| 1|#define decode_ctx_init RENAME_FUNC_NAME(decode_ctx_init) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 241| | 242| 1| DEFER_CLEANUP(e_t black_e = {0}, e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 243| 1| DEFER_CLEANUP(e_t gray_e = {0}, e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 244| | 245| 1| DEFER_CLEANUP(pad_r_t c0 = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 246| 1| DEFER_CLEANUP(pad_r_t h0 = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 247| 1| pad_r_t pk = {0}; 248| | 249| | // Pad ciphertext (c0), secret key (h0), and public key (h) 250| 1| c0.val = ct->c0; 251| 1| h0.val = sk->bin[0]; 252| 1| pk.val = sk->pk; 253| | 254| 1| DEFER_CLEANUP(syndrome_t s = {0}, syndrome_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 255| 1| DMSG(" Computing s.\n"); 256| 1| compute_syndrome(&s, &c0, &h0, &ctx); ------------------ | | 66| 1|#define compute_syndrome RENAME_FUNC_NAME(compute_syndrome) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 257| 1| ctx.dup(&s); 258| | 259| | // Reset (init) the error because it is xored in the find_err functions. 260| 1| bike_memset(e, 0, sizeof(*e)); 261| | 262| 6| for(uint32_t iter = 0; iter < MAX_IT; iter++) { ------------------ | | 53| 6|# define MAX_IT 5 ------------------ | Branch (262:26): [True: 5, False: 1] ------------------ 263| 5| const uint8_t threshold = get_threshold(&s); ------------------ | | 141| 5|#define get_threshold RENAME_FUNC_NAME(get_threshold) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 264| | 265| 5| DMSG(" Iteration: %d\n", iter); 266| 5| DMSG(" Weight of e: %lu\n", 267| 5| r_bits_vector_weight(&e->val[0]) + r_bits_vector_weight(&e->val[1])); 268| 5| DMSG(" Weight of syndrome: %lu\n", r_bits_vector_weight((r_t *)s.qw)); 269| | 270| 5| find_err1(e, &black_e, &gray_e, &s, sk->wlist, threshold, &ctx); 271| 5| recompute_syndrome(&s, &c0, &h0, &pk, e, &ctx); ------------------ | | 67| 5|#define recompute_syndrome RENAME_FUNC_NAME(recompute_syndrome) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 272| 5|#if defined(BGF_DECODER) 273| 5| if(iter >= 1) { ------------------ | Branch (273:8): [True: 4, False: 1] ------------------ 274| 4| continue; 275| 4| } 276| 1|#endif 277| 1| DMSG(" Weight of e: %lu\n", 278| 1| r_bits_vector_weight(&e->val[0]) + r_bits_vector_weight(&e->val[1])); 279| 1| DMSG(" Weight of syndrome: %lu\n", r_bits_vector_weight((r_t *)s.qw)); 280| | 281| 1| find_err2(e, &black_e, &s, sk->wlist, ((D + 1) / 2) + 1, &ctx); ------------------ | | 60| 1|# define D 137 ------------------ 282| 1| recompute_syndrome(&s, &c0, &h0, &pk, e, &ctx); ------------------ | | 67| 1|#define recompute_syndrome RENAME_FUNC_NAME(recompute_syndrome) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 283| | 284| 1| DMSG(" Weight of e: %lu\n", 285| 1| r_bits_vector_weight(&e->val[0]) + r_bits_vector_weight(&e->val[1])); 286| 1| DMSG(" Weight of syndrome: %lu\n", r_bits_vector_weight((r_t *)s.qw)); 287| | 288| 1| find_err2(e, &gray_e, &s, sk->wlist, ((D + 1) / 2) + 1, &ctx); ------------------ | | 60| 1|# define D 137 ------------------ 289| 1| recompute_syndrome(&s, &c0, &h0, &pk, e, &ctx); ------------------ | | 67| 1|#define recompute_syndrome RENAME_FUNC_NAME(recompute_syndrome) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 290| 1| } 291| 1|} decode.c:OQS_KEM_bike_l5_get_threshold: 103| 5|{ 104| 5| bike_static_assert(sizeof(*s) >= sizeof(r_t), syndrome_is_large_enough); ------------------ | | 33| 5| typedef char static_assertion_##MSG[(COND) ? 1 : -1] BIKE_UNUSED_ATT ------------------ 105| | 106| 5| const uint64_t syndrome_weight = r_bits_vector_weight((const r_t *)s->qw); ------------------ | | 78| 5|#define r_bits_vector_weight RENAME_FUNC_NAME(r_bits_vector_weight) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 107| | 108| | // The threshold coefficients are defined in the spec as floating point values. 109| | // Since we want to avoid floating point operations for constant-timeness, 110| | // we use integer arithmetic to compute the threshold. 111| | // For example, in the case of Level-1 parameters, instead of having: 112| | // T0 = 13.530 and T1 = 0.0069722, 113| | // we multipy the values by 10^8 and work with integers: 114| | // T0' = 1353000000 and T1' = 697220. 115| | // Then, instead of computing the threshold by: 116| | // T0 + T1*S, 117| | // we compute: 118| | // (T0' + T1'*S)/10^8, 119| | // where S is the syndrome weight. Additionally, instead of dividing by 10^8, 120| | // we compute the result by a multiplication and a right shift (both 121| | // constant-time operations), as described in: 122| | // https://dl.acm.org/doi/pdf/10.1145/178243.178249 123| 5| uint64_t thr = THRESHOLD_COEFF0 + (THRESHOLD_COEFF1 * syndrome_weight); ------------------ | | 63| 5|# define THRESHOLD_COEFF0 1787850000ULL ------------------ uint64_t thr = THRESHOLD_COEFF0 + (THRESHOLD_COEFF1 * syndrome_weight); ------------------ | | 64| 5|# define THRESHOLD_COEFF1 402312ULL ------------------ 124| 5| MUL64HIGH(thr, thr, THRESHOLD_MUL_CONST); ------------------ | | 93| 5| do { \ | | 94| 5| uint64_t a_lo, a_hi, b_lo, b_hi; \ | | 95| 5| a_lo = a & 0xffffffff; \ | | 96| 5| b_lo = b & 0xffffffff; \ | | 97| 5| a_hi = a >> 32; \ | | 98| 5| b_hi = b >> 32; \ | | 99| 5| c = a_hi*b_hi + ((a_hi*b_lo + a_lo*b_hi) >> 32); \ | | 100| 5| } while(0) | | ------------------ | | | Branch (100:11): [Folded, False: 5] | | ------------------ ------------------ 125| 5| thr >>= THRESHOLD_SHR_CONST; ------------------ | | 66| 5|# define THRESHOLD_SHR_CONST 26 ------------------ 126| | 127| 5| const uint32_t mask = secure_l32_mask((uint32_t)thr, THRESHOLD_MIN); ------------------ | | 67| 5|# define THRESHOLD_MIN 69 ------------------ 128| 5| thr = (u32_barrier(mask) & thr) | (u32_barrier(~mask) & THRESHOLD_MIN); ------------------ | | 67| 5|# define THRESHOLD_MIN 69 ------------------ 129| | 130| 5| DMSG(" Threshold: %d\n", thr); 131| 5| return thr; 132| 5|} OQS_KEM_bike_l1_rotate_right_avx2: 99| 4.97k|{ 100| | // 1) Rotate in granularity of 256 bits blocks, using YMMs 101| 4.97k| rotate256_big(out, in, (bitscount / BITS_IN_YMM)); ------------------ | | 51| 4.97k|#define BITS_IN_YMM (BYTES_IN_YMM * 8) | | ------------------ | | | | 48| 4.97k|#define BYTES_IN_YMM 0x20 | | ------------------ ------------------ 102| | // 2) Rotate in smaller granularity (less than 256 bits), using YMMs 103| 4.97k| rotate256_small(out, out, (bitscount % BITS_IN_YMM)); ------------------ | | 79| 4.97k|#define rotate256_small RENAME_FUNC_NAME(rotate256_small) | | ------------------ | | | | 44| 4.97k|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 4.97k|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 4.97k|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ rotate256_small(out, out, (bitscount % BITS_IN_YMM)); ------------------ | | 51| 4.97k|#define BITS_IN_YMM (BYTES_IN_YMM * 8) | | ------------------ | | | | 48| 4.97k|#define BYTES_IN_YMM 0x20 | | ------------------ ------------------ 104| 4.97k|} OQS_KEM_bike_l1_dup_avx2: 112| 45|{ 113| 45| s->qw[R_QWORDS - 1] = ------------------ | | 82| 45|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 45|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 114| 45| (s->qw[0] << LAST_R_QWORD_LEAD) | (s->qw[R_QWORDS - 1] & LAST_R_QWORD_MASK); ------------------ | | 92| 45|#define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 23| 45|# define R_BITS 12323 | | ------------------ | | #define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 43| 45|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 45|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ (s->qw[0] << LAST_R_QWORD_LEAD) | (s->qw[R_QWORDS - 1] & LAST_R_QWORD_MASK); ------------------ | | 82| 45|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 45|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ (s->qw[0] << LAST_R_QWORD_LEAD) | (s->qw[R_QWORDS - 1] & LAST_R_QWORD_MASK); ------------------ | | 94| 45|#define LAST_R_QWORD_MASK MASK(LAST_R_QWORD_LEAD) | | ------------------ | | | | 43| 45|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 45|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 115| | 116| 17.3k| for(size_t i = 0; i < (2 * R_QWORDS) - 1; i++) { ------------------ | | 82| 17.3k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 17.3k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (116:21): [True: 17.3k, False: 45] ------------------ 117| 17.3k| s->qw[R_QWORDS + i] = ------------------ | | 82| 17.3k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 17.3k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 118| 17.3k| (s->qw[i] >> LAST_R_QWORD_TRAIL) | (s->qw[i + 1] << LAST_R_QWORD_LEAD); ------------------ | | 93| 17.3k|#define LAST_R_QWORD_TRAIL (64 - LAST_R_QWORD_LEAD) | | ------------------ | | | | 92| 17.3k|#define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | | | ------------------ | | | | | | 23| 17.3k|# define R_BITS 12323 | | | | ------------------ | | | | #define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | | | ------------------ | | | | | | 43| 17.3k|#define MASK(len) (BIT(len) - 1) | | | | | | ------------------ | | | | | | | | 42| 17.3k|#define BIT(len) (1ULL << (len)) | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ (s->qw[i] >> LAST_R_QWORD_TRAIL) | (s->qw[i + 1] << LAST_R_QWORD_LEAD); ------------------ | | 92| 17.3k|#define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 23| 17.3k|# define R_BITS 12323 | | ------------------ | | #define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 43| 17.3k|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 17.3k|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 119| 17.3k| } 120| 45|} OQS_KEM_bike_l1_bit_sliced_adder_avx2: 126| 5.12k|{ 127| | // From cache-memory perspective this loop should be the outside loop 128| 32.7k| for(size_t j = 0; j < num_of_slices; j++) { ------------------ | Branch (128:21): [True: 27.5k, False: 5.12k] ------------------ 129| 5.35M| for(size_t i = 0; i < R_QWORDS; i++) { ------------------ | | 82| 5.35M|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 5.35M|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (129:23): [True: 5.32M, False: 27.5k] ------------------ 130| 5.32M| const uint64_t carry = (upc->slice[j].u.qw[i] & rotated_syndrome->qw[i]); 131| 5.32M| upc->slice[j].u.qw[i] ^= rotated_syndrome->qw[i]; 132| 5.32M| rotated_syndrome->qw[i] = carry; 133| 5.32M| } 134| 27.5k| } 135| 5.12k|} OQS_KEM_bike_l1_bit_slice_full_subtract_avx2: 138| 70|{ 139| | // Borrow 140| 70| uint64_t br[R_QWORDS] = {0}; 141| | 142| 630| for(size_t j = 0; j < SLICES; j++) { ------------------ | | 116| 630|#define SLICES (LOG2_MSB(D) + 1) | | ------------------ | | | | 77| 630| ((v) == 0 \ | | | | ------------------ | | | | | Branch (77:4): [Folded, False: 630] | | | | ------------------ | | | | 78| 630| ? 0 \ | | | | 79| 630| : ((v) < 2 \ | | | | ------------------ | | | | | Branch (79:9): [Folded, False: 630] | | | | ------------------ | | | | 80| 630| ? 1 \ | | | | 81| 630| : ((v) < 4 \ | | | | ------------------ | | | | | Branch (81:14): [Folded, False: 630] | | | | ------------------ | | | | 82| 630| ? 2 \ | | | | 83| 630| : ((v) < 8 \ | | | | ------------------ | | | | | Branch (83:19): [Folded, False: 630] | | | | ------------------ | | | | 84| 630| ? 3 \ | | | | 85| 630| : ((v) < 16 \ | | | | ------------------ | | | | | Branch (85:24): [Folded, False: 630] | | | | ------------------ | | | | 86| 630| ? 4 \ | | | | 87| 630| : ((v) < 32 \ | | | | ------------------ | | | | | Branch (87:29): [Folded, False: 630] | | | | ------------------ | | | | 88| 630| ? 5 \ | | | | 89| 630| : ((v) < 64 \ | | | | ------------------ | | | | | Branch (89:34): [Folded, False: 630] | | | | ------------------ | | | | 90| 630| ? 6 \ | | | | 91| 630| : ((v) < 128 ? 7 \ | | | | ------------------ | | | | | Branch (91:39): [True: 630, Folded] | | | | ------------------ | | | | 92| 630| : ((v) < 256 ? 8 : 9))))))))) | | | | ------------------ | | | | | Branch (92:52): [True: 0, Folded] | | | | ------------------ | | ------------------ ------------------ | Branch (142:21): [True: 560, False: 70] ------------------ 143| | 144| 560| const uint64_t lsb_mask = 0 - (val & 0x1); 145| 560| val >>= 1; 146| | 147| | // Perform a - b with c as the input/output carry 148| | // br = 0 0 0 0 1 1 1 1 149| | // a = 0 0 1 1 0 0 1 1 150| | // b = 0 1 0 1 0 1 0 1 151| | // ------------------- 152| | // o = 0 1 1 0 0 1 1 1 153| | // c = 0 1 0 0 1 1 0 1 154| | // 155| | // o = a^b^c 156| | // _ __ _ _ _ _ _ 157| | // br = abc + abc + abc + abc = abc + ((a+b))c 158| | 159| 108k| for(size_t i = 0; i < R_QWORDS; i++) { ------------------ | | 82| 108k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 108k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (159:23): [True: 108k, False: 560] ------------------ 160| 108k| const uint64_t a = upc->slice[j].u.qw[i]; 161| 108k| const uint64_t b = lsb_mask; 162| 108k| const uint64_t tmp = ((~a) & b & (~br[i])) | ((((~a) | b) & br[i])); 163| 108k| upc->slice[j].u.qw[i] = a ^ b ^ br[i]; 164| 108k| br[i] = tmp; 165| 108k| } 166| 560| } 167| 70|} decode_avx2.c:rotate256_big: 32| 8.33k|{ 33| | // For preventing overflows (comparison in bytes) 34| 8.33k| bike_static_assert(sizeof(*out) > ------------------ | | 33| 8.33k| typedef char static_assertion_##MSG[(COND) ? 1 : -1] BIKE_UNUSED_ATT ------------------ 35| 8.33k| (BYTES_IN_YMM * (R_YMM + (2 * R_YMM_HALF_LOG2))), 36| 8.33k| rotr_big_err); 37| | 38| 8.33k| *out = *in; 39| | 40| 63.5k| for(uint32_t idx = R_YMM_HALF_LOG2; idx >= 1; idx >>= 1) { ------------------ | | 28| 8.33k|#define R_YMM_HALF_LOG2 UPTOPOW2(R_YMM / 2) | | ------------------ | | | | 73| 8.33k|#define UPTOPOW2(v) (UPTOPOW2_5(v) + 1) | | | | ------------------ | | | | | | 71| 8.33k|#define UPTOPOW2_5(v) (UPTOPOW2_4(v) | (UPTOPOW2_4(v) >> 16)) | | | | | | ------------------ | | | | | | | | 70| 8.33k|#define UPTOPOW2_4(v) (UPTOPOW2_3(v) | (UPTOPOW2_3(v) >> 8)) | | | | | | | | ------------------ | | | | | | | | | | 69| 8.33k|#define UPTOPOW2_3(v) (UPTOPOW2_2(v) | (UPTOPOW2_2(v) >> 4)) | | | | | | | | | | ------------------ | | | | | | | | | | | | 68| 8.33k|#define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | | | #define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | ------------------ | | | | | | | | | | #define UPTOPOW2_3(v) (UPTOPOW2_2(v) | (UPTOPOW2_2(v) >> 4)) | | | | | | | | | | ------------------ | | | | | | | | | | | | 68| 8.33k|#define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | | | #define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | ------------------ | | | | | | | | ------------------ | | | | | | | | #define UPTOPOW2_4(v) (UPTOPOW2_3(v) | (UPTOPOW2_3(v) >> 8)) | | | | | | | | ------------------ | | | | | | | | | | 69| 8.33k|#define UPTOPOW2_3(v) (UPTOPOW2_2(v) | (UPTOPOW2_2(v) >> 4)) | | | | | | | | | | ------------------ | | | | | | | | | | | | 68| 8.33k|#define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | | | #define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | ------------------ | | | | | | | | | | #define UPTOPOW2_3(v) (UPTOPOW2_2(v) | (UPTOPOW2_2(v) >> 4)) | | | | | | | | | | ------------------ | | | | | | | | | | | | 68| 8.33k|#define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | | | #define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | ------------------ | | | | | | | | ------------------ | | | | | | ------------------ | | | | | | #define UPTOPOW2_5(v) (UPTOPOW2_4(v) | (UPTOPOW2_4(v) >> 16)) | | | | | | ------------------ | | | | | | | | 70| 8.33k|#define UPTOPOW2_4(v) (UPTOPOW2_3(v) | (UPTOPOW2_3(v) >> 8)) | | | | | | | | ------------------ | | | | | | | | | | 69| 8.33k|#define UPTOPOW2_3(v) (UPTOPOW2_2(v) | (UPTOPOW2_2(v) >> 4)) | | | | | | | | | | ------------------ | | | | | | | | | | | | 68| 8.33k|#define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | | | #define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | ------------------ | | | | | | | | | | #define UPTOPOW2_3(v) (UPTOPOW2_2(v) | (UPTOPOW2_2(v) >> 4)) | | | | | | | | | | ------------------ | | | | | | | | | | | | 68| 8.33k|#define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | | | #define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | ------------------ | | | | | | | | ------------------ | | | | | | | | #define UPTOPOW2_4(v) (UPTOPOW2_3(v) | (UPTOPOW2_3(v) >> 8)) | | | | | | | | ------------------ | | | | | | | | | | 69| 8.33k|#define UPTOPOW2_3(v) (UPTOPOW2_2(v) | (UPTOPOW2_2(v) >> 4)) | | | | | | | | | | ------------------ | | | | | | | | | | | | 68| 8.33k|#define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | | | #define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | ------------------ | | | | | | | | | | #define UPTOPOW2_3(v) (UPTOPOW2_2(v) | (UPTOPOW2_2(v) >> 4)) | | | | | | | | | | ------------------ | | | | | | | | | | | | 68| 8.33k|#define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | | | #define UPTOPOW2_2(v) (UPTOPOW2_1(v) | (UPTOPOW2_1(v) >> 2)) | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | 67| 8.33k|#define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | #define UPTOPOW2_1(v) (UPTOPOW2_0(v) | (UPTOPOW2_0(v) >> 1)) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | | | | | 66| 8.33k|#define UPTOPOW2_0(v) ((v)-1) | | | | | | | | | | | | | | ------------------ | | | | | | | | | | | | ------------------ | | | | | | | | | | ------------------ | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (40:39): [True: 55.2k, False: 8.33k] ------------------ 41| 55.2k| const uint8_t mask = secure_l32_mask(ymm_num, idx); 42| 55.2k| const __m256i blend_mask = SET1_I8(mask); ------------------ | | 68| 55.2k|# define SET1_I8(a) _mm256_set1_epi8(a) ------------------ 43| 55.2k| ymm_num = ymm_num - (idx & mask); 44| | 45| 5.95M| for(size_t i = 0; i < (R_YMM + idx); i++) { ------------------ | | 84| 5.95M|#define R_YMM DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_YMM) | | ------------------ | | | | 37| 5.95M|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (45:23): [True: 5.89M, False: 55.2k] ------------------ 46| 5.89M| __m256i a = LOAD(&out->qw[4 * (i + idx)]); ------------------ | | 28| 5.89M|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 47| 5.89M| __m256i b = LOAD(&out->qw[4 * i]); ------------------ | | 28| 5.89M|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 48| 5.89M| b = BLENDV_I8(b, a, blend_mask); ------------------ | | 92| 5.89M|# define BLENDV_I8(a, b, mask) _mm256_blendv_epi8(a, b, mask) ------------------ 49| 5.89M| STORE(&out->qw[4 * i], b); ------------------ | | 29| 5.89M|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 50| 5.89M| } 51| 55.2k| } 52| 8.33k|} decode_avx2.c:OQS_KEM_bike_l1_rotate256_small: 56| 4.97k|{ 57| 4.97k| __m256i carry_in = SET_ZERO; ------------------ | | 72| 4.97k|# define SET_ZERO _mm256_setzero_si256() ------------------ 58| 4.97k| const int count64 = (int)count & 0x3f; 59| 4.97k| const uint64_t count_mask = (count >> 5) & 0xe; 60| | 61| 4.97k| __m256i idx = SET_I32(7, 6, 5, 4, 3, 2, 1, 0); ------------------ | | 66| 4.97k|# define SET_I32(...) _mm256_set_epi32(__VA_ARGS__) ------------------ 62| 4.97k| const __m256i zero_mask = SET_I64(-1, -1, -1, 0); ------------------ | | 67| 4.97k|# define SET_I64(...) _mm256_set_epi64x(__VA_ARGS__) ------------------ 63| 4.97k| const __m256i count_vet = SET1_I8(count_mask); ------------------ | | 68| 4.97k|# define SET1_I8(a) _mm256_set1_epi8(a) ------------------ 64| | 65| 4.97k| ALIGN(ALIGN_BYTES) ------------------ | | 18| 4.97k|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 66| 4.97k| const uint8_t zero_mask2_buf[] = { 67| 4.97k| 0x86, 0x86, 0x86, 0x86, 0x86, 0x86, 0x86, 0x86, 0x84, 0x84, 0x84, 68| 4.97k| 0x84, 0x84, 0x84, 0x84, 0x84, 0x82, 0x82, 0x82, 0x82, 0x82, 0x82, 69| 4.97k| 0x82, 0x82, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80}; 70| 4.97k| __m256i zero_mask2 = LOAD(zero_mask2_buf); ------------------ | | 28| 4.97k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 71| | 72| 4.97k| zero_mask2 = SUB_I8(zero_mask2, count_vet); ------------------ | | 75| 4.97k|# define SUB_I8(a, b) _mm256_sub_epi8(a, b) ------------------ 73| 4.97k| idx = ADD_I8(idx, count_vet); ------------------ | | 74| 4.97k|# define ADD_I8(a, b) _mm256_add_epi8(a, b) ------------------ 74| | 75| 253k| for(int i = R_YMM; i >= 0; i--) { ------------------ | | 84| 4.97k|#define R_YMM DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_YMM) | | ------------------ | | | | 37| 4.97k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (75:22): [True: 248k, False: 4.97k] ------------------ 76| | // Load the next 256 bits 77| 248k| __m256i in256 = LOAD(&in->qw[4 * i]); ------------------ | | 28| 248k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 78| | 79| | // Rotate the current and previous 256 registers so that their quadwords 80| | // would be in the right positions. 81| 248k| __m256i carry_out = PERMVAR_I32(in256, idx); ------------------ | | 93| 248k|# define PERMVAR_I32(a, idx) _mm256_permutevar8x32_epi32(a, idx) ------------------ 82| 248k| in256 = BLENDV_I8(carry_in, carry_out, zero_mask2); ------------------ | | 92| 248k|# define BLENDV_I8(a, b, mask) _mm256_blendv_epi8(a, b, mask) ------------------ 83| | 84| | // Shift less than 64 (quadwords internal) 85| 248k| __m256i inner_carry = BLENDV_I8(carry_in, in256, zero_mask); ------------------ | | 92| 248k|# define BLENDV_I8(a, b, mask) _mm256_blendv_epi8(a, b, mask) ------------------ 86| 248k| inner_carry = PERM_I64(inner_carry, 0x39); ------------------ | | 94| 248k|# define PERM_I64(a, imm) _mm256_permute4x64_epi64(a, imm) ------------------ 87| 248k| const __m256i out256 = 88| 248k| SRLI_I64(in256, count64) | SLLI_I64(inner_carry, (int)64 - count64); ------------------ | | 32| 248k|# define SRLI_I64(a, imm) _mm256_srli_epi64(a, imm) ------------------ SRLI_I64(in256, count64) | SLLI_I64(inner_carry, (int)64 - count64); ------------------ | | 31| 248k|# define SLLI_I64(a, imm) _mm256_slli_epi64(a, imm) ------------------ 89| | 90| | // Store the rotated value 91| 248k| STORE(&out->qw[4 * i], out256); ------------------ | | 29| 248k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 92| 248k| carry_in = carry_out; 93| 248k| } 94| 4.97k|} OQS_KEM_bike_l3_rotate_right_avx2: 99| 1.44k|{ 100| | // 1) Rotate in granularity of 256 bits blocks, using YMMs 101| 1.44k| rotate256_big(out, in, (bitscount / BITS_IN_YMM)); ------------------ | | 51| 1.44k|#define BITS_IN_YMM (BYTES_IN_YMM * 8) | | ------------------ | | | | 48| 1.44k|#define BYTES_IN_YMM 0x20 | | ------------------ ------------------ 102| | // 2) Rotate in smaller granularity (less than 256 bits), using YMMs 103| 1.44k| rotate256_small(out, out, (bitscount % BITS_IN_YMM)); ------------------ | | 79| 1.44k|#define rotate256_small RENAME_FUNC_NAME(rotate256_small) | | ------------------ | | | | 44| 1.44k|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1.44k|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1.44k|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ rotate256_small(out, out, (bitscount % BITS_IN_YMM)); ------------------ | | 51| 1.44k|#define BITS_IN_YMM (BYTES_IN_YMM * 8) | | ------------------ | | | | 48| 1.44k|#define BYTES_IN_YMM 0x20 | | ------------------ ------------------ 104| 1.44k|} OQS_KEM_bike_l3_dup_avx2: 112| 9|{ 113| 9| s->qw[R_QWORDS - 1] = ------------------ | | 82| 9|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 9|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 114| 9| (s->qw[0] << LAST_R_QWORD_LEAD) | (s->qw[R_QWORDS - 1] & LAST_R_QWORD_MASK); ------------------ | | 92| 9|#define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 43| 9|# define R_BITS 24659 | | ------------------ | | #define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 43| 9|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 9|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ (s->qw[0] << LAST_R_QWORD_LEAD) | (s->qw[R_QWORDS - 1] & LAST_R_QWORD_MASK); ------------------ | | 82| 9|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 9|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ (s->qw[0] << LAST_R_QWORD_LEAD) | (s->qw[R_QWORDS - 1] & LAST_R_QWORD_MASK); ------------------ | | 94| 9|#define LAST_R_QWORD_MASK MASK(LAST_R_QWORD_LEAD) | | ------------------ | | | | 43| 9|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 9|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 115| | 116| 6.94k| for(size_t i = 0; i < (2 * R_QWORDS) - 1; i++) { ------------------ | | 82| 6.94k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 6.94k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (116:21): [True: 6.93k, False: 9] ------------------ 117| 6.93k| s->qw[R_QWORDS + i] = ------------------ | | 82| 6.93k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 6.93k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 118| 6.93k| (s->qw[i] >> LAST_R_QWORD_TRAIL) | (s->qw[i + 1] << LAST_R_QWORD_LEAD); ------------------ | | 93| 6.93k|#define LAST_R_QWORD_TRAIL (64 - LAST_R_QWORD_LEAD) | | ------------------ | | | | 92| 6.93k|#define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | | | ------------------ | | | | | | 43| 6.93k|# define R_BITS 24659 | | | | ------------------ | | | | #define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | | | ------------------ | | | | | | 43| 6.93k|#define MASK(len) (BIT(len) - 1) | | | | | | ------------------ | | | | | | | | 42| 6.93k|#define BIT(len) (1ULL << (len)) | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ (s->qw[i] >> LAST_R_QWORD_TRAIL) | (s->qw[i + 1] << LAST_R_QWORD_LEAD); ------------------ | | 92| 6.93k|#define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 43| 6.93k|# define R_BITS 24659 | | ------------------ | | #define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 43| 6.93k|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 6.93k|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 119| 6.93k| } 120| 9|} OQS_KEM_bike_l3_bit_sliced_adder_avx2: 126| 1.47k|{ 127| | // From cache-memory perspective this loop should be the outside loop 128| 10.1k| for(size_t j = 0; j < num_of_slices; j++) { ------------------ | Branch (128:21): [True: 8.65k, False: 1.47k] ------------------ 129| 3.34M| for(size_t i = 0; i < R_QWORDS; i++) { ------------------ | | 82| 3.34M|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 3.34M|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (129:23): [True: 3.34M, False: 8.65k] ------------------ 130| 3.34M| const uint64_t carry = (upc->slice[j].u.qw[i] & rotated_syndrome->qw[i]); 131| 3.34M| upc->slice[j].u.qw[i] ^= rotated_syndrome->qw[i]; 132| 3.34M| rotated_syndrome->qw[i] = carry; 133| 3.34M| } 134| 8.65k| } 135| 1.47k|} OQS_KEM_bike_l3_bit_slice_full_subtract_avx2: 138| 14|{ 139| | // Borrow 140| 14| uint64_t br[R_QWORDS] = {0}; 141| | 142| 126| for(size_t j = 0; j < SLICES; j++) { ------------------ | | 116| 126|#define SLICES (LOG2_MSB(D) + 1) | | ------------------ | | | | 77| 126| ((v) == 0 \ | | | | ------------------ | | | | | Branch (77:4): [Folded, False: 126] | | | | ------------------ | | | | 78| 126| ? 0 \ | | | | 79| 126| : ((v) < 2 \ | | | | ------------------ | | | | | Branch (79:9): [Folded, False: 126] | | | | ------------------ | | | | 80| 126| ? 1 \ | | | | 81| 126| : ((v) < 4 \ | | | | ------------------ | | | | | Branch (81:14): [Folded, False: 126] | | | | ------------------ | | | | 82| 126| ? 2 \ | | | | 83| 126| : ((v) < 8 \ | | | | ------------------ | | | | | Branch (83:19): [Folded, False: 126] | | | | ------------------ | | | | 84| 126| ? 3 \ | | | | 85| 126| : ((v) < 16 \ | | | | ------------------ | | | | | Branch (85:24): [Folded, False: 126] | | | | ------------------ | | | | 86| 126| ? 4 \ | | | | 87| 126| : ((v) < 32 \ | | | | ------------------ | | | | | Branch (87:29): [Folded, False: 126] | | | | ------------------ | | | | 88| 126| ? 5 \ | | | | 89| 126| : ((v) < 64 \ | | | | ------------------ | | | | | Branch (89:34): [Folded, False: 126] | | | | ------------------ | | | | 90| 126| ? 6 \ | | | | 91| 126| : ((v) < 128 ? 7 \ | | | | ------------------ | | | | | Branch (91:39): [True: 126, Folded] | | | | ------------------ | | | | 92| 126| : ((v) < 256 ? 8 : 9))))))))) | | | | ------------------ | | | | | Branch (92:52): [True: 0, Folded] | | | | ------------------ | | ------------------ ------------------ | Branch (142:21): [True: 112, False: 14] ------------------ 143| | 144| 112| const uint64_t lsb_mask = 0 - (val & 0x1); 145| 112| val >>= 1; 146| | 147| | // Perform a - b with c as the input/output carry 148| | // br = 0 0 0 0 1 1 1 1 149| | // a = 0 0 1 1 0 0 1 1 150| | // b = 0 1 0 1 0 1 0 1 151| | // ------------------- 152| | // o = 0 1 1 0 0 1 1 1 153| | // c = 0 1 0 0 1 1 0 1 154| | // 155| | // o = a^b^c 156| | // _ __ _ _ _ _ _ 157| | // br = abc + abc + abc + abc = abc + ((a+b))c 158| | 159| 43.3k| for(size_t i = 0; i < R_QWORDS; i++) { ------------------ | | 82| 43.3k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 43.3k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (159:23): [True: 43.2k, False: 112] ------------------ 160| 43.2k| const uint64_t a = upc->slice[j].u.qw[i]; 161| 43.2k| const uint64_t b = lsb_mask; 162| 43.2k| const uint64_t tmp = ((~a) & b & (~br[i])) | ((((~a) | b) & br[i])); 163| 43.2k| upc->slice[j].u.qw[i] = a ^ b ^ br[i]; 164| 43.2k| br[i] = tmp; 165| 43.2k| } 166| 112| } 167| 14|} decode_avx2.c:OQS_KEM_bike_l3_rotate256_small: 56| 1.44k|{ 57| 1.44k| __m256i carry_in = SET_ZERO; ------------------ | | 72| 1.44k|# define SET_ZERO _mm256_setzero_si256() ------------------ 58| 1.44k| const int count64 = (int)count & 0x3f; 59| 1.44k| const uint64_t count_mask = (count >> 5) & 0xe; 60| | 61| 1.44k| __m256i idx = SET_I32(7, 6, 5, 4, 3, 2, 1, 0); ------------------ | | 66| 1.44k|# define SET_I32(...) _mm256_set_epi32(__VA_ARGS__) ------------------ 62| 1.44k| const __m256i zero_mask = SET_I64(-1, -1, -1, 0); ------------------ | | 67| 1.44k|# define SET_I64(...) _mm256_set_epi64x(__VA_ARGS__) ------------------ 63| 1.44k| const __m256i count_vet = SET1_I8(count_mask); ------------------ | | 68| 1.44k|# define SET1_I8(a) _mm256_set1_epi8(a) ------------------ 64| | 65| 1.44k| ALIGN(ALIGN_BYTES) ------------------ | | 18| 1.44k|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 66| 1.44k| const uint8_t zero_mask2_buf[] = { 67| 1.44k| 0x86, 0x86, 0x86, 0x86, 0x86, 0x86, 0x86, 0x86, 0x84, 0x84, 0x84, 68| 1.44k| 0x84, 0x84, 0x84, 0x84, 0x84, 0x82, 0x82, 0x82, 0x82, 0x82, 0x82, 69| 1.44k| 0x82, 0x82, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80}; 70| 1.44k| __m256i zero_mask2 = LOAD(zero_mask2_buf); ------------------ | | 28| 1.44k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 71| | 72| 1.44k| zero_mask2 = SUB_I8(zero_mask2, count_vet); ------------------ | | 75| 1.44k|# define SUB_I8(a, b) _mm256_sub_epi8(a, b) ------------------ 73| 1.44k| idx = ADD_I8(idx, count_vet); ------------------ | | 74| 1.44k|# define ADD_I8(a, b) _mm256_add_epi8(a, b) ------------------ 74| | 75| 142k| for(int i = R_YMM; i >= 0; i--) { ------------------ | | 84| 1.44k|#define R_YMM DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_YMM) | | ------------------ | | | | 37| 1.44k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (75:22): [True: 141k, False: 1.44k] ------------------ 76| | // Load the next 256 bits 77| 141k| __m256i in256 = LOAD(&in->qw[4 * i]); ------------------ | | 28| 141k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 78| | 79| | // Rotate the current and previous 256 registers so that their quadwords 80| | // would be in the right positions. 81| 141k| __m256i carry_out = PERMVAR_I32(in256, idx); ------------------ | | 93| 141k|# define PERMVAR_I32(a, idx) _mm256_permutevar8x32_epi32(a, idx) ------------------ 82| 141k| in256 = BLENDV_I8(carry_in, carry_out, zero_mask2); ------------------ | | 92| 141k|# define BLENDV_I8(a, b, mask) _mm256_blendv_epi8(a, b, mask) ------------------ 83| | 84| | // Shift less than 64 (quadwords internal) 85| 141k| __m256i inner_carry = BLENDV_I8(carry_in, in256, zero_mask); ------------------ | | 92| 141k|# define BLENDV_I8(a, b, mask) _mm256_blendv_epi8(a, b, mask) ------------------ 86| 141k| inner_carry = PERM_I64(inner_carry, 0x39); ------------------ | | 94| 141k|# define PERM_I64(a, imm) _mm256_permute4x64_epi64(a, imm) ------------------ 87| 141k| const __m256i out256 = 88| 141k| SRLI_I64(in256, count64) | SLLI_I64(inner_carry, (int)64 - count64); ------------------ | | 32| 141k|# define SRLI_I64(a, imm) _mm256_srli_epi64(a, imm) ------------------ SRLI_I64(in256, count64) | SLLI_I64(inner_carry, (int)64 - count64); ------------------ | | 31| 141k|# define SLLI_I64(a, imm) _mm256_slli_epi64(a, imm) ------------------ 89| | 90| | // Store the rotated value 91| 141k| STORE(&out->qw[4 * i], out256); ------------------ | | 29| 141k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 92| 141k| carry_in = carry_out; 93| 141k| } 94| 1.44k|} OQS_KEM_bike_l5_rotate_right_avx2: 99| 1.91k|{ 100| | // 1) Rotate in granularity of 256 bits blocks, using YMMs 101| 1.91k| rotate256_big(out, in, (bitscount / BITS_IN_YMM)); ------------------ | | 51| 1.91k|#define BITS_IN_YMM (BYTES_IN_YMM * 8) | | ------------------ | | | | 48| 1.91k|#define BYTES_IN_YMM 0x20 | | ------------------ ------------------ 102| | // 2) Rotate in smaller granularity (less than 256 bits), using YMMs 103| 1.91k| rotate256_small(out, out, (bitscount % BITS_IN_YMM)); ------------------ | | 79| 1.91k|#define rotate256_small RENAME_FUNC_NAME(rotate256_small) | | ------------------ | | | | 44| 1.91k|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1.91k|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1.91k|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ rotate256_small(out, out, (bitscount % BITS_IN_YMM)); ------------------ | | 51| 1.91k|#define BITS_IN_YMM (BYTES_IN_YMM * 8) | | ------------------ | | | | 48| 1.91k|#define BYTES_IN_YMM 0x20 | | ------------------ ------------------ 104| 1.91k|} OQS_KEM_bike_l5_dup_avx2: 112| 9|{ 113| 9| s->qw[R_QWORDS - 1] = ------------------ | | 82| 9|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 9|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 114| 9| (s->qw[0] << LAST_R_QWORD_LEAD) | (s->qw[R_QWORDS - 1] & LAST_R_QWORD_MASK); ------------------ | | 92| 9|#define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 59| 9|# define R_BITS 40973 | | ------------------ | | #define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 43| 9|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 9|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ (s->qw[0] << LAST_R_QWORD_LEAD) | (s->qw[R_QWORDS - 1] & LAST_R_QWORD_MASK); ------------------ | | 82| 9|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 9|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ (s->qw[0] << LAST_R_QWORD_LEAD) | (s->qw[R_QWORDS - 1] & LAST_R_QWORD_MASK); ------------------ | | 94| 9|#define LAST_R_QWORD_MASK MASK(LAST_R_QWORD_LEAD) | | ------------------ | | | | 43| 9|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 9|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 115| | 116| 11.5k| for(size_t i = 0; i < (2 * R_QWORDS) - 1; i++) { ------------------ | | 82| 11.5k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 11.5k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (116:21): [True: 11.5k, False: 9] ------------------ 117| 11.5k| s->qw[R_QWORDS + i] = ------------------ | | 82| 11.5k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 11.5k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 118| 11.5k| (s->qw[i] >> LAST_R_QWORD_TRAIL) | (s->qw[i + 1] << LAST_R_QWORD_LEAD); ------------------ | | 93| 11.5k|#define LAST_R_QWORD_TRAIL (64 - LAST_R_QWORD_LEAD) | | ------------------ | | | | 92| 11.5k|#define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | | | ------------------ | | | | | | 59| 11.5k|# define R_BITS 40973 | | | | ------------------ | | | | #define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | | | ------------------ | | | | | | 43| 11.5k|#define MASK(len) (BIT(len) - 1) | | | | | | ------------------ | | | | | | | | 42| 11.5k|#define BIT(len) (1ULL << (len)) | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ (s->qw[i] >> LAST_R_QWORD_TRAIL) | (s->qw[i + 1] << LAST_R_QWORD_LEAD); ------------------ | | 92| 11.5k|#define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 59| 11.5k|# define R_BITS 40973 | | ------------------ | | #define LAST_R_QWORD_LEAD (R_BITS & MASK(6)) | | ------------------ | | | | 43| 11.5k|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 11.5k|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 119| 11.5k| } 120| 9|} OQS_KEM_bike_l5_bit_sliced_adder_avx2: 126| 1.94k|{ 127| | // From cache-memory perspective this loop should be the outside loop 128| 14.1k| for(size_t j = 0; j < num_of_slices; j++) { ------------------ | Branch (128:21): [True: 12.1k, False: 1.94k] ------------------ 129| 7.80M| for(size_t i = 0; i < R_QWORDS; i++) { ------------------ | | 82| 7.80M|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 7.80M|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (129:23): [True: 7.79M, False: 12.1k] ------------------ 130| 7.79M| const uint64_t carry = (upc->slice[j].u.qw[i] & rotated_syndrome->qw[i]); 131| 7.79M| upc->slice[j].u.qw[i] ^= rotated_syndrome->qw[i]; 132| 7.79M| rotated_syndrome->qw[i] = carry; 133| 7.79M| } 134| 12.1k| } 135| 1.94k|} OQS_KEM_bike_l5_bit_slice_full_subtract_avx2: 138| 14|{ 139| | // Borrow 140| 14| uint64_t br[R_QWORDS] = {0}; 141| | 142| 140| for(size_t j = 0; j < SLICES; j++) { ------------------ | | 116| 140|#define SLICES (LOG2_MSB(D) + 1) | | ------------------ | | | | 77| 140| ((v) == 0 \ | | | | ------------------ | | | | | Branch (77:4): [Folded, False: 140] | | | | ------------------ | | | | 78| 140| ? 0 \ | | | | 79| 140| : ((v) < 2 \ | | | | ------------------ | | | | | Branch (79:9): [Folded, False: 140] | | | | ------------------ | | | | 80| 140| ? 1 \ | | | | 81| 140| : ((v) < 4 \ | | | | ------------------ | | | | | Branch (81:14): [Folded, False: 140] | | | | ------------------ | | | | 82| 140| ? 2 \ | | | | 83| 140| : ((v) < 8 \ | | | | ------------------ | | | | | Branch (83:19): [Folded, False: 140] | | | | ------------------ | | | | 84| 140| ? 3 \ | | | | 85| 140| : ((v) < 16 \ | | | | ------------------ | | | | | Branch (85:24): [Folded, False: 140] | | | | ------------------ | | | | 86| 140| ? 4 \ | | | | 87| 140| : ((v) < 32 \ | | | | ------------------ | | | | | Branch (87:29): [Folded, False: 140] | | | | ------------------ | | | | 88| 140| ? 5 \ | | | | 89| 140| : ((v) < 64 \ | | | | ------------------ | | | | | Branch (89:34): [Folded, False: 140] | | | | ------------------ | | | | 90| 140| ? 6 \ | | | | 91| 140| : ((v) < 128 ? 7 \ | | | | ------------------ | | | | | Branch (91:39): [Folded, False: 140] | | | | ------------------ | | | | 92| 140| : ((v) < 256 ? 8 : 9))))))))) | | | | ------------------ | | | | | Branch (92:52): [True: 140, Folded] | | | | ------------------ | | ------------------ ------------------ | Branch (142:21): [True: 126, False: 14] ------------------ 143| | 144| 126| const uint64_t lsb_mask = 0 - (val & 0x1); 145| 126| val >>= 1; 146| | 147| | // Perform a - b with c as the input/output carry 148| | // br = 0 0 0 0 1 1 1 1 149| | // a = 0 0 1 1 0 0 1 1 150| | // b = 0 1 0 1 0 1 0 1 151| | // ------------------- 152| | // o = 0 1 1 0 0 1 1 1 153| | // c = 0 1 0 0 1 1 0 1 154| | // 155| | // o = a^b^c 156| | // _ __ _ _ _ _ _ 157| | // br = abc + abc + abc + abc = abc + ((a+b))c 158| | 159| 80.8k| for(size_t i = 0; i < R_QWORDS; i++) { ------------------ | | 82| 80.8k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 80.8k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (159:23): [True: 80.7k, False: 126] ------------------ 160| 80.7k| const uint64_t a = upc->slice[j].u.qw[i]; 161| 80.7k| const uint64_t b = lsb_mask; 162| 80.7k| const uint64_t tmp = ((~a) & b & (~br[i])) | ((((~a) | b) & br[i])); 163| 80.7k| upc->slice[j].u.qw[i] = a ^ b ^ br[i]; 164| 80.7k| br[i] = tmp; 165| 80.7k| } 166| 126| } 167| 14|} decode_avx2.c:OQS_KEM_bike_l5_rotate256_small: 56| 1.91k|{ 57| 1.91k| __m256i carry_in = SET_ZERO; ------------------ | | 72| 1.91k|# define SET_ZERO _mm256_setzero_si256() ------------------ 58| 1.91k| const int count64 = (int)count & 0x3f; 59| 1.91k| const uint64_t count_mask = (count >> 5) & 0xe; 60| | 61| 1.91k| __m256i idx = SET_I32(7, 6, 5, 4, 3, 2, 1, 0); ------------------ | | 66| 1.91k|# define SET_I32(...) _mm256_set_epi32(__VA_ARGS__) ------------------ 62| 1.91k| const __m256i zero_mask = SET_I64(-1, -1, -1, 0); ------------------ | | 67| 1.91k|# define SET_I64(...) _mm256_set_epi64x(__VA_ARGS__) ------------------ 63| 1.91k| const __m256i count_vet = SET1_I8(count_mask); ------------------ | | 68| 1.91k|# define SET1_I8(a) _mm256_set1_epi8(a) ------------------ 64| | 65| 1.91k| ALIGN(ALIGN_BYTES) ------------------ | | 18| 1.91k|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 66| 1.91k| const uint8_t zero_mask2_buf[] = { 67| 1.91k| 0x86, 0x86, 0x86, 0x86, 0x86, 0x86, 0x86, 0x86, 0x84, 0x84, 0x84, 68| 1.91k| 0x84, 0x84, 0x84, 0x84, 0x84, 0x82, 0x82, 0x82, 0x82, 0x82, 0x82, 69| 1.91k| 0x82, 0x82, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80, 0x80}; 70| 1.91k| __m256i zero_mask2 = LOAD(zero_mask2_buf); ------------------ | | 28| 1.91k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 71| | 72| 1.91k| zero_mask2 = SUB_I8(zero_mask2, count_vet); ------------------ | | 75| 1.91k|# define SUB_I8(a, b) _mm256_sub_epi8(a, b) ------------------ 73| 1.91k| idx = ADD_I8(idx, count_vet); ------------------ | | 74| 1.91k|# define ADD_I8(a, b) _mm256_add_epi8(a, b) ------------------ 74| | 75| 312k| for(int i = R_YMM; i >= 0; i--) { ------------------ | | 84| 1.91k|#define R_YMM DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_YMM) | | ------------------ | | | | 37| 1.91k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (75:22): [True: 310k, False: 1.91k] ------------------ 76| | // Load the next 256 bits 77| 310k| __m256i in256 = LOAD(&in->qw[4 * i]); ------------------ | | 28| 310k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 78| | 79| | // Rotate the current and previous 256 registers so that their quadwords 80| | // would be in the right positions. 81| 310k| __m256i carry_out = PERMVAR_I32(in256, idx); ------------------ | | 93| 310k|# define PERMVAR_I32(a, idx) _mm256_permutevar8x32_epi32(a, idx) ------------------ 82| 310k| in256 = BLENDV_I8(carry_in, carry_out, zero_mask2); ------------------ | | 92| 310k|# define BLENDV_I8(a, b, mask) _mm256_blendv_epi8(a, b, mask) ------------------ 83| | 84| | // Shift less than 64 (quadwords internal) 85| 310k| __m256i inner_carry = BLENDV_I8(carry_in, in256, zero_mask); ------------------ | | 92| 310k|# define BLENDV_I8(a, b, mask) _mm256_blendv_epi8(a, b, mask) ------------------ 86| 310k| inner_carry = PERM_I64(inner_carry, 0x39); ------------------ | | 94| 310k|# define PERM_I64(a, imm) _mm256_permute4x64_epi64(a, imm) ------------------ 87| 310k| const __m256i out256 = 88| 310k| SRLI_I64(in256, count64) | SLLI_I64(inner_carry, (int)64 - count64); ------------------ | | 32| 310k|# define SRLI_I64(a, imm) _mm256_srli_epi64(a, imm) ------------------ SRLI_I64(in256, count64) | SLLI_I64(inner_carry, (int)64 - count64); ------------------ | | 31| 310k|# define SLLI_I64(a, imm) _mm256_slli_epi64(a, imm) ------------------ 89| | 90| | // Store the rotated value 91| 310k| STORE(&out->qw[4 * i], out256); ------------------ | | 29| 310k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 92| 310k| carry_in = carry_out; 93| 310k| } 94| 1.91k|} decode.c:OQS_KEM_bike_l1_decode_ctx_init: 62| 5|{ 63| 5|#if defined(X86_64) 64| 5|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 65| 5| if(is_avx512_enabled()) { ------------------ | | 98| 5|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (65:6): [True: 0, False: 5] ------------------ 66| 0| ctx->rotate_right = rotate_right_avx512; ------------------ | | 77| 0|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->rotate_right = rotate_right_avx512; ------------------ | | 87| 0|#define rotate_right_avx512 RENAME_FUNC_NAME(rotate_right_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 67| 0| ctx->dup = dup_avx512; ------------------ | | 89| 0|#define dup_avx512 RENAME_FUNC_NAME(dup_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 68| 0| ctx->bit_sliced_adder = bit_sliced_adder_avx512; ------------------ | | 91| 0|#define bit_sliced_adder_avx512 RENAME_FUNC_NAME(bit_sliced_adder_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 69| 0| ctx->bit_slice_full_subtract = bit_slice_full_subtract_avx512; ------------------ | | 93| 0|#define bit_slice_full_subtract_avx512 RENAME_FUNC_NAME(bit_slice_full_subtract_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 70| 0| } else 71| 5|#endif 72| 5|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 73| 5| if(is_avx2_enabled()) { ------------------ | | 97| 5|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (73:6): [True: 5, False: 0] ------------------ 74| 5| ctx->rotate_right = rotate_right_avx2; ------------------ | | 77| 5|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->rotate_right = rotate_right_avx2; ------------------ | | 86| 5|#define rotate_right_avx2 RENAME_FUNC_NAME(rotate_right_avx2) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 75| 5| ctx->dup = dup_avx2; ------------------ | | 88| 5|#define dup_avx2 RENAME_FUNC_NAME(dup_avx2) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 76| 5| ctx->bit_sliced_adder = bit_sliced_adder_avx2; ------------------ | | 90| 5|#define bit_sliced_adder_avx2 RENAME_FUNC_NAME(bit_sliced_adder_avx2) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 77| 5| ctx->bit_slice_full_subtract = bit_slice_full_subtract_avx2; ------------------ | | 92| 5|#define bit_slice_full_subtract_avx2 RENAME_FUNC_NAME(bit_slice_full_subtract_avx2) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 78| 5| } else 79| 0|#endif 80| 0|#endif 81| 0| { 82| 0| ctx->rotate_right = rotate_right_port; ------------------ | | 77| 0|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->rotate_right = rotate_right_port; ------------------ | | 82| 0|#define rotate_right_port RENAME_FUNC_NAME(rotate_right_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 83| 0| ctx->dup = dup_port; ------------------ | | 83| 0|#define dup_port RENAME_FUNC_NAME(dup_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 84| 0| ctx->bit_sliced_adder = bit_sliced_adder_port; ------------------ | | 84| 0|#define bit_sliced_adder_port RENAME_FUNC_NAME(bit_sliced_adder_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 85| 0| ctx->bit_slice_full_subtract = bit_slice_full_subtract_port; ------------------ | | 85| 0|#define bit_slice_full_subtract_port RENAME_FUNC_NAME(bit_slice_full_subtract_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 86| 0| } 87| 5|} decode.c:OQS_KEM_bike_l3_decode_ctx_init: 62| 1|{ 63| 1|#if defined(X86_64) 64| 1|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 65| 1| if(is_avx512_enabled()) { ------------------ | | 98| 1|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (65:6): [True: 0, False: 1] ------------------ 66| 0| ctx->rotate_right = rotate_right_avx512; ------------------ | | 77| 0|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->rotate_right = rotate_right_avx512; ------------------ | | 87| 0|#define rotate_right_avx512 RENAME_FUNC_NAME(rotate_right_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 67| 0| ctx->dup = dup_avx512; ------------------ | | 89| 0|#define dup_avx512 RENAME_FUNC_NAME(dup_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 68| 0| ctx->bit_sliced_adder = bit_sliced_adder_avx512; ------------------ | | 91| 0|#define bit_sliced_adder_avx512 RENAME_FUNC_NAME(bit_sliced_adder_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 69| 0| ctx->bit_slice_full_subtract = bit_slice_full_subtract_avx512; ------------------ | | 93| 0|#define bit_slice_full_subtract_avx512 RENAME_FUNC_NAME(bit_slice_full_subtract_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 70| 0| } else 71| 1|#endif 72| 1|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 73| 1| if(is_avx2_enabled()) { ------------------ | | 97| 1|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (73:6): [True: 1, False: 0] ------------------ 74| 1| ctx->rotate_right = rotate_right_avx2; ------------------ | | 77| 1|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->rotate_right = rotate_right_avx2; ------------------ | | 86| 1|#define rotate_right_avx2 RENAME_FUNC_NAME(rotate_right_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 75| 1| ctx->dup = dup_avx2; ------------------ | | 88| 1|#define dup_avx2 RENAME_FUNC_NAME(dup_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 76| 1| ctx->bit_sliced_adder = bit_sliced_adder_avx2; ------------------ | | 90| 1|#define bit_sliced_adder_avx2 RENAME_FUNC_NAME(bit_sliced_adder_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 77| 1| ctx->bit_slice_full_subtract = bit_slice_full_subtract_avx2; ------------------ | | 92| 1|#define bit_slice_full_subtract_avx2 RENAME_FUNC_NAME(bit_slice_full_subtract_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 78| 1| } else 79| 0|#endif 80| 0|#endif 81| 0| { 82| 0| ctx->rotate_right = rotate_right_port; ------------------ | | 77| 0|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->rotate_right = rotate_right_port; ------------------ | | 82| 0|#define rotate_right_port RENAME_FUNC_NAME(rotate_right_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 83| 0| ctx->dup = dup_port; ------------------ | | 83| 0|#define dup_port RENAME_FUNC_NAME(dup_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 84| 0| ctx->bit_sliced_adder = bit_sliced_adder_port; ------------------ | | 84| 0|#define bit_sliced_adder_port RENAME_FUNC_NAME(bit_sliced_adder_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 85| 0| ctx->bit_slice_full_subtract = bit_slice_full_subtract_port; ------------------ | | 85| 0|#define bit_slice_full_subtract_port RENAME_FUNC_NAME(bit_slice_full_subtract_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 86| 0| } 87| 1|} decode.c:OQS_KEM_bike_l5_decode_ctx_init: 62| 1|{ 63| 1|#if defined(X86_64) 64| 1|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 65| 1| if(is_avx512_enabled()) { ------------------ | | 98| 1|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (65:6): [True: 0, False: 1] ------------------ 66| 0| ctx->rotate_right = rotate_right_avx512; ------------------ | | 77| 0|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->rotate_right = rotate_right_avx512; ------------------ | | 87| 0|#define rotate_right_avx512 RENAME_FUNC_NAME(rotate_right_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 67| 0| ctx->dup = dup_avx512; ------------------ | | 89| 0|#define dup_avx512 RENAME_FUNC_NAME(dup_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 68| 0| ctx->bit_sliced_adder = bit_sliced_adder_avx512; ------------------ | | 91| 0|#define bit_sliced_adder_avx512 RENAME_FUNC_NAME(bit_sliced_adder_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 69| 0| ctx->bit_slice_full_subtract = bit_slice_full_subtract_avx512; ------------------ | | 93| 0|#define bit_slice_full_subtract_avx512 RENAME_FUNC_NAME(bit_slice_full_subtract_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 70| 0| } else 71| 1|#endif 72| 1|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 73| 1| if(is_avx2_enabled()) { ------------------ | | 97| 1|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (73:6): [True: 1, False: 0] ------------------ 74| 1| ctx->rotate_right = rotate_right_avx2; ------------------ | | 77| 1|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->rotate_right = rotate_right_avx2; ------------------ | | 86| 1|#define rotate_right_avx2 RENAME_FUNC_NAME(rotate_right_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 75| 1| ctx->dup = dup_avx2; ------------------ | | 88| 1|#define dup_avx2 RENAME_FUNC_NAME(dup_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 76| 1| ctx->bit_sliced_adder = bit_sliced_adder_avx2; ------------------ | | 90| 1|#define bit_sliced_adder_avx2 RENAME_FUNC_NAME(bit_sliced_adder_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 77| 1| ctx->bit_slice_full_subtract = bit_slice_full_subtract_avx2; ------------------ | | 92| 1|#define bit_slice_full_subtract_avx2 RENAME_FUNC_NAME(bit_slice_full_subtract_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 78| 1| } else 79| 0|#endif 80| 0|#endif 81| 0| { 82| 0| ctx->rotate_right = rotate_right_port; ------------------ | | 77| 0|#define rotate_right RENAME_FUNC_NAME(rotate_right) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->rotate_right = rotate_right_port; ------------------ | | 82| 0|#define rotate_right_port RENAME_FUNC_NAME(rotate_right_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 83| 0| ctx->dup = dup_port; ------------------ | | 83| 0|#define dup_port RENAME_FUNC_NAME(dup_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 84| 0| ctx->bit_sliced_adder = bit_sliced_adder_port; ------------------ | | 84| 0|#define bit_sliced_adder_port RENAME_FUNC_NAME(bit_sliced_adder_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 85| 0| ctx->bit_slice_full_subtract = bit_slice_full_subtract_port; ------------------ | | 85| 0|#define bit_slice_full_subtract_port RENAME_FUNC_NAME(bit_slice_full_subtract_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 86| 0| } 87| 1|} kem.c:OQS_KEM_bike_l1_gf2x_mod_add: 15| 5|{ 16| 5| const uint64_t *a_qwords = (const uint64_t *)a; 17| 5| const uint64_t *b_qwords = (const uint64_t *)b; 18| 5| uint64_t * c_qwords = (uint64_t *)c; 19| | 20| 1.28k| for(size_t i = 0; i < R_PADDED_QWORDS; i++) { ------------------ | | 90| 1.28k|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 1.28k|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 1.28k|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 1.28k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 40| 1.28k|# define BLOCK_BITS 16384 | | | | ------------------ | | ------------------ ------------------ | Branch (20:21): [True: 1.28k, False: 5] ------------------ 21| 1.28k| c_qwords[i] = a_qwords[i] ^ b_qwords[i]; 22| 1.28k| } 23| 5|} kem.c:OQS_KEM_bike_l3_gf2x_mod_add: 15| 1|{ 16| 1| const uint64_t *a_qwords = (const uint64_t *)a; 17| 1| const uint64_t *b_qwords = (const uint64_t *)b; 18| 1| uint64_t * c_qwords = (uint64_t *)c; 19| | 20| 513| for(size_t i = 0; i < R_PADDED_QWORDS; i++) { ------------------ | | 90| 513|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 513|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 513|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 513|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 56| 513|# define BLOCK_BITS 32768 | | | | ------------------ | | ------------------ ------------------ | Branch (20:21): [True: 512, False: 1] ------------------ 21| 512| c_qwords[i] = a_qwords[i] ^ b_qwords[i]; 22| 512| } 23| 1|} kem.c:OQS_KEM_bike_l5_gf2x_mod_add: 15| 1|{ 16| 1| const uint64_t *a_qwords = (const uint64_t *)a; 17| 1| const uint64_t *b_qwords = (const uint64_t *)b; 18| 1| uint64_t * c_qwords = (uint64_t *)c; 19| | 20| 1.02k| for(size_t i = 0; i < R_PADDED_QWORDS; i++) { ------------------ | | 90| 1.02k|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 1.02k|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 1.02k|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 1.02k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 71| 1.02k|# define BLOCK_BITS 65536 | | | | ------------------ | | ------------------ ------------------ | Branch (20:21): [True: 1.02k, False: 1] ------------------ 21| 1.02k| c_qwords[i] = a_qwords[i] ^ b_qwords[i]; 22| 1.02k| } 23| 1|} decode.c:OQS_KEM_bike_l1_gf2x_mod_add: 15| 70|{ 16| 70| const uint64_t *a_qwords = (const uint64_t *)a; 17| 70| const uint64_t *b_qwords = (const uint64_t *)b; 18| 70| uint64_t * c_qwords = (uint64_t *)c; 19| | 20| 17.9k| for(size_t i = 0; i < R_PADDED_QWORDS; i++) { ------------------ | | 90| 17.9k|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 17.9k|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 17.9k|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 17.9k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 40| 17.9k|# define BLOCK_BITS 16384 | | | | ------------------ | | ------------------ ------------------ | Branch (20:21): [True: 17.9k, False: 70] ------------------ 21| 17.9k| c_qwords[i] = a_qwords[i] ^ b_qwords[i]; 22| 17.9k| } 23| 70|} decode.c:OQS_KEM_bike_l3_gf2x_mod_add: 15| 14|{ 16| 14| const uint64_t *a_qwords = (const uint64_t *)a; 17| 14| const uint64_t *b_qwords = (const uint64_t *)b; 18| 14| uint64_t * c_qwords = (uint64_t *)c; 19| | 20| 7.18k| for(size_t i = 0; i < R_PADDED_QWORDS; i++) { ------------------ | | 90| 7.18k|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 7.18k|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 7.18k|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 7.18k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 56| 7.18k|# define BLOCK_BITS 32768 | | | | ------------------ | | ------------------ ------------------ | Branch (20:21): [True: 7.16k, False: 14] ------------------ 21| 7.16k| c_qwords[i] = a_qwords[i] ^ b_qwords[i]; 22| 7.16k| } 23| 14|} decode.c:OQS_KEM_bike_l5_gf2x_mod_add: 15| 14|{ 16| 14| const uint64_t *a_qwords = (const uint64_t *)a; 17| 14| const uint64_t *b_qwords = (const uint64_t *)b; 18| 14| uint64_t * c_qwords = (uint64_t *)c; 19| | 20| 14.3k| for(size_t i = 0; i < R_PADDED_QWORDS; i++) { ------------------ | | 90| 14.3k|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 14.3k|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 14.3k|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 14.3k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 71| 14.3k|# define BLOCK_BITS 65536 | | | | ------------------ | | ------------------ ------------------ | Branch (20:21): [True: 14.3k, False: 14] ------------------ 21| 14.3k| c_qwords[i] = a_qwords[i] ^ b_qwords[i]; 22| 14.3k| } 23| 14|} gf2x_inv.c:OQS_KEM_bike_l1_gf2x_ctx_init: 132| 5|{ 133| 5|#if defined(X86_64) 134| 5|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 135| 5| if(is_avx512_enabled()) { ------------------ | | 98| 5|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (135:6): [True: 0, False: 5] ------------------ 136| 0| ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 112| 0|#define karatzuba_add1_avx512 RENAME_FUNC_NAME(karatzuba_add1_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 137| 0| ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 114| 0|#define karatzuba_add2_avx512 RENAME_FUNC_NAME(karatzuba_add2_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 138| 0| ctx->karatzuba_add3 = karatzuba_add3_avx512; ------------------ | | 116| 0|#define karatzuba_add3_avx512 RENAME_FUNC_NAME(karatzuba_add3_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 139| 0| ctx->k_sqr = k_sqr_avx512; ------------------ | | 120| 0|#define k_sqr_avx512 RENAME_FUNC_NAME(k_sqr_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 140| 0| ctx->red = gf2x_red_avx512; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx512; ------------------ | | 122| 0|#define gf2x_red_avx512 RENAME_FUNC_NAME(gf2x_red_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 141| 0| } else 142| 5|#endif 143| 5|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 144| 5| if(is_avx2_enabled()) { ------------------ | | 97| 5|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (144:6): [True: 5, False: 0] ------------------ 145| 5| ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 71| 5|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 111| 5|#define karatzuba_add1_avx2 RENAME_FUNC_NAME(karatzuba_add1_avx2) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 146| 5| ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 72| 5|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 113| 5|#define karatzuba_add2_avx2 RENAME_FUNC_NAME(karatzuba_add2_avx2) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 147| 5| ctx->karatzuba_add3 = karatzuba_add3_avx2; ------------------ | | 115| 5|#define karatzuba_add3_avx2 RENAME_FUNC_NAME(karatzuba_add3_avx2) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 148| 5| ctx->k_sqr = k_sqr_avx2; ------------------ | | 119| 5|#define k_sqr_avx2 RENAME_FUNC_NAME(k_sqr_avx2) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 5| ctx->red = gf2x_red_avx2; ------------------ | | 75| 5|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx2; ------------------ | | 121| 5|#define gf2x_red_avx2 RENAME_FUNC_NAME(gf2x_red_avx2) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 150| 5| } else 151| 0|#endif 152| 0|#endif 153| 0| { 154| 0| ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 103| 0|#define karatzuba_add1_port RENAME_FUNC_NAME(karatzuba_add1_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 155| 0| ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 104| 0|#define karatzuba_add2_port RENAME_FUNC_NAME(karatzuba_add2_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 156| 0| ctx->karatzuba_add3 = karatzuba_add3_port; ------------------ | | 105| 0|#define karatzuba_add3_port RENAME_FUNC_NAME(karatzuba_add3_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 157| 0| ctx->k_sqr = k_sqr_port; ------------------ | | 107| 0|#define k_sqr_port RENAME_FUNC_NAME(k_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 0| ctx->red = gf2x_red_port; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_port; ------------------ | | 108| 0|#define gf2x_red_port RENAME_FUNC_NAME(gf2x_red_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 159| 0| } 160| | 161| 5|#if defined(X86_64) 162| |# if !defined(DISABLE_VPCLMUL) 163| | if(is_vpclmul_enabled()) { 164| | ctx->mul_base_qwords = GF2X_VPCLMUL_BASE_QWORDS; 165| | ctx->mul_base = gf2x_mul_base_vpclmul; 166| | ctx->sqr = gf2x_sqr_vpclmul; 167| | } else 168| |# endif // DISABLE_VPCLMUL 169| 5|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 170| 5| if(is_pclmul_enabled()) { ------------------ | | 99| 5|#define is_pclmul_enabled RENAME_FUNC_NAME(is_pclmul_enabled) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (170:6): [True: 5, False: 0] ------------------ 171| 5| ctx->mul_base_qwords = GF2X_PCLMUL_BASE_QWORDS; ------------------ | | 19| 5|#define GF2X_PCLMUL_BASE_QWORDS (8) ------------------ 172| 5| ctx->mul_base = gf2x_mul_base_pclmul; ------------------ | | 109| 5|#define gf2x_mul_base_pclmul RENAME_FUNC_NAME(gf2x_mul_base_pclmul) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 173| 5| ctx->sqr = gf2x_sqr_pclmul; ------------------ | | 117| 5|#define gf2x_sqr_pclmul RENAME_FUNC_NAME(gf2x_sqr_pclmul) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 174| 5| } else 175| 0|#endif 176| 0|#endif 177| 0| { 178| 0| ctx->mul_base_qwords = GF2X_PORT_BASE_QWORDS; ------------------ | | 18| 0|#define GF2X_PORT_BASE_QWORDS (1) ------------------ 179| 0| ctx->mul_base = gf2x_mul_base_port; ------------------ | | 102| 0|#define gf2x_mul_base_port RENAME_FUNC_NAME(gf2x_mul_base_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 180| 0| ctx->sqr = gf2x_sqr_port; ------------------ | | 106| 0|#define gf2x_sqr_port RENAME_FUNC_NAME(gf2x_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 181| 0| } 182| 5|} gf2x_mul.c:OQS_KEM_bike_l1_gf2x_ctx_init: 132| 85|{ 133| 85|#if defined(X86_64) 134| 85|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 135| 85| if(is_avx512_enabled()) { ------------------ | | 98| 85|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (135:6): [True: 0, False: 85] ------------------ 136| 0| ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 112| 0|#define karatzuba_add1_avx512 RENAME_FUNC_NAME(karatzuba_add1_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 137| 0| ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 114| 0|#define karatzuba_add2_avx512 RENAME_FUNC_NAME(karatzuba_add2_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 138| 0| ctx->karatzuba_add3 = karatzuba_add3_avx512; ------------------ | | 116| 0|#define karatzuba_add3_avx512 RENAME_FUNC_NAME(karatzuba_add3_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 139| 0| ctx->k_sqr = k_sqr_avx512; ------------------ | | 120| 0|#define k_sqr_avx512 RENAME_FUNC_NAME(k_sqr_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 140| 0| ctx->red = gf2x_red_avx512; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx512; ------------------ | | 122| 0|#define gf2x_red_avx512 RENAME_FUNC_NAME(gf2x_red_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 141| 0| } else 142| 85|#endif 143| 85|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 144| 85| if(is_avx2_enabled()) { ------------------ | | 97| 85|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (144:6): [True: 85, False: 0] ------------------ 145| 85| ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 71| 85|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 111| 85|#define karatzuba_add1_avx2 RENAME_FUNC_NAME(karatzuba_add1_avx2) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 146| 85| ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 72| 85|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 113| 85|#define karatzuba_add2_avx2 RENAME_FUNC_NAME(karatzuba_add2_avx2) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 147| 85| ctx->karatzuba_add3 = karatzuba_add3_avx2; ------------------ | | 115| 85|#define karatzuba_add3_avx2 RENAME_FUNC_NAME(karatzuba_add3_avx2) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 148| 85| ctx->k_sqr = k_sqr_avx2; ------------------ | | 119| 85|#define k_sqr_avx2 RENAME_FUNC_NAME(k_sqr_avx2) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 85| ctx->red = gf2x_red_avx2; ------------------ | | 75| 85|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx2; ------------------ | | 121| 85|#define gf2x_red_avx2 RENAME_FUNC_NAME(gf2x_red_avx2) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 150| 85| } else 151| 0|#endif 152| 0|#endif 153| 0| { 154| 0| ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 103| 0|#define karatzuba_add1_port RENAME_FUNC_NAME(karatzuba_add1_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 155| 0| ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 104| 0|#define karatzuba_add2_port RENAME_FUNC_NAME(karatzuba_add2_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 156| 0| ctx->karatzuba_add3 = karatzuba_add3_port; ------------------ | | 105| 0|#define karatzuba_add3_port RENAME_FUNC_NAME(karatzuba_add3_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 157| 0| ctx->k_sqr = k_sqr_port; ------------------ | | 107| 0|#define k_sqr_port RENAME_FUNC_NAME(k_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 0| ctx->red = gf2x_red_port; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_port; ------------------ | | 108| 0|#define gf2x_red_port RENAME_FUNC_NAME(gf2x_red_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 159| 0| } 160| | 161| 85|#if defined(X86_64) 162| |# if !defined(DISABLE_VPCLMUL) 163| | if(is_vpclmul_enabled()) { 164| | ctx->mul_base_qwords = GF2X_VPCLMUL_BASE_QWORDS; 165| | ctx->mul_base = gf2x_mul_base_vpclmul; 166| | ctx->sqr = gf2x_sqr_vpclmul; 167| | } else 168| |# endif // DISABLE_VPCLMUL 169| 85|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 170| 85| if(is_pclmul_enabled()) { ------------------ | | 99| 85|#define is_pclmul_enabled RENAME_FUNC_NAME(is_pclmul_enabled) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (170:6): [True: 85, False: 0] ------------------ 171| 85| ctx->mul_base_qwords = GF2X_PCLMUL_BASE_QWORDS; ------------------ | | 19| 85|#define GF2X_PCLMUL_BASE_QWORDS (8) ------------------ 172| 85| ctx->mul_base = gf2x_mul_base_pclmul; ------------------ | | 109| 85|#define gf2x_mul_base_pclmul RENAME_FUNC_NAME(gf2x_mul_base_pclmul) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 173| 85| ctx->sqr = gf2x_sqr_pclmul; ------------------ | | 117| 85|#define gf2x_sqr_pclmul RENAME_FUNC_NAME(gf2x_sqr_pclmul) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 174| 85| } else 175| 0|#endif 176| 0|#endif 177| 0| { 178| 0| ctx->mul_base_qwords = GF2X_PORT_BASE_QWORDS; ------------------ | | 18| 0|#define GF2X_PORT_BASE_QWORDS (1) ------------------ 179| 0| ctx->mul_base = gf2x_mul_base_port; ------------------ | | 102| 0|#define gf2x_mul_base_port RENAME_FUNC_NAME(gf2x_mul_base_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 180| 0| ctx->sqr = gf2x_sqr_port; ------------------ | | 106| 0|#define gf2x_sqr_port RENAME_FUNC_NAME(gf2x_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 181| 0| } 182| 85|} gf2x_inv.c:OQS_KEM_bike_l3_gf2x_ctx_init: 132| 1|{ 133| 1|#if defined(X86_64) 134| 1|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 135| 1| if(is_avx512_enabled()) { ------------------ | | 98| 1|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (135:6): [True: 0, False: 1] ------------------ 136| 0| ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 112| 0|#define karatzuba_add1_avx512 RENAME_FUNC_NAME(karatzuba_add1_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 137| 0| ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 114| 0|#define karatzuba_add2_avx512 RENAME_FUNC_NAME(karatzuba_add2_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 138| 0| ctx->karatzuba_add3 = karatzuba_add3_avx512; ------------------ | | 116| 0|#define karatzuba_add3_avx512 RENAME_FUNC_NAME(karatzuba_add3_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 139| 0| ctx->k_sqr = k_sqr_avx512; ------------------ | | 120| 0|#define k_sqr_avx512 RENAME_FUNC_NAME(k_sqr_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 140| 0| ctx->red = gf2x_red_avx512; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx512; ------------------ | | 122| 0|#define gf2x_red_avx512 RENAME_FUNC_NAME(gf2x_red_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 141| 0| } else 142| 1|#endif 143| 1|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 144| 1| if(is_avx2_enabled()) { ------------------ | | 97| 1|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (144:6): [True: 1, False: 0] ------------------ 145| 1| ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 71| 1|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 111| 1|#define karatzuba_add1_avx2 RENAME_FUNC_NAME(karatzuba_add1_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 146| 1| ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 72| 1|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 113| 1|#define karatzuba_add2_avx2 RENAME_FUNC_NAME(karatzuba_add2_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 147| 1| ctx->karatzuba_add3 = karatzuba_add3_avx2; ------------------ | | 115| 1|#define karatzuba_add3_avx2 RENAME_FUNC_NAME(karatzuba_add3_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 148| 1| ctx->k_sqr = k_sqr_avx2; ------------------ | | 119| 1|#define k_sqr_avx2 RENAME_FUNC_NAME(k_sqr_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 1| ctx->red = gf2x_red_avx2; ------------------ | | 75| 1|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx2; ------------------ | | 121| 1|#define gf2x_red_avx2 RENAME_FUNC_NAME(gf2x_red_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 150| 1| } else 151| 0|#endif 152| 0|#endif 153| 0| { 154| 0| ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 103| 0|#define karatzuba_add1_port RENAME_FUNC_NAME(karatzuba_add1_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 155| 0| ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 104| 0|#define karatzuba_add2_port RENAME_FUNC_NAME(karatzuba_add2_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 156| 0| ctx->karatzuba_add3 = karatzuba_add3_port; ------------------ | | 105| 0|#define karatzuba_add3_port RENAME_FUNC_NAME(karatzuba_add3_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 157| 0| ctx->k_sqr = k_sqr_port; ------------------ | | 107| 0|#define k_sqr_port RENAME_FUNC_NAME(k_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 0| ctx->red = gf2x_red_port; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_port; ------------------ | | 108| 0|#define gf2x_red_port RENAME_FUNC_NAME(gf2x_red_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 159| 0| } 160| | 161| 1|#if defined(X86_64) 162| |# if !defined(DISABLE_VPCLMUL) 163| | if(is_vpclmul_enabled()) { 164| | ctx->mul_base_qwords = GF2X_VPCLMUL_BASE_QWORDS; 165| | ctx->mul_base = gf2x_mul_base_vpclmul; 166| | ctx->sqr = gf2x_sqr_vpclmul; 167| | } else 168| |# endif // DISABLE_VPCLMUL 169| 1|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 170| 1| if(is_pclmul_enabled()) { ------------------ | | 99| 1|#define is_pclmul_enabled RENAME_FUNC_NAME(is_pclmul_enabled) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (170:6): [True: 1, False: 0] ------------------ 171| 1| ctx->mul_base_qwords = GF2X_PCLMUL_BASE_QWORDS; ------------------ | | 19| 1|#define GF2X_PCLMUL_BASE_QWORDS (8) ------------------ 172| 1| ctx->mul_base = gf2x_mul_base_pclmul; ------------------ | | 109| 1|#define gf2x_mul_base_pclmul RENAME_FUNC_NAME(gf2x_mul_base_pclmul) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 173| 1| ctx->sqr = gf2x_sqr_pclmul; ------------------ | | 117| 1|#define gf2x_sqr_pclmul RENAME_FUNC_NAME(gf2x_sqr_pclmul) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 174| 1| } else 175| 0|#endif 176| 0|#endif 177| 0| { 178| 0| ctx->mul_base_qwords = GF2X_PORT_BASE_QWORDS; ------------------ | | 18| 0|#define GF2X_PORT_BASE_QWORDS (1) ------------------ 179| 0| ctx->mul_base = gf2x_mul_base_port; ------------------ | | 102| 0|#define gf2x_mul_base_port RENAME_FUNC_NAME(gf2x_mul_base_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 180| 0| ctx->sqr = gf2x_sqr_port; ------------------ | | 106| 0|#define gf2x_sqr_port RENAME_FUNC_NAME(gf2x_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 181| 0| } 182| 1|} gf2x_mul.c:OQS_KEM_bike_l3_gf2x_ctx_init: 132| 17|{ 133| 17|#if defined(X86_64) 134| 17|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 135| 17| if(is_avx512_enabled()) { ------------------ | | 98| 17|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (135:6): [True: 0, False: 17] ------------------ 136| 0| ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 112| 0|#define karatzuba_add1_avx512 RENAME_FUNC_NAME(karatzuba_add1_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 137| 0| ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 114| 0|#define karatzuba_add2_avx512 RENAME_FUNC_NAME(karatzuba_add2_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 138| 0| ctx->karatzuba_add3 = karatzuba_add3_avx512; ------------------ | | 116| 0|#define karatzuba_add3_avx512 RENAME_FUNC_NAME(karatzuba_add3_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 139| 0| ctx->k_sqr = k_sqr_avx512; ------------------ | | 120| 0|#define k_sqr_avx512 RENAME_FUNC_NAME(k_sqr_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 140| 0| ctx->red = gf2x_red_avx512; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx512; ------------------ | | 122| 0|#define gf2x_red_avx512 RENAME_FUNC_NAME(gf2x_red_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 141| 0| } else 142| 17|#endif 143| 17|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 144| 17| if(is_avx2_enabled()) { ------------------ | | 97| 17|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (144:6): [True: 17, False: 0] ------------------ 145| 17| ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 71| 17|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 111| 17|#define karatzuba_add1_avx2 RENAME_FUNC_NAME(karatzuba_add1_avx2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 146| 17| ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 72| 17|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 113| 17|#define karatzuba_add2_avx2 RENAME_FUNC_NAME(karatzuba_add2_avx2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 147| 17| ctx->karatzuba_add3 = karatzuba_add3_avx2; ------------------ | | 115| 17|#define karatzuba_add3_avx2 RENAME_FUNC_NAME(karatzuba_add3_avx2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 148| 17| ctx->k_sqr = k_sqr_avx2; ------------------ | | 119| 17|#define k_sqr_avx2 RENAME_FUNC_NAME(k_sqr_avx2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 17| ctx->red = gf2x_red_avx2; ------------------ | | 75| 17|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx2; ------------------ | | 121| 17|#define gf2x_red_avx2 RENAME_FUNC_NAME(gf2x_red_avx2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 150| 17| } else 151| 0|#endif 152| 0|#endif 153| 0| { 154| 0| ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 103| 0|#define karatzuba_add1_port RENAME_FUNC_NAME(karatzuba_add1_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 155| 0| ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 104| 0|#define karatzuba_add2_port RENAME_FUNC_NAME(karatzuba_add2_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 156| 0| ctx->karatzuba_add3 = karatzuba_add3_port; ------------------ | | 105| 0|#define karatzuba_add3_port RENAME_FUNC_NAME(karatzuba_add3_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 157| 0| ctx->k_sqr = k_sqr_port; ------------------ | | 107| 0|#define k_sqr_port RENAME_FUNC_NAME(k_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 0| ctx->red = gf2x_red_port; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_port; ------------------ | | 108| 0|#define gf2x_red_port RENAME_FUNC_NAME(gf2x_red_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 159| 0| } 160| | 161| 17|#if defined(X86_64) 162| |# if !defined(DISABLE_VPCLMUL) 163| | if(is_vpclmul_enabled()) { 164| | ctx->mul_base_qwords = GF2X_VPCLMUL_BASE_QWORDS; 165| | ctx->mul_base = gf2x_mul_base_vpclmul; 166| | ctx->sqr = gf2x_sqr_vpclmul; 167| | } else 168| |# endif // DISABLE_VPCLMUL 169| 17|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 170| 17| if(is_pclmul_enabled()) { ------------------ | | 99| 17|#define is_pclmul_enabled RENAME_FUNC_NAME(is_pclmul_enabled) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (170:6): [True: 17, False: 0] ------------------ 171| 17| ctx->mul_base_qwords = GF2X_PCLMUL_BASE_QWORDS; ------------------ | | 19| 17|#define GF2X_PCLMUL_BASE_QWORDS (8) ------------------ 172| 17| ctx->mul_base = gf2x_mul_base_pclmul; ------------------ | | 109| 17|#define gf2x_mul_base_pclmul RENAME_FUNC_NAME(gf2x_mul_base_pclmul) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 173| 17| ctx->sqr = gf2x_sqr_pclmul; ------------------ | | 117| 17|#define gf2x_sqr_pclmul RENAME_FUNC_NAME(gf2x_sqr_pclmul) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 174| 17| } else 175| 0|#endif 176| 0|#endif 177| 0| { 178| 0| ctx->mul_base_qwords = GF2X_PORT_BASE_QWORDS; ------------------ | | 18| 0|#define GF2X_PORT_BASE_QWORDS (1) ------------------ 179| 0| ctx->mul_base = gf2x_mul_base_port; ------------------ | | 102| 0|#define gf2x_mul_base_port RENAME_FUNC_NAME(gf2x_mul_base_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 180| 0| ctx->sqr = gf2x_sqr_port; ------------------ | | 106| 0|#define gf2x_sqr_port RENAME_FUNC_NAME(gf2x_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 181| 0| } 182| 17|} gf2x_inv.c:OQS_KEM_bike_l5_gf2x_ctx_init: 132| 1|{ 133| 1|#if defined(X86_64) 134| 1|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 135| 1| if(is_avx512_enabled()) { ------------------ | | 98| 1|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (135:6): [True: 0, False: 1] ------------------ 136| 0| ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 112| 0|#define karatzuba_add1_avx512 RENAME_FUNC_NAME(karatzuba_add1_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 137| 0| ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 114| 0|#define karatzuba_add2_avx512 RENAME_FUNC_NAME(karatzuba_add2_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 138| 0| ctx->karatzuba_add3 = karatzuba_add3_avx512; ------------------ | | 116| 0|#define karatzuba_add3_avx512 RENAME_FUNC_NAME(karatzuba_add3_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 139| 0| ctx->k_sqr = k_sqr_avx512; ------------------ | | 120| 0|#define k_sqr_avx512 RENAME_FUNC_NAME(k_sqr_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 140| 0| ctx->red = gf2x_red_avx512; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx512; ------------------ | | 122| 0|#define gf2x_red_avx512 RENAME_FUNC_NAME(gf2x_red_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 141| 0| } else 142| 1|#endif 143| 1|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 144| 1| if(is_avx2_enabled()) { ------------------ | | 97| 1|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (144:6): [True: 1, False: 0] ------------------ 145| 1| ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 71| 1|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 111| 1|#define karatzuba_add1_avx2 RENAME_FUNC_NAME(karatzuba_add1_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 146| 1| ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 72| 1|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 113| 1|#define karatzuba_add2_avx2 RENAME_FUNC_NAME(karatzuba_add2_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 147| 1| ctx->karatzuba_add3 = karatzuba_add3_avx2; ------------------ | | 115| 1|#define karatzuba_add3_avx2 RENAME_FUNC_NAME(karatzuba_add3_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 148| 1| ctx->k_sqr = k_sqr_avx2; ------------------ | | 119| 1|#define k_sqr_avx2 RENAME_FUNC_NAME(k_sqr_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 1| ctx->red = gf2x_red_avx2; ------------------ | | 75| 1|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx2; ------------------ | | 121| 1|#define gf2x_red_avx2 RENAME_FUNC_NAME(gf2x_red_avx2) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 150| 1| } else 151| 0|#endif 152| 0|#endif 153| 0| { 154| 0| ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 103| 0|#define karatzuba_add1_port RENAME_FUNC_NAME(karatzuba_add1_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 155| 0| ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 104| 0|#define karatzuba_add2_port RENAME_FUNC_NAME(karatzuba_add2_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 156| 0| ctx->karatzuba_add3 = karatzuba_add3_port; ------------------ | | 105| 0|#define karatzuba_add3_port RENAME_FUNC_NAME(karatzuba_add3_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 157| 0| ctx->k_sqr = k_sqr_port; ------------------ | | 107| 0|#define k_sqr_port RENAME_FUNC_NAME(k_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 0| ctx->red = gf2x_red_port; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_port; ------------------ | | 108| 0|#define gf2x_red_port RENAME_FUNC_NAME(gf2x_red_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 159| 0| } 160| | 161| 1|#if defined(X86_64) 162| |# if !defined(DISABLE_VPCLMUL) 163| | if(is_vpclmul_enabled()) { 164| | ctx->mul_base_qwords = GF2X_VPCLMUL_BASE_QWORDS; 165| | ctx->mul_base = gf2x_mul_base_vpclmul; 166| | ctx->sqr = gf2x_sqr_vpclmul; 167| | } else 168| |# endif // DISABLE_VPCLMUL 169| 1|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 170| 1| if(is_pclmul_enabled()) { ------------------ | | 99| 1|#define is_pclmul_enabled RENAME_FUNC_NAME(is_pclmul_enabled) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (170:6): [True: 1, False: 0] ------------------ 171| 1| ctx->mul_base_qwords = GF2X_PCLMUL_BASE_QWORDS; ------------------ | | 19| 1|#define GF2X_PCLMUL_BASE_QWORDS (8) ------------------ 172| 1| ctx->mul_base = gf2x_mul_base_pclmul; ------------------ | | 109| 1|#define gf2x_mul_base_pclmul RENAME_FUNC_NAME(gf2x_mul_base_pclmul) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 173| 1| ctx->sqr = gf2x_sqr_pclmul; ------------------ | | 117| 1|#define gf2x_sqr_pclmul RENAME_FUNC_NAME(gf2x_sqr_pclmul) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 174| 1| } else 175| 0|#endif 176| 0|#endif 177| 0| { 178| 0| ctx->mul_base_qwords = GF2X_PORT_BASE_QWORDS; ------------------ | | 18| 0|#define GF2X_PORT_BASE_QWORDS (1) ------------------ 179| 0| ctx->mul_base = gf2x_mul_base_port; ------------------ | | 102| 0|#define gf2x_mul_base_port RENAME_FUNC_NAME(gf2x_mul_base_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 180| 0| ctx->sqr = gf2x_sqr_port; ------------------ | | 106| 0|#define gf2x_sqr_port RENAME_FUNC_NAME(gf2x_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 181| 0| } 182| 1|} gf2x_mul.c:OQS_KEM_bike_l5_gf2x_ctx_init: 132| 17|{ 133| 17|#if defined(X86_64) 134| 17|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 135| 17| if(is_avx512_enabled()) { ------------------ | | 98| 17|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (135:6): [True: 0, False: 17] ------------------ 136| 0| ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx512; ------------------ | | 112| 0|#define karatzuba_add1_avx512 RENAME_FUNC_NAME(karatzuba_add1_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 137| 0| ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx512; ------------------ | | 114| 0|#define karatzuba_add2_avx512 RENAME_FUNC_NAME(karatzuba_add2_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 138| 0| ctx->karatzuba_add3 = karatzuba_add3_avx512; ------------------ | | 116| 0|#define karatzuba_add3_avx512 RENAME_FUNC_NAME(karatzuba_add3_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 139| 0| ctx->k_sqr = k_sqr_avx512; ------------------ | | 120| 0|#define k_sqr_avx512 RENAME_FUNC_NAME(k_sqr_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 140| 0| ctx->red = gf2x_red_avx512; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx512; ------------------ | | 122| 0|#define gf2x_red_avx512 RENAME_FUNC_NAME(gf2x_red_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 141| 0| } else 142| 17|#endif 143| 17|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 144| 17| if(is_avx2_enabled()) { ------------------ | | 97| 17|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (144:6): [True: 17, False: 0] ------------------ 145| 17| ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 71| 17|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_avx2; ------------------ | | 111| 17|#define karatzuba_add1_avx2 RENAME_FUNC_NAME(karatzuba_add1_avx2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 146| 17| ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 72| 17|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_avx2; ------------------ | | 113| 17|#define karatzuba_add2_avx2 RENAME_FUNC_NAME(karatzuba_add2_avx2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 147| 17| ctx->karatzuba_add3 = karatzuba_add3_avx2; ------------------ | | 115| 17|#define karatzuba_add3_avx2 RENAME_FUNC_NAME(karatzuba_add3_avx2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 148| 17| ctx->k_sqr = k_sqr_avx2; ------------------ | | 119| 17|#define k_sqr_avx2 RENAME_FUNC_NAME(k_sqr_avx2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 17| ctx->red = gf2x_red_avx2; ------------------ | | 75| 17|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_avx2; ------------------ | | 121| 17|#define gf2x_red_avx2 RENAME_FUNC_NAME(gf2x_red_avx2) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 150| 17| } else 151| 0|#endif 152| 0|#endif 153| 0| { 154| 0| ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 71| 0|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add1 = karatzuba_add1_port; ------------------ | | 103| 0|#define karatzuba_add1_port RENAME_FUNC_NAME(karatzuba_add1_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 155| 0| ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 72| 0|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->karatzuba_add2 = karatzuba_add2_port; ------------------ | | 104| 0|#define karatzuba_add2_port RENAME_FUNC_NAME(karatzuba_add2_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 156| 0| ctx->karatzuba_add3 = karatzuba_add3_port; ------------------ | | 105| 0|#define karatzuba_add3_port RENAME_FUNC_NAME(karatzuba_add3_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 157| 0| ctx->k_sqr = k_sqr_port; ------------------ | | 107| 0|#define k_sqr_port RENAME_FUNC_NAME(k_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 0| ctx->red = gf2x_red_port; ------------------ | | 75| 0|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->red = gf2x_red_port; ------------------ | | 108| 0|#define gf2x_red_port RENAME_FUNC_NAME(gf2x_red_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 159| 0| } 160| | 161| 17|#if defined(X86_64) 162| |# if !defined(DISABLE_VPCLMUL) 163| | if(is_vpclmul_enabled()) { 164| | ctx->mul_base_qwords = GF2X_VPCLMUL_BASE_QWORDS; 165| | ctx->mul_base = gf2x_mul_base_vpclmul; 166| | ctx->sqr = gf2x_sqr_vpclmul; 167| | } else 168| |# endif // DISABLE_VPCLMUL 169| 17|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_PCLMULQDQ_INSTRUCTIONS) 170| 17| if(is_pclmul_enabled()) { ------------------ | | 99| 17|#define is_pclmul_enabled RENAME_FUNC_NAME(is_pclmul_enabled) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (170:6): [True: 17, False: 0] ------------------ 171| 17| ctx->mul_base_qwords = GF2X_PCLMUL_BASE_QWORDS; ------------------ | | 19| 17|#define GF2X_PCLMUL_BASE_QWORDS (8) ------------------ 172| 17| ctx->mul_base = gf2x_mul_base_pclmul; ------------------ | | 109| 17|#define gf2x_mul_base_pclmul RENAME_FUNC_NAME(gf2x_mul_base_pclmul) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 173| 17| ctx->sqr = gf2x_sqr_pclmul; ------------------ | | 117| 17|#define gf2x_sqr_pclmul RENAME_FUNC_NAME(gf2x_sqr_pclmul) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 174| 17| } else 175| 0|#endif 176| 0|#endif 177| 0| { 178| 0| ctx->mul_base_qwords = GF2X_PORT_BASE_QWORDS; ------------------ | | 18| 0|#define GF2X_PORT_BASE_QWORDS (1) ------------------ 179| 0| ctx->mul_base = gf2x_mul_base_port; ------------------ | | 102| 0|#define gf2x_mul_base_port RENAME_FUNC_NAME(gf2x_mul_base_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 180| 0| ctx->sqr = gf2x_sqr_port; ------------------ | | 106| 0|#define gf2x_sqr_port RENAME_FUNC_NAME(gf2x_sqr_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 181| 0| } 182| 17|} OQS_KEM_bike_l1_gf2x_mod_inv: 119| 5|{ 120| | // Initialize gf2x methods struct 121| 5| gf2x_ctx ctx; 122| 5| gf2x_ctx_init(&ctx); ------------------ | | 126| 5|#define gf2x_ctx_init RENAME_FUNC_NAME(gf2x_ctx_init) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 123| | 124| | // Note that exp0/1_k/l are predefined constants that depend only on the value 125| | // of R. This value is public. Therefore, branches in this function, which 126| | // depends on R, are also "public". Code that releases these branches 127| | // (taken/not-taken) does not leak secret information. 128| 5| const size_t exp0_k[MAX_I] = {EXP0_K_VALS}; ------------------ | | 80| 5| 1, 2, 4, 8, 16, 32, 64, 128, 256, 512, 1024, 2048, 4096, 8192 ------------------ 129| 5| const size_t exp0_l[MAX_I] = {EXP0_L_VALS}; ------------------ | | 82| 5| 6162, 3081, 3851, 5632, 22, 484, 119, 1838, 1742, 3106, 10650, 1608, 10157, 8816 ------------------ 130| 5| const size_t exp1_k[MAX_I] = {EXP1_K_VALS}; ------------------ | | 83| 5|# define EXP1_K_VALS 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 33, 4129 ------------------ 131| 5| const size_t exp1_l[MAX_I] = {EXP1_L_VALS}; ------------------ | | 84| 5|# define EXP1_L_VALS 0, 0, 0, 0, 0, 6162, 0, 0, 0, 0, 0, 0, 242, 5717 ------------------ 132| | 133| 5| DEFER_CLEANUP(pad_r_t f = {0}, pad_r_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 134| 5| DEFER_CLEANUP(pad_r_t g = {0}, pad_r_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 135| 5| DEFER_CLEANUP(pad_r_t t = {0}, pad_r_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 136| 5| DEFER_CLEANUP(dbl_pad_r_t sec_buf = {0}, dbl_pad_r_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 137| | 138| | // Steps 2 and 3 in [1](Algorithm 2) 139| 5| f.val = a->val; 140| 5| t.val = a->val; 141| | 142| 70| for(size_t i = 1; i < MAX_I; i++) { ------------------ | | 78| 70|# define MAX_I (14) ------------------ | Branch (142:21): [True: 65, False: 5] ------------------ 143| | // Step 5 in [1](Algorithm 2), exponentiation 0: g = f^2^2^(i-1) 144| 65| if(exp0_k[i - 1] <= K_SQR_THR) { ------------------ | | 51| 65|#define K_SQR_THR (64) ------------------ | Branch (144:8): [True: 35, False: 30] ------------------ 145| 35| repeated_squaring(&g, &f, exp0_k[i - 1], &sec_buf, &ctx); 146| 35| } else { 147| 30| ctx.k_sqr(&g, &f, exp0_l[i - 1]); 148| 30| } 149| | 150| | // Step 6, [1](Algorithm 2): f = f*g 151| 65| gf2x_mod_mul_with_ctx(&f, &g, &f, &ctx); ------------------ | | 125| 65|#define gf2x_mod_mul_with_ctx RENAME_FUNC_NAME(gf2x_mod_mul_with_ctx) | | ------------------ | | | | 44| 65|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 65|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 65|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 152| | 153| 65| if(exp1_k[i] != 0) { ------------------ | Branch (153:8): [True: 15, False: 50] ------------------ 154| | // Step 8, [1](Algorithm 2), exponentiation 1: g = f^2^((r-2) % 2^i) 155| 15| if(exp1_k[i] <= K_SQR_THR) { ------------------ | | 51| 15|#define K_SQR_THR (64) ------------------ | Branch (155:10): [True: 10, False: 5] ------------------ 156| 10| repeated_squaring(&g, &f, exp1_k[i], &sec_buf, &ctx); 157| 10| } else { 158| 5| ctx.k_sqr(&g, &f, exp1_l[i]); 159| 5| } 160| | 161| | // Step 9, [1](Algorithm 2): t = t*g; 162| 15| gf2x_mod_mul_with_ctx(&t, &g, &t, &ctx); ------------------ | | 125| 15|#define gf2x_mod_mul_with_ctx RENAME_FUNC_NAME(gf2x_mod_mul_with_ctx) | | ------------------ | | | | 44| 15|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 15|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 15|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 163| 15| } 164| 65| } 165| | 166| | // Step 10, [1](Algorithm 2): c = t^2 167| 5| gf2x_mod_sqr_in_place(&t, &sec_buf, &ctx); 168| 5| c->val = t.val; 169| 5|} gf2x_inv.c:repeated_squaring: 32| 64|{ 33| 64| c->val = a->val; 34| | 35| 1.15k| for(size_t i = 0; i < num_sqrs; i++) { ------------------ | Branch (35:21): [True: 1.09k, False: 64] ------------------ 36| 1.09k| gf2x_mod_sqr_in_place(c, sec_buf, ctx); 37| 1.09k| } 38| 64|} gf2x_inv.c:gf2x_mod_sqr_in_place: 21| 1.09k|{ 22| 1.09k| ctx->sqr(secure_buffer, a); 23| 1.09k| ctx->red(a, secure_buffer); ------------------ | | 75| 1.09k|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 1.09k|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1.09k|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1.09k|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 24| 1.09k|} OQS_KEM_bike_l3_gf2x_mod_inv: 119| 1|{ 120| | // Initialize gf2x methods struct 121| 1| gf2x_ctx ctx; 122| 1| gf2x_ctx_init(&ctx); ------------------ | | 126| 1|#define gf2x_ctx_init RENAME_FUNC_NAME(gf2x_ctx_init) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 123| | 124| | // Note that exp0/1_k/l are predefined constants that depend only on the value 125| | // of R. This value is public. Therefore, branches in this function, which 126| | // depends on R, are also "public". Code that releases these branches 127| | // (taken/not-taken) does not leak secret information. 128| 1| const size_t exp0_k[MAX_I] = {EXP0_K_VALS}; ------------------ | | 93| 1| 1, 2, 4, 8, 16, 32, 64, 128, 256, 512, 1024, 2048, 4096, 8192, 16384 ------------------ 129| 1| const size_t exp0_l[MAX_I] = {EXP0_L_VALS}; ------------------ | | 95| 1| 12330, 6165, 7706, 3564, 2711, 1139, 15053, 1258, 4388, 20524, 9538, 6393, \ | | 96| 1| 10486, 1715, 6804 ------------------ 130| 1| const size_t exp1_k[MAX_I] = {EXP1_K_VALS}; ------------------ | | 97| 1|# define EXP1_K_VALS 0, 0, 0, 0, 1, 0, 17, 0, 0, 0, 0, 0, 0, 81, 8273 ------------------ 131| 1| const size_t exp1_l[MAX_I] = {EXP1_L_VALS}; ------------------ | | 98| 1|# define EXP1_L_VALS 0, 0, 0, 0, 12330, 0, 13685, 0, 0, 0, 0, 0, 0, 23678, 19056 ------------------ 132| | 133| 1| DEFER_CLEANUP(pad_r_t f = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 134| 1| DEFER_CLEANUP(pad_r_t g = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 135| 1| DEFER_CLEANUP(pad_r_t t = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 136| 1| DEFER_CLEANUP(dbl_pad_r_t sec_buf = {0}, dbl_pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 137| | 138| | // Steps 2 and 3 in [1](Algorithm 2) 139| 1| f.val = a->val; 140| 1| t.val = a->val; 141| | 142| 15| for(size_t i = 1; i < MAX_I; i++) { ------------------ | | 91| 15|# define MAX_I (15) ------------------ | Branch (142:21): [True: 14, False: 1] ------------------ 143| | // Step 5 in [1](Algorithm 2), exponentiation 0: g = f^2^2^(i-1) 144| 14| if(exp0_k[i - 1] <= K_SQR_THR) { ------------------ | | 51| 14|#define K_SQR_THR (64) ------------------ | Branch (144:8): [True: 7, False: 7] ------------------ 145| 7| repeated_squaring(&g, &f, exp0_k[i - 1], &sec_buf, &ctx); 146| 7| } else { 147| 7| ctx.k_sqr(&g, &f, exp0_l[i - 1]); 148| 7| } 149| | 150| | // Step 6, [1](Algorithm 2): f = f*g 151| 14| gf2x_mod_mul_with_ctx(&f, &g, &f, &ctx); ------------------ | | 125| 14|#define gf2x_mod_mul_with_ctx RENAME_FUNC_NAME(gf2x_mod_mul_with_ctx) | | ------------------ | | | | 44| 14|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 14|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 14|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 152| | 153| 14| if(exp1_k[i] != 0) { ------------------ | Branch (153:8): [True: 4, False: 10] ------------------ 154| | // Step 8, [1](Algorithm 2), exponentiation 1: g = f^2^((r-2) % 2^i) 155| 4| if(exp1_k[i] <= K_SQR_THR) { ------------------ | | 51| 4|#define K_SQR_THR (64) ------------------ | Branch (155:10): [True: 2, False: 2] ------------------ 156| 2| repeated_squaring(&g, &f, exp1_k[i], &sec_buf, &ctx); 157| 2| } else { 158| 2| ctx.k_sqr(&g, &f, exp1_l[i]); 159| 2| } 160| | 161| | // Step 9, [1](Algorithm 2): t = t*g; 162| 4| gf2x_mod_mul_with_ctx(&t, &g, &t, &ctx); ------------------ | | 125| 4|#define gf2x_mod_mul_with_ctx RENAME_FUNC_NAME(gf2x_mod_mul_with_ctx) | | ------------------ | | | | 44| 4|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 4|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 4|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 163| 4| } 164| 14| } 165| | 166| | // Step 10, [1](Algorithm 2): c = t^2 167| 1| gf2x_mod_sqr_in_place(&t, &sec_buf, &ctx); 168| 1| c->val = t.val; 169| 1|} OQS_KEM_bike_l5_gf2x_mod_inv: 119| 1|{ 120| | // Initialize gf2x methods struct 121| 1| gf2x_ctx ctx; 122| 1| gf2x_ctx_init(&ctx); ------------------ | | 126| 1|#define gf2x_ctx_init RENAME_FUNC_NAME(gf2x_ctx_init) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 123| | 124| | // Note that exp0/1_k/l are predefined constants that depend only on the value 125| | // of R. This value is public. Therefore, branches in this function, which 126| | // depends on R, are also "public". Code that releases these branches 127| | // (taken/not-taken) does not leak secret information. 128| 1| const size_t exp0_k[MAX_I] = {EXP0_K_VALS}; ------------------ | | 107| 1| 1, 2, 4, 8, 16, 32, 64, 128, 256, 512, 1024, 2048, 4096, 8192, 16384, 32768 ------------------ 129| 1| const size_t exp0_l[MAX_I] = {EXP0_L_VALS}; ------------------ | | 109| 1| 20487, 30730, 28169, 9443, 13001, 12376, 8302, 6618, 38760, 21582, 1660, \ | | 110| 1| 10409, 14669, 30338, 17745, 7520 ------------------ 130| 1| const size_t exp1_k[MAX_I] = {EXP1_K_VALS}; ------------------ | | 111| 1|# define EXP1_K_VALS 0, 1, 0, 3, 0, 0, 0, 0, 0, 0, 0, 0, 0, 11, 0, 8203 ------------------ 131| 1| const size_t exp1_l[MAX_I] = {EXP1_L_VALS}; ------------------ | | 112| 1|# define EXP1_L_VALS 0, 20487, 0, 15365, 0, 0, 0, 0, 0, 0, 0, 0, 0, 6302, 0, 10058 ------------------ 132| | 133| 1| DEFER_CLEANUP(pad_r_t f = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 134| 1| DEFER_CLEANUP(pad_r_t g = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 135| 1| DEFER_CLEANUP(pad_r_t t = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 136| 1| DEFER_CLEANUP(dbl_pad_r_t sec_buf = {0}, dbl_pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 137| | 138| | // Steps 2 and 3 in [1](Algorithm 2) 139| 1| f.val = a->val; 140| 1| t.val = a->val; 141| | 142| 16| for(size_t i = 1; i < MAX_I; i++) { ------------------ | | 105| 16|# define MAX_I (16) ------------------ | Branch (142:21): [True: 15, False: 1] ------------------ 143| | // Step 5 in [1](Algorithm 2), exponentiation 0: g = f^2^2^(i-1) 144| 15| if(exp0_k[i - 1] <= K_SQR_THR) { ------------------ | | 51| 15|#define K_SQR_THR (64) ------------------ | Branch (144:8): [True: 7, False: 8] ------------------ 145| 7| repeated_squaring(&g, &f, exp0_k[i - 1], &sec_buf, &ctx); 146| 8| } else { 147| 8| ctx.k_sqr(&g, &f, exp0_l[i - 1]); 148| 8| } 149| | 150| | // Step 6, [1](Algorithm 2): f = f*g 151| 15| gf2x_mod_mul_with_ctx(&f, &g, &f, &ctx); ------------------ | | 125| 15|#define gf2x_mod_mul_with_ctx RENAME_FUNC_NAME(gf2x_mod_mul_with_ctx) | | ------------------ | | | | 44| 15|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 15|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 15|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 152| | 153| 15| if(exp1_k[i] != 0) { ------------------ | Branch (153:8): [True: 4, False: 11] ------------------ 154| | // Step 8, [1](Algorithm 2), exponentiation 1: g = f^2^((r-2) % 2^i) 155| 4| if(exp1_k[i] <= K_SQR_THR) { ------------------ | | 51| 4|#define K_SQR_THR (64) ------------------ | Branch (155:10): [True: 3, False: 1] ------------------ 156| 3| repeated_squaring(&g, &f, exp1_k[i], &sec_buf, &ctx); 157| 3| } else { 158| 1| ctx.k_sqr(&g, &f, exp1_l[i]); 159| 1| } 160| | 161| | // Step 9, [1](Algorithm 2): t = t*g; 162| 4| gf2x_mod_mul_with_ctx(&t, &g, &t, &ctx); ------------------ | | 125| 4|#define gf2x_mod_mul_with_ctx RENAME_FUNC_NAME(gf2x_mod_mul_with_ctx) | | ------------------ | | | | 44| 4|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 4|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 4|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 163| 4| } 164| 15| } 165| | 166| | // Step 10, [1](Algorithm 2): c = t^2 167| 1| gf2x_mod_sqr_in_place(&t, &sec_buf, &ctx); 168| 1| c->val = t.val; 169| 1|} OQS_KEM_bike_l1_k_sqr_avx2: 191| 35|{ 192| 35| ALIGN(ALIGN_BYTES) map_word_t map[R_PADDED]; ------------------ | | 18| 35|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 193| 35| ALIGN(ALIGN_BYTES) uint8_t a_bytes[R_PADDED]; ------------------ | | 18| 35|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 194| 35| ALIGN(ALIGN_BYTES) uint8_t c_bytes[R_PADDED] = {0}; ------------------ | | 18| 35|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 195| | 196| | // Generate the permutation map defined by pi1 and l_param. 197| 35| generate_map(map, l_param); 198| | 199| 35| bin_to_bytes(a_bytes, a); 200| | 201| | // Permute "a" using the generated permutation map. 202| 431k| for(size_t i = 0; i < R_BITS; i++) { ------------------ | | 23| 431k|# define R_BITS 12323 ------------------ | Branch (202:21): [True: 431k, False: 35] ------------------ 203| 431k| c_bytes[i] = a_bytes[map[i]]; 204| 431k| } 205| | 206| 35| bytes_to_bin(c, c_bytes); 207| | 208| 35| secure_clean(a_bytes, sizeof(a_bytes)); ------------------ | | 33| 35|#define secure_clean OQS_MEM_cleanse ------------------ 209| 35| secure_clean(c_bytes, sizeof(c_bytes)); ------------------ | | 33| 35|#define secure_clean OQS_MEM_cleanse ------------------ 210| 35|} gf2x_ksqr_avx2.c:generate_map: 51| 53|{ 52| 53| __m256i vmap[NUM_YMMS], vtmp[NUM_YMMS], vr, inc, zero; 53| | 54| | // The permutation map is generated in the following way: 55| | // 1. for i = 0 to map size: 56| | // 2. map[i] = (i * l_param) % r 57| | // However, to avoid the expensive multiplication and modulo operations 58| | // we modify the algorithm to: 59| | // 1. map[0] = l_param 60| | // 2. for i = 1 to map size: 61| | // 3. map[i] = map[i - 1] + l_param 62| | // 4. if map[i] >= r: 63| | // 5. map[i] = map[i] - r 64| | // This algorithm is parallelized with vector instructions by processing 65| | // certain number of values (NUM_OF_VALS) in parallel. Therefore, 66| | // in the beginning we need to initialize the first NUM_OF_VALS elements. 67| 1.60k| for(size_t i = 0; i < NUM_OF_VALS; i++) { ------------------ | | 48| 1.60k|#define NUM_OF_VALS (NUM_YMMS * MAP_WORDS_IN_YMM) | | ------------------ | | | | 47| 1.60k|#define NUM_YMMS (2) | | ------------------ | | #define NUM_OF_VALS (NUM_YMMS * MAP_WORDS_IN_YMM) | | ------------------ | | | | 27| 1.60k|# define MAP_WORDS_IN_YMM WORDS_IN_YMM | | | | ------------------ | | | | | | 54| 1.60k|#define WORDS_IN_YMM (BYTES_IN_YMM / sizeof(uint16_t)) | | | | | | ------------------ | | | | | | | | 48| 1.60k|#define BYTES_IN_YMM 0x20 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (67:21): [True: 1.55k, False: 53] ------------------ 68| 1.55k| map[i] = (i * l_param) % R_BITS; ------------------ | | 23| 1.55k|# define R_BITS 12323 ------------------ 69| 1.55k| } 70| | 71| 53| vr = SET1(R_BITS); ------------------ | | 30| 53|# define SET1(x) SET1_I16(x) | | ------------------ | | | | 69| 53|# define SET1_I16(a) _mm256_set1_epi16(a) | | ------------------ ------------------ 72| 53| zero = SET_ZERO; ------------------ | | 72| 53|# define SET_ZERO _mm256_setzero_si256() ------------------ 73| | 74| | // Set the increment vector such that adding it to vmap vectors 75| | // gives the next NUM_OF_VALS elements of the map. AVX2 does not 76| | // support comparison of vectors where vector elements are considered 77| | // as unsigned integers. This is a problem when r > 2^14 because 78| | // sum of two values can be greater than 2^15 which would make the it 79| | // a negative number when considered as a signed 16-bit integer, 80| | // and therefore, the condition in step 4 of the algorithm would be 81| | // evaluated incorrectly. So, we use the following trick: 82| | // we subtract R from the increment and modify the algorithm: 83| | // 1. map[0] = l_param 84| | // 2. for i = 1 to map size: 85| | // 3. map[i] = map[i - 1] + (l_param - r) 86| | // 4. if map[i] < 0: 87| | // 5. map[i] = map[i] + r 88| 53| inc = SET1((l_param * NUM_OF_VALS) % R_BITS); ------------------ | | 30| 53|# define SET1(x) SET1_I16(x) | | ------------------ | | | | 69| 53|# define SET1_I16(a) _mm256_set1_epi16(a) | | ------------------ ------------------ 89| 53| inc = SUB(inc, vr); ------------------ | | 31| 53|# define SUB(x, y) SUB_I16(x, y) | | ------------------ | | | | 78| 53|# define SUB_I16(a, b) _mm256_sub_epi16(a, b) | | ------------------ ------------------ 90| | 91| | // Load the first NUM_OF_VALS elements in the vmap vectors 92| 159| for(size_t i = 0; i < NUM_YMMS; i++) { ------------------ | | 47| 159|#define NUM_YMMS (2) ------------------ | Branch (92:21): [True: 106, False: 53] ------------------ 93| 106| vmap[i] = LOAD(&map[i * MAP_WORDS_IN_YMM]); ------------------ | | 28| 106|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 94| 106| } 95| | 96| 64.0k| for(size_t i = NUM_YMMS; i < (R_PADDED / MAP_WORDS_IN_YMM); i += NUM_YMMS) { ------------------ | | 47| 53|#define NUM_YMMS (2) ------------------ for(size_t i = NUM_YMMS; i < (R_PADDED / MAP_WORDS_IN_YMM); i += NUM_YMMS) { ------------------ | | 88| 64.0k|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | ------------------ | | | | 87| 64.0k|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | ------------------ | | | | | | 37| 64.0k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | ------------------ | | ------------------ | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | ------------------ | | | | 40| 64.0k|# define BLOCK_BITS 16384 | | ------------------ ------------------ for(size_t i = NUM_YMMS; i < (R_PADDED / MAP_WORDS_IN_YMM); i += NUM_YMMS) { ------------------ | | 27| 64.0k|# define MAP_WORDS_IN_YMM WORDS_IN_YMM | | ------------------ | | | | 54| 64.0k|#define WORDS_IN_YMM (BYTES_IN_YMM / sizeof(uint16_t)) | | | | ------------------ | | | | | | 48| 64.0k|#define BYTES_IN_YMM 0x20 | | | | ------------------ | | ------------------ ------------------ for(size_t i = NUM_YMMS; i < (R_PADDED / MAP_WORDS_IN_YMM); i += NUM_YMMS) { ------------------ | | 47| 63.9k|#define NUM_YMMS (2) ------------------ | Branch (96:28): [True: 63.9k, False: 53] ------------------ 97| 191k| for(size_t j = 0; j < NUM_YMMS; j++) { ------------------ | | 47| 191k|#define NUM_YMMS (2) ------------------ | Branch (97:23): [True: 127k, False: 63.9k] ------------------ 98| 127k| vmap[j] = ADD(vmap[j], inc); ------------------ | | 32| 127k|# define ADD(x, y) ADD_I16(x, y) | | ------------------ | | | | 76| 127k|# define ADD_I16(a, b) _mm256_add_epi16(a, b) | | ------------------ ------------------ 99| 127k| vtmp[j] = CMPGT(zero, vmap[j]); ------------------ | | 33| 127k|# define CMPGT(x, y) CMPGT_I16(x, y) | | ------------------ | | | | 85| 127k|# define CMPGT_I16(a, b) _mm256_cmpgt_epi16(a, b) | | ------------------ ------------------ 100| 127k| vmap[j] = ADD(vmap[j], vtmp[j] & vr); ------------------ | | 32| 127k|# define ADD(x, y) ADD_I16(x, y) | | ------------------ | | | | 76| 127k|# define ADD_I16(a, b) _mm256_add_epi16(a, b) | | ------------------ ------------------ 101| | 102| 127k| STORE(&map[(i + j) * MAP_WORDS_IN_YMM], vmap[j]); ------------------ | | 29| 127k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 103| 127k| } 104| 63.9k| } 105| 53|} gf2x_ksqr_avx2.c:bin_to_bytes: 124| 53|{ 125| | // The algorithm works by taking every 32 bits of the input and converting 126| | // them to 32 bytes where each byte holds one of the bits. The first step is 127| | // to broadcast a 32-bit value (call it a) to all elements of vector t. 128| | // Then t contains bytes of a in the following order: 129| | // t = [ a3 a2 a1 a0 ... a3 a2 a1 a0 ] 130| | // where a0 contains the first 8 bits of a, a1 the second 8 bits, etc. 131| | // Let the output vector be [ out31 out30 ... out0 ]. We want to store 132| | // bit 0 of a in out0 byte, bit 1 of a in out1 byte, ect. (note that 133| | // we want to store the bit in the most significant position of a byte 134| | // because this is required by MOVEMASK instruction used in bytes_to_bin.) 135| | // 136| | // Ideally, we would shuffle the bytes of t such that the byte in 137| | // i-th position contains i-th bit of val, shift t appropriately and obtain 138| | // the result. However, AVX2 doesn't support shift operation on bytes, only 139| | // shifts of individual QWORDS (64 bit) and DWORDS (32 bit) are allowed. 140| | // Consider the two least significant DWORDS of t: 141| | // t = [ ... | a3 a2 a1 a0 | a3 a2 a1 a0 ] 142| | // and shift them by 6 and 4 to the left, respectively, to obtain: 143| | // t = [ ... | t7 t6 t5 t4 | t3 t2 t1 t0 ] 144| | // where t3 = a3 << 6, t2 = a2 << 6, t1 = a1 << 6, t0 = a0 << 6, 145| | // and t7 = a3 << 4, t6 = a2 << 4, t5 = a1 << 4, t4 = a0 << 4. 146| | // Now we shuffle vector t to obtain vector p such that: 147| | // p = [ ... | t12 t12 t8 t8 | t4 t4 t0 t0 ] 148| | // Note that in every even position of the vector p we have the right byte 149| | // of the input shifted by the required shift. The values in the odd 150| | // positions contain the right bytes of the input but they need to be shifted 151| | // one more time to the left by 1. By shifting each DWORD of p by 1 we get: 152| | // q = [ ... | p7 p6 p5 p4 | p3 p2 p1 p0 ] 153| | // where p1 = t0 << 1 = a0 << 7, p3 = t4 << 1 = 5, etc. Therefore, by 154| | // blending p and q (taking even positions from p and odd positions from q) 155| | // we obtain the desired result. 156| | 157| 53| __m256i t, p, q; 158| | 159| 53| const __m256i shift_mask = SET_I32(0, 2, 4, 6, 0, 2, 4, 6); ------------------ | | 66| 53|# define SET_I32(...) _mm256_set_epi32(__VA_ARGS__) ------------------ 160| | 161| 53| const __m256i shuffle_mask = 162| 53| SET_I8(15, 15, 11, 11, 7, 7, 3, 3, 14, 14, 10, 10, 6, 6, 2, 2, 13, 13, 9, 9, ------------------ | | 65| 53|# define SET_I8(...) _mm256_set_epi8(__VA_ARGS__) ------------------ 163| 53| 5, 5, 1, 1, 12, 12, 8, 8, 4, 4, 0, 0); 164| | 165| 53| const __m256i blend_mask = SET1_I16(0x00ff); ------------------ | | 69| 53|# define SET1_I16(a) _mm256_set1_epi16(a) ------------------ 166| | 167| 53| const uint32_t *bin32 = (const uint32_t *)bin_buf; 168| | 169| 32.0k| for(size_t i = 0; i < R_QWORDS * 2; i++) { ------------------ | | 82| 32.0k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 32.0k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (169:21): [True: 31.9k, False: 53] ------------------ 170| 31.9k| t = SET1_I32(bin32[i]); ------------------ | | 70| 31.9k|# define SET1_I32(a) _mm256_set1_epi32(a) ------------------ 171| 31.9k| t = SLLV_I32(t, shift_mask); ------------------ | | 83| 31.9k|# define SLLV_I32(a, b) _mm256_sllv_epi32(a, b) ------------------ 172| | 173| 31.9k| p = SHUF_I8(t, shuffle_mask); ------------------ | | 91| 31.9k|# define SHUF_I8(a, b) _mm256_shuffle_epi8(a, b) ------------------ 174| 31.9k| q = SLLI_I32(p, 1); ------------------ | | 82| 31.9k|# define SLLI_I32(a, imm) _mm256_slli_epi32(a, imm) ------------------ 175| | 176| 31.9k| STORE(&bytes_buf[i * 32], BLENDV_I8(p, q, blend_mask)); ------------------ | | 29| 31.9k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 177| 31.9k| } 178| 53|} gf2x_ksqr_avx2.c:bytes_to_bin: 111| 53|{ 112| 53| uint32_t *bin32 = (uint32_t *)bin_buf; 113| | 114| 32.0k| for(size_t i = 0; i < R_QWORDS * 2; i++) { ------------------ | | 82| 32.0k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 32.0k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (114:21): [True: 31.9k, False: 53] ------------------ 115| 31.9k| __m256i t = LOAD(&bytes_buf[i * BYTES_IN_YMM]); ------------------ | | 28| 31.9k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 116| 31.9k| bin32[i] = MOVEMASK(t); ------------------ | | 96| 31.9k|# define MOVEMASK(a) _mm256_movemask_epi8(a) ------------------ 117| 31.9k| } 118| 53|} OQS_KEM_bike_l3_k_sqr_avx2: 191| 9|{ 192| 9| ALIGN(ALIGN_BYTES) map_word_t map[R_PADDED]; ------------------ | | 18| 9|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 193| 9| ALIGN(ALIGN_BYTES) uint8_t a_bytes[R_PADDED]; ------------------ | | 18| 9|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 194| 9| ALIGN(ALIGN_BYTES) uint8_t c_bytes[R_PADDED] = {0}; ------------------ | | 18| 9|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 195| | 196| | // Generate the permutation map defined by pi1 and l_param. 197| 9| generate_map(map, l_param); 198| | 199| 9| bin_to_bytes(a_bytes, a); 200| | 201| | // Permute "a" using the generated permutation map. 202| 221k| for(size_t i = 0; i < R_BITS; i++) { ------------------ | | 43| 221k|# define R_BITS 24659 ------------------ | Branch (202:21): [True: 221k, False: 9] ------------------ 203| 221k| c_bytes[i] = a_bytes[map[i]]; 204| 221k| } 205| | 206| 9| bytes_to_bin(c, c_bytes); 207| | 208| 9| secure_clean(a_bytes, sizeof(a_bytes)); ------------------ | | 33| 9|#define secure_clean OQS_MEM_cleanse ------------------ 209| 9| secure_clean(c_bytes, sizeof(c_bytes)); ------------------ | | 33| 9|#define secure_clean OQS_MEM_cleanse ------------------ 210| 9|} OQS_KEM_bike_l5_k_sqr_avx2: 191| 9|{ 192| 9| ALIGN(ALIGN_BYTES) map_word_t map[R_PADDED]; ------------------ | | 18| 9|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 193| 9| ALIGN(ALIGN_BYTES) uint8_t a_bytes[R_PADDED]; ------------------ | | 18| 9|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 194| 9| ALIGN(ALIGN_BYTES) uint8_t c_bytes[R_PADDED] = {0}; ------------------ | | 18| 9|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 195| | 196| | // Generate the permutation map defined by pi1 and l_param. 197| 9| generate_map(map, l_param); 198| | 199| 9| bin_to_bytes(a_bytes, a); 200| | 201| | // Permute "a" using the generated permutation map. 202| 368k| for(size_t i = 0; i < R_BITS; i++) { ------------------ | | 59| 368k|# define R_BITS 40973 ------------------ | Branch (202:21): [True: 368k, False: 9] ------------------ 203| 368k| c_bytes[i] = a_bytes[map[i]]; 204| 368k| } 205| | 206| 9| bytes_to_bin(c, c_bytes); 207| | 208| 9| secure_clean(a_bytes, sizeof(a_bytes)); ------------------ | | 33| 9|#define secure_clean OQS_MEM_cleanse ------------------ 209| 9| secure_clean(c_bytes, sizeof(c_bytes)); ------------------ | | 33| 9|#define secure_clean OQS_MEM_cleanse ------------------ 210| 9|} OQS_KEM_bike_l1_gf2x_mod_mul_with_ctx: 90| 165|{ 91| 165| bike_static_assert((R_PADDED_BYTES % 2 == 0), karatzuba_n_is_odd); ------------------ | | 30| 165|# define bike_static_assert(COND, MSG) static_assert(COND, "MSG") ------------------ 92| | 93| 165| DEFER_CLEANUP(dbl_pad_r_t t = {0}, dbl_pad_r_cleanup); ------------------ | | 16| 165| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 94| 165| ALIGN(ALIGN_BYTES) uint64_t secure_buffer[SECURE_BUFFER_QWORDS]; ------------------ | | 18| 165|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 95| | 96| 165| karatzuba((uint64_t *)&t, (const uint64_t *)a, (const uint64_t *)b, R_QWORDS, ------------------ | | 82| 165|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 165|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 97| 165| R_PADDED_QWORDS, secure_buffer, ctx); ------------------ | | 90| 165|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 165|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 165|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 165|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 40| 165|# define BLOCK_BITS 16384 | | | | ------------------ | | ------------------ ------------------ 98| | 99| 165| ctx->red(c, &t); ------------------ | | 75| 165|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 165|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 165|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 165|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 100| | 101| 165| secure_clean((uint8_t *)secure_buffer, sizeof(secure_buffer)); ------------------ | | 33| 165|#define secure_clean OQS_MEM_cleanse ------------------ 102| 165|} OQS_KEM_bike_l1_gf2x_mod_mul: 105| 85|{ 106| 85| bike_static_assert((R_PADDED_BYTES % 2 == 0), karatzuba_n_is_odd); ------------------ | | 30| 85|# define bike_static_assert(COND, MSG) static_assert(COND, "MSG") ------------------ 107| | 108| | // Initialize gf2x methods struct 109| 85| gf2x_ctx ctx; 110| 85| gf2x_ctx_init(&ctx); ------------------ | | 126| 85|#define gf2x_ctx_init RENAME_FUNC_NAME(gf2x_ctx_init) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 111| | 112| 85| gf2x_mod_mul_with_ctx(c, a, b, &ctx); ------------------ | | 125| 85|#define gf2x_mod_mul_with_ctx RENAME_FUNC_NAME(gf2x_mod_mul_with_ctx) | | ------------------ | | | | 44| 85|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 85|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 85|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 113| 85|} gf2x_mul.c:karatzuba: 32| 179k|{ 33| 179k| if(qwords_len <= ctx->mul_base_qwords) { ------------------ | Branch (33:6): [True: 119k, False: 59.7k] ------------------ 34| 119k| ctx->mul_base(c, a, b); 35| 119k| return; 36| 119k| } 37| | 38| 59.7k| const size_t half_qw_len = qwords_len_pad >> 1; 39| | 40| | // Split a and b into low and high parts of size n_padded/2 41| 59.7k| const uint64_t *a_lo = a; 42| 59.7k| const uint64_t *b_lo = b; 43| 59.7k| const uint64_t *a_hi = &a[half_qw_len]; 44| 59.7k| const uint64_t *b_hi = &b[half_qw_len]; 45| | 46| | // Split c into 4 parts of size n_padded/2 (the last ptr is not needed) 47| 59.7k| uint64_t *c0 = c; 48| 59.7k| uint64_t *c1 = &c[half_qw_len]; 49| 59.7k| uint64_t *c2 = &c[half_qw_len * 2]; 50| | 51| | // Allocate 3 ptrs of size n_padded/2 on sec_buf 52| 59.7k| uint64_t *alah = sec_buf; 53| 59.7k| uint64_t *blbh = &sec_buf[half_qw_len]; 54| 59.7k| uint64_t *tmp = &sec_buf[half_qw_len * 2]; 55| | 56| | // Move sec_buf ptr to the first free location for the next recursion call 57| 59.7k| sec_buf = &sec_buf[half_qw_len * 3]; 58| | 59| | // Compute a_lo*b_lo and store the result in (c1|c0) 60| 59.7k| karatzuba(c0, a_lo, b_lo, half_qw_len, half_qw_len, sec_buf, ctx); 61| | 62| | // If the real number of digits n is less or equal to n_padded/2 then: 63| | // a_hi = 0 and b_hi = 0 64| | // and 65| | // (a_hi|a_lo)*(b_hi|b_lo) = a_lo*b_lo 66| | // so we can skip the remaining two multiplications 67| 59.7k| if(qwords_len > half_qw_len) { ------------------ | Branch (67:6): [True: 59.7k, False: 36] ------------------ 68| | // Compute a_hi*b_hi and store the result in (c3|c2) 69| 59.7k| karatzuba(c2, a_hi, b_hi, qwords_len - half_qw_len, half_qw_len, sec_buf, 70| 59.7k| ctx); 71| | 72| | // Compute alah = (a_lo + a_hi) and blbh = (b_lo + b_hi) 73| 59.7k| ctx->karatzuba_add1(alah, blbh, a, b, half_qw_len); ------------------ | | 71| 59.7k|#define karatzuba_add1 RENAME_FUNC_NAME(karatzuba_add1) | | ------------------ | | | | 44| 59.7k|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 59.7k|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 59.7k|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 74| | 75| | // Compute (c1 + c2) and store the result in tmp 76| 59.7k| ctx->karatzuba_add2(tmp, c1, c2, half_qw_len); ------------------ | | 72| 59.7k|#define karatzuba_add2 RENAME_FUNC_NAME(karatzuba_add2) | | ------------------ | | | | 44| 59.7k|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 59.7k|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 59.7k|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 77| | 78| | // Compute alah*blbh and store the result in (c2|c1) 79| 59.7k| karatzuba(c1, alah, blbh, half_qw_len, half_qw_len, sec_buf, ctx); 80| | 81| | // Add (tmp|tmp) and (c3|c0) to (c2|c1) 82| 59.7k| ctx->karatzuba_add3(c0, tmp, half_qw_len); 83| 59.7k| } 84| 59.7k|} OQS_KEM_bike_l3_gf2x_mod_mul_with_ctx: 90| 35|{ 91| 35| bike_static_assert((R_PADDED_BYTES % 2 == 0), karatzuba_n_is_odd); ------------------ | | 30| 35|# define bike_static_assert(COND, MSG) static_assert(COND, "MSG") ------------------ 92| | 93| 35| DEFER_CLEANUP(dbl_pad_r_t t = {0}, dbl_pad_r_cleanup); ------------------ | | 16| 35| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 94| 35| ALIGN(ALIGN_BYTES) uint64_t secure_buffer[SECURE_BUFFER_QWORDS]; ------------------ | | 18| 35|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 95| | 96| 35| karatzuba((uint64_t *)&t, (const uint64_t *)a, (const uint64_t *)b, R_QWORDS, ------------------ | | 82| 35|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 35|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 97| 35| R_PADDED_QWORDS, secure_buffer, ctx); ------------------ | | 90| 35|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 35|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 35|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 35|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 56| 35|# define BLOCK_BITS 32768 | | | | ------------------ | | ------------------ ------------------ 98| | 99| 35| ctx->red(c, &t); ------------------ | | 75| 35|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 35|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 35|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 35|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 100| | 101| 35| secure_clean((uint8_t *)secure_buffer, sizeof(secure_buffer)); ------------------ | | 33| 35|#define secure_clean OQS_MEM_cleanse ------------------ 102| 35|} OQS_KEM_bike_l3_gf2x_mod_mul: 105| 17|{ 106| 17| bike_static_assert((R_PADDED_BYTES % 2 == 0), karatzuba_n_is_odd); ------------------ | | 30| 17|# define bike_static_assert(COND, MSG) static_assert(COND, "MSG") ------------------ 107| | 108| | // Initialize gf2x methods struct 109| 17| gf2x_ctx ctx; 110| 17| gf2x_ctx_init(&ctx); ------------------ | | 126| 17|#define gf2x_ctx_init RENAME_FUNC_NAME(gf2x_ctx_init) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 111| | 112| 17| gf2x_mod_mul_with_ctx(c, a, b, &ctx); ------------------ | | 125| 17|#define gf2x_mod_mul_with_ctx RENAME_FUNC_NAME(gf2x_mod_mul_with_ctx) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 113| 17|} OQS_KEM_bike_l5_gf2x_mod_mul_with_ctx: 90| 36|{ 91| 36| bike_static_assert((R_PADDED_BYTES % 2 == 0), karatzuba_n_is_odd); ------------------ | | 30| 36|# define bike_static_assert(COND, MSG) static_assert(COND, "MSG") ------------------ 92| | 93| 36| DEFER_CLEANUP(dbl_pad_r_t t = {0}, dbl_pad_r_cleanup); ------------------ | | 16| 36| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 94| 36| ALIGN(ALIGN_BYTES) uint64_t secure_buffer[SECURE_BUFFER_QWORDS]; ------------------ | | 18| 36|#define ALIGN(n) __attribute__((aligned(n))) ------------------ 95| | 96| 36| karatzuba((uint64_t *)&t, (const uint64_t *)a, (const uint64_t *)b, R_QWORDS, ------------------ | | 82| 36|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 36|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 97| 36| R_PADDED_QWORDS, secure_buffer, ctx); ------------------ | | 90| 36|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 36|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 36|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 36|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 71| 36|# define BLOCK_BITS 65536 | | | | ------------------ | | ------------------ ------------------ 98| | 99| 36| ctx->red(c, &t); ------------------ | | 75| 36|#define red RENAME_FUNC_NAME(red) | | ------------------ | | | | 44| 36|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 36|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 36|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 100| | 101| 36| secure_clean((uint8_t *)secure_buffer, sizeof(secure_buffer)); ------------------ | | 33| 36|#define secure_clean OQS_MEM_cleanse ------------------ 102| 36|} OQS_KEM_bike_l5_gf2x_mod_mul: 105| 17|{ 106| 17| bike_static_assert((R_PADDED_BYTES % 2 == 0), karatzuba_n_is_odd); ------------------ | | 30| 17|# define bike_static_assert(COND, MSG) static_assert(COND, "MSG") ------------------ 107| | 108| | // Initialize gf2x methods struct 109| 17| gf2x_ctx ctx; 110| 17| gf2x_ctx_init(&ctx); ------------------ | | 126| 17|#define gf2x_ctx_init RENAME_FUNC_NAME(gf2x_ctx_init) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 111| | 112| 17| gf2x_mod_mul_with_ctx(c, a, b, &ctx); ------------------ | | 125| 17|#define gf2x_mod_mul_with_ctx RENAME_FUNC_NAME(gf2x_mod_mul_with_ctx) | | ------------------ | | | | 44| 17|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 17|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 17|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 113| 17|} OQS_KEM_bike_l1_karatzuba_add1_avx2: 21| 17.8k|{ 22| 17.8k| assert(qwords_len % REG_QWORDS == 0); 23| | 24| 17.8k| REG_T va0, va1, vb0, vb1; ------------------ | | 26| 17.8k|# define REG_T __m256i ------------------ 25| | 26| 81.1k| for(size_t i = 0; i < qwords_len; i += REG_QWORDS) { ------------------ | | 58| 63.3k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (26:21): [True: 63.3k, False: 17.8k] ------------------ 27| 63.3k| va0 = LOAD(&a[i]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 28| 63.3k| va1 = LOAD(&a[i + qwords_len]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 29| 63.3k| vb0 = LOAD(&b[i]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 30| 63.3k| vb1 = LOAD(&b[i + qwords_len]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 31| | 32| 63.3k| STORE(&alah[i], va0 ^ va1); ------------------ | | 29| 63.3k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 33| 63.3k| STORE(&blbh[i], vb0 ^ vb1); ------------------ | | 29| 63.3k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 34| 63.3k| } 35| 17.8k|} OQS_KEM_bike_l1_karatzuba_add2_avx2: 41| 17.8k|{ 42| 17.8k| assert(qwords_len % REG_QWORDS == 0); 43| | 44| 17.8k| REG_T vx, vy; ------------------ | | 26| 17.8k|# define REG_T __m256i ------------------ 45| | 46| 81.1k| for(size_t i = 0; i < qwords_len; i += REG_QWORDS) { ------------------ | | 58| 63.3k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (46:21): [True: 63.3k, False: 17.8k] ------------------ 47| 63.3k| vx = LOAD(&x[i]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 48| 63.3k| vy = LOAD(&y[i]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 49| | 50| 63.3k| STORE(&z[i], vx ^ vy); ------------------ | | 29| 63.3k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 51| 63.3k| } 52| 17.8k|} OQS_KEM_bike_l1_karatzuba_add3_avx2: 57| 17.8k|{ 58| 17.8k| assert(qwords_len % REG_QWORDS == 0); 59| | 60| 17.8k| REG_T vr0, vr1, vr2, vr3, vt; ------------------ | | 26| 17.8k|# define REG_T __m256i ------------------ 61| | 62| 17.8k| uint64_t *c0 = c; 63| 17.8k| uint64_t *c1 = &c[qwords_len]; 64| 17.8k| uint64_t *c2 = &c[2 * qwords_len]; 65| 17.8k| uint64_t *c3 = &c[3 * qwords_len]; 66| | 67| 81.1k| for(size_t i = 0; i < qwords_len; i += REG_QWORDS) { ------------------ | | 58| 63.3k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (67:21): [True: 63.3k, False: 17.8k] ------------------ 68| 63.3k| vr0 = LOAD(&c0[i]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 69| 63.3k| vr1 = LOAD(&c1[i]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 70| 63.3k| vr2 = LOAD(&c2[i]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 71| 63.3k| vr3 = LOAD(&c3[i]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 72| 63.3k| vt = LOAD(&mid[i]); ------------------ | | 28| 63.3k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 73| | 74| 63.3k| STORE(&c1[i], vt ^ vr0 ^ vr1); ------------------ | | 29| 63.3k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 75| 63.3k| STORE(&c2[i], vt ^ vr2 ^ vr3); ------------------ | | 29| 63.3k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 76| 63.3k| } 77| 17.8k|} OQS_KEM_bike_l1_gf2x_red_avx2: 81| 975|{ 82| 975| const uint64_t *a64 = (const uint64_t *)a; 83| 975| uint64_t * c64 = (uint64_t *)c; 84| | 85| 48.7k| for(size_t i = 0; i < R_QWORDS; i += REG_QWORDS) { ------------------ | | 82| 48.7k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 48.7k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ for(size_t i = 0; i < R_QWORDS; i += REG_QWORDS) { ------------------ | | 58| 47.7k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (85:21): [True: 47.7k, False: 975] ------------------ 86| 47.7k| REG_T vt0 = LOAD(&a64[i]); ------------------ | | 26| 47.7k|# define REG_T __m256i ------------------ REG_T vt0 = LOAD(&a64[i]); ------------------ | | 28| 47.7k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 87| 47.7k| REG_T vt1 = LOAD(&a64[i + R_QWORDS]); ------------------ | | 26| 47.7k|# define REG_T __m256i ------------------ REG_T vt1 = LOAD(&a64[i + R_QWORDS]); ------------------ | | 28| 47.7k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 88| 47.7k| REG_T vt2 = LOAD(&a64[i + R_QWORDS - 1]); ------------------ | | 26| 47.7k|# define REG_T __m256i ------------------ REG_T vt2 = LOAD(&a64[i + R_QWORDS - 1]); ------------------ | | 28| 47.7k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 89| | 90| 47.7k| vt1 = SLLI_I64(vt1, LAST_R_QWORD_TRAIL); ------------------ | | 31| 47.7k|# define SLLI_I64(a, imm) _mm256_slli_epi64(a, imm) ------------------ 91| 47.7k| vt2 = SRLI_I64(vt2, LAST_R_QWORD_LEAD); ------------------ | | 32| 47.7k|# define SRLI_I64(a, imm) _mm256_srli_epi64(a, imm) ------------------ 92| | 93| 47.7k| vt0 ^= (vt1 | vt2); 94| | 95| 47.7k| STORE(&c64[i], vt0); ------------------ | | 29| 47.7k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 96| 47.7k| } 97| | 98| 975| c64[R_QWORDS - 1] &= LAST_R_QWORD_MASK; ------------------ | | 82| 975|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 975|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ c64[R_QWORDS - 1] &= LAST_R_QWORD_MASK; ------------------ | | 94| 975|#define LAST_R_QWORD_MASK MASK(LAST_R_QWORD_LEAD) | | ------------------ | | | | 43| 975|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 975|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 99| | 100| | // Clean the secrets from the upper part of c 101| 975| secure_clean((uint8_t *)&c64[R_QWORDS], ------------------ | | 33| 975|#define secure_clean OQS_MEM_cleanse ------------------ secure_clean((uint8_t *)&c64[R_QWORDS], ------------------ | | 82| 975|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 975|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 102| 975| (R_PADDED_QWORDS - R_QWORDS) * sizeof(uint64_t)); ------------------ | | 90| 975|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 975|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 975|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 975|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 40| 975|# define BLOCK_BITS 16384 | | | | ------------------ | | ------------------ ------------------ (R_PADDED_QWORDS - R_QWORDS) * sizeof(uint64_t)); ------------------ | | 82| 975|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 975|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 103| 975|} OQS_KEM_bike_l3_karatzuba_add1_avx2: 21| 11.3k|{ 22| 11.3k| assert(qwords_len % REG_QWORDS == 0); 23| | 24| 11.3k| REG_T va0, va1, vb0, vb1; ------------------ | | 26| 11.3k|# define REG_T __m256i ------------------ 25| | 26| 53.3k| for(size_t i = 0; i < qwords_len; i += REG_QWORDS) { ------------------ | | 58| 42.0k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (26:21): [True: 42.0k, False: 11.3k] ------------------ 27| 42.0k| va0 = LOAD(&a[i]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 28| 42.0k| va1 = LOAD(&a[i + qwords_len]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 29| 42.0k| vb0 = LOAD(&b[i]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 30| 42.0k| vb1 = LOAD(&b[i + qwords_len]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 31| | 32| 42.0k| STORE(&alah[i], va0 ^ va1); ------------------ | | 29| 42.0k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 33| 42.0k| STORE(&blbh[i], vb0 ^ vb1); ------------------ | | 29| 42.0k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 34| 42.0k| } 35| 11.3k|} OQS_KEM_bike_l3_karatzuba_add2_avx2: 41| 11.3k|{ 42| 11.3k| assert(qwords_len % REG_QWORDS == 0); 43| | 44| 11.3k| REG_T vx, vy; ------------------ | | 26| 11.3k|# define REG_T __m256i ------------------ 45| | 46| 53.3k| for(size_t i = 0; i < qwords_len; i += REG_QWORDS) { ------------------ | | 58| 42.0k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (46:21): [True: 42.0k, False: 11.3k] ------------------ 47| 42.0k| vx = LOAD(&x[i]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 48| 42.0k| vy = LOAD(&y[i]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 49| | 50| 42.0k| STORE(&z[i], vx ^ vy); ------------------ | | 29| 42.0k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 51| 42.0k| } 52| 11.3k|} OQS_KEM_bike_l3_karatzuba_add3_avx2: 57| 11.3k|{ 58| 11.3k| assert(qwords_len % REG_QWORDS == 0); 59| | 60| 11.3k| REG_T vr0, vr1, vr2, vr3, vt; ------------------ | | 26| 11.3k|# define REG_T __m256i ------------------ 61| | 62| 11.3k| uint64_t *c0 = c; 63| 11.3k| uint64_t *c1 = &c[qwords_len]; 64| 11.3k| uint64_t *c2 = &c[2 * qwords_len]; 65| 11.3k| uint64_t *c3 = &c[3 * qwords_len]; 66| | 67| 53.3k| for(size_t i = 0; i < qwords_len; i += REG_QWORDS) { ------------------ | | 58| 42.0k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (67:21): [True: 42.0k, False: 11.3k] ------------------ 68| 42.0k| vr0 = LOAD(&c0[i]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 69| 42.0k| vr1 = LOAD(&c1[i]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 70| 42.0k| vr2 = LOAD(&c2[i]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 71| 42.0k| vr3 = LOAD(&c3[i]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 72| 42.0k| vt = LOAD(&mid[i]); ------------------ | | 28| 42.0k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 73| | 74| 42.0k| STORE(&c1[i], vt ^ vr0 ^ vr1); ------------------ | | 29| 42.0k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 75| 42.0k| STORE(&c2[i], vt ^ vr2 ^ vr3); ------------------ | | 29| 42.0k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 76| 42.0k| } 77| 11.3k|} OQS_KEM_bike_l3_gf2x_red_avx2: 81| 181|{ 82| 181| const uint64_t *a64 = (const uint64_t *)a; 83| 181| uint64_t * c64 = (uint64_t *)c; 84| | 85| 17.7k| for(size_t i = 0; i < R_QWORDS; i += REG_QWORDS) { ------------------ | | 82| 17.7k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 17.7k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ for(size_t i = 0; i < R_QWORDS; i += REG_QWORDS) { ------------------ | | 58| 17.5k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (85:21): [True: 17.5k, False: 181] ------------------ 86| 17.5k| REG_T vt0 = LOAD(&a64[i]); ------------------ | | 26| 17.5k|# define REG_T __m256i ------------------ REG_T vt0 = LOAD(&a64[i]); ------------------ | | 28| 17.5k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 87| 17.5k| REG_T vt1 = LOAD(&a64[i + R_QWORDS]); ------------------ | | 26| 17.5k|# define REG_T __m256i ------------------ REG_T vt1 = LOAD(&a64[i + R_QWORDS]); ------------------ | | 28| 17.5k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 88| 17.5k| REG_T vt2 = LOAD(&a64[i + R_QWORDS - 1]); ------------------ | | 26| 17.5k|# define REG_T __m256i ------------------ REG_T vt2 = LOAD(&a64[i + R_QWORDS - 1]); ------------------ | | 28| 17.5k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 89| | 90| 17.5k| vt1 = SLLI_I64(vt1, LAST_R_QWORD_TRAIL); ------------------ | | 31| 17.5k|# define SLLI_I64(a, imm) _mm256_slli_epi64(a, imm) ------------------ 91| 17.5k| vt2 = SRLI_I64(vt2, LAST_R_QWORD_LEAD); ------------------ | | 32| 17.5k|# define SRLI_I64(a, imm) _mm256_srli_epi64(a, imm) ------------------ 92| | 93| 17.5k| vt0 ^= (vt1 | vt2); 94| | 95| 17.5k| STORE(&c64[i], vt0); ------------------ | | 29| 17.5k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 96| 17.5k| } 97| | 98| 181| c64[R_QWORDS - 1] &= LAST_R_QWORD_MASK; ------------------ | | 82| 181|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 181|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ c64[R_QWORDS - 1] &= LAST_R_QWORD_MASK; ------------------ | | 94| 181|#define LAST_R_QWORD_MASK MASK(LAST_R_QWORD_LEAD) | | ------------------ | | | | 43| 181|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 181|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 99| | 100| | // Clean the secrets from the upper part of c 101| 181| secure_clean((uint8_t *)&c64[R_QWORDS], ------------------ | | 33| 181|#define secure_clean OQS_MEM_cleanse ------------------ secure_clean((uint8_t *)&c64[R_QWORDS], ------------------ | | 82| 181|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 181|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 102| 181| (R_PADDED_QWORDS - R_QWORDS) * sizeof(uint64_t)); ------------------ | | 90| 181|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 181|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 181|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 181|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 56| 181|# define BLOCK_BITS 32768 | | | | ------------------ | | ------------------ ------------------ (R_PADDED_QWORDS - R_QWORDS) * sizeof(uint64_t)); ------------------ | | 82| 181|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 181|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 103| 181|} OQS_KEM_bike_l5_karatzuba_add1_avx2: 21| 30.6k|{ 22| 30.6k| assert(qwords_len % REG_QWORDS == 0); 23| | 24| 30.6k| REG_T va0, va1, vb0, vb1; ------------------ | | 26| 30.6k|# define REG_T __m256i ------------------ 25| | 26| 146k| for(size_t i = 0; i < qwords_len; i += REG_QWORDS) { ------------------ | | 58| 115k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (26:21): [True: 115k, False: 30.6k] ------------------ 27| 115k| va0 = LOAD(&a[i]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 28| 115k| va1 = LOAD(&a[i + qwords_len]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 29| 115k| vb0 = LOAD(&b[i]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 30| 115k| vb1 = LOAD(&b[i + qwords_len]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 31| | 32| 115k| STORE(&alah[i], va0 ^ va1); ------------------ | | 29| 115k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 33| 115k| STORE(&blbh[i], vb0 ^ vb1); ------------------ | | 29| 115k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 34| 115k| } 35| 30.6k|} OQS_KEM_bike_l5_karatzuba_add2_avx2: 41| 30.6k|{ 42| 30.6k| assert(qwords_len % REG_QWORDS == 0); 43| | 44| 30.6k| REG_T vx, vy; ------------------ | | 26| 30.6k|# define REG_T __m256i ------------------ 45| | 46| 146k| for(size_t i = 0; i < qwords_len; i += REG_QWORDS) { ------------------ | | 58| 115k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (46:21): [True: 115k, False: 30.6k] ------------------ 47| 115k| vx = LOAD(&x[i]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 48| 115k| vy = LOAD(&y[i]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 49| | 50| 115k| STORE(&z[i], vx ^ vy); ------------------ | | 29| 115k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 51| 115k| } 52| 30.6k|} OQS_KEM_bike_l5_karatzuba_add3_avx2: 57| 30.6k|{ 58| 30.6k| assert(qwords_len % REG_QWORDS == 0); 59| | 60| 30.6k| REG_T vr0, vr1, vr2, vr3, vt; ------------------ | | 26| 30.6k|# define REG_T __m256i ------------------ 61| | 62| 30.6k| uint64_t *c0 = c; 63| 30.6k| uint64_t *c1 = &c[qwords_len]; 64| 30.6k| uint64_t *c2 = &c[2 * qwords_len]; 65| 30.6k| uint64_t *c3 = &c[3 * qwords_len]; 66| | 67| 146k| for(size_t i = 0; i < qwords_len; i += REG_QWORDS) { ------------------ | | 58| 115k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (67:21): [True: 115k, False: 30.6k] ------------------ 68| 115k| vr0 = LOAD(&c0[i]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 69| 115k| vr1 = LOAD(&c1[i]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 70| 115k| vr2 = LOAD(&c2[i]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 71| 115k| vr3 = LOAD(&c3[i]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 72| 115k| vt = LOAD(&mid[i]); ------------------ | | 28| 115k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 73| | 74| 115k| STORE(&c1[i], vt ^ vr0 ^ vr1); ------------------ | | 29| 115k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 75| 115k| STORE(&c2[i], vt ^ vr2 ^ vr3); ------------------ | | 29| 115k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 76| 115k| } 77| 30.6k|} OQS_KEM_bike_l5_gf2x_red_avx2: 81| 179|{ 82| 179| const uint64_t *a64 = (const uint64_t *)a; 83| 179| uint64_t * c64 = (uint64_t *)c; 84| | 85| 28.9k| for(size_t i = 0; i < R_QWORDS; i += REG_QWORDS) { ------------------ | | 82| 28.9k|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 28.9k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ for(size_t i = 0; i < R_QWORDS; i += REG_QWORDS) { ------------------ | | 58| 28.8k|#define REG_QWORDS (sizeof(REG_T) / sizeof(uint64_t)) // NOLINT ------------------ | Branch (85:21): [True: 28.8k, False: 179] ------------------ 86| 28.8k| REG_T vt0 = LOAD(&a64[i]); ------------------ | | 26| 28.8k|# define REG_T __m256i ------------------ REG_T vt0 = LOAD(&a64[i]); ------------------ | | 28| 28.8k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 87| 28.8k| REG_T vt1 = LOAD(&a64[i + R_QWORDS]); ------------------ | | 26| 28.8k|# define REG_T __m256i ------------------ REG_T vt1 = LOAD(&a64[i + R_QWORDS]); ------------------ | | 28| 28.8k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 88| 28.8k| REG_T vt2 = LOAD(&a64[i + R_QWORDS - 1]); ------------------ | | 26| 28.8k|# define REG_T __m256i ------------------ REG_T vt2 = LOAD(&a64[i + R_QWORDS - 1]); ------------------ | | 28| 28.8k|# define LOAD(mem) _mm256_loadu_si256((const void *)(mem)) ------------------ 89| | 90| 28.8k| vt1 = SLLI_I64(vt1, LAST_R_QWORD_TRAIL); ------------------ | | 31| 28.8k|# define SLLI_I64(a, imm) _mm256_slli_epi64(a, imm) ------------------ 91| 28.8k| vt2 = SRLI_I64(vt2, LAST_R_QWORD_LEAD); ------------------ | | 32| 28.8k|# define SRLI_I64(a, imm) _mm256_srli_epi64(a, imm) ------------------ 92| | 93| 28.8k| vt0 ^= (vt1 | vt2); 94| | 95| 28.8k| STORE(&c64[i], vt0); ------------------ | | 29| 28.8k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 96| 28.8k| } 97| | 98| 179| c64[R_QWORDS - 1] &= LAST_R_QWORD_MASK; ------------------ | | 82| 179|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 179|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ c64[R_QWORDS - 1] &= LAST_R_QWORD_MASK; ------------------ | | 94| 179|#define LAST_R_QWORD_MASK MASK(LAST_R_QWORD_LEAD) | | ------------------ | | | | 43| 179|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 179|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 99| | 100| | // Clean the secrets from the upper part of c 101| 179| secure_clean((uint8_t *)&c64[R_QWORDS], ------------------ | | 33| 179|#define secure_clean OQS_MEM_cleanse ------------------ secure_clean((uint8_t *)&c64[R_QWORDS], ------------------ | | 82| 179|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 179|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 102| 179| (R_PADDED_QWORDS - R_QWORDS) * sizeof(uint64_t)); ------------------ | | 90| 179|#define R_PADDED_QWORDS (R_PADDED / 64) | | ------------------ | | | | 88| 179|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 179|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 179|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 71| 179|# define BLOCK_BITS 65536 | | | | ------------------ | | ------------------ ------------------ (R_PADDED_QWORDS - R_QWORDS) * sizeof(uint64_t)); ------------------ | | 82| 179|#define R_QWORDS DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_QWORD) | | ------------------ | | | | 37| 179|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 103| 179|} OQS_KEM_bike_l1_gf2x_mul_base_pclmul: 94| 35.8k|{ 95| 35.8k| __m128i va[4], vb[4]; 96| 35.8k| __m128i aa[2], bb[2]; 97| 35.8k| __m128i lo[4], hi[4], mi[4], m[2]; 98| | 99| 179k| for(size_t i = 0; i < 4; i++) { ------------------ | Branch (99:21): [True: 143k, False: 35.8k] ------------------ 100| 143k| va[i] = LOAD128(&a[QWORDS_IN_XMM * i]); ------------------ | | 12| 143k|#define LOAD128(mem) _mm_loadu_si128((const void *)(mem)) ------------------ 101| 143k| vb[i] = LOAD128(&b[QWORDS_IN_XMM * i]); ------------------ | | 12| 143k|#define LOAD128(mem) _mm_loadu_si128((const void *)(mem)) ------------------ 102| 143k| } 103| | 104| | // Multiply the low and the high halves of a and b 105| | // lo <-- a_lo * b_lo 106| | // hi <-- a_hi * b_hi 107| 35.8k| gf2x_mul4_int(lo, va[0], va[1], vb[0], vb[1]); 108| 35.8k| gf2x_mul4_int(hi, va[2], va[3], vb[2], vb[3]); 109| | 110| | // Compute the middle multiplication 111| | // aa <-- a_lo + a_hi 112| | // bb <-- b_lo + b_hi 113| | // mi <-- aa * bb 114| 35.8k| aa[0] = va[0] ^ va[2]; 115| 35.8k| aa[1] = va[1] ^ va[3]; 116| 35.8k| bb[0] = vb[0] ^ vb[2]; 117| 35.8k| bb[1] = vb[1] ^ vb[3]; 118| 35.8k| gf2x_mul4_int(mi, aa[0], aa[1], bb[0], bb[1]); 119| | 120| 35.8k| m[0] = lo[2] ^ hi[0]; 121| 35.8k| m[1] = lo[3] ^ hi[1]; 122| | 123| 35.8k| STORE128(&c[0 * QWORDS_IN_XMM], lo[0]); ------------------ | | 13| 35.8k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 124| 35.8k| STORE128(&c[1 * QWORDS_IN_XMM], lo[1]); ------------------ | | 13| 35.8k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 125| 35.8k| STORE128(&c[2 * QWORDS_IN_XMM], mi[0] ^ lo[0] ^ m[0]); ------------------ | | 13| 35.8k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 126| 35.8k| STORE128(&c[3 * QWORDS_IN_XMM], mi[1] ^ lo[1] ^ m[1]); ------------------ | | 13| 35.8k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 127| 35.8k| STORE128(&c[4 * QWORDS_IN_XMM], mi[2] ^ hi[2] ^ m[0]); ------------------ | | 13| 35.8k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 128| 35.8k| STORE128(&c[5 * QWORDS_IN_XMM], mi[3] ^ hi[3] ^ m[1]); ------------------ | | 13| 35.8k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 129| 35.8k| STORE128(&c[6 * QWORDS_IN_XMM], hi[2]); ------------------ | | 13| 35.8k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 130| 35.8k| STORE128(&c[7 * QWORDS_IN_XMM], hi[3]); ------------------ | | 13| 35.8k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 131| 35.8k|} OQS_KEM_bike_l1_gf2x_sqr_pclmul: 134| 810|{ 135| 810| __m128i va, vr0, vr1; 136| | 137| 810| const uint64_t *a64 = (const uint64_t *)a; 138| 810| uint64_t * c64 = (uint64_t *)c; 139| | 140| 79.3k| for(size_t i = 0; i < (R_XMM * QWORDS_IN_XMM); i += QWORDS_IN_XMM) { ------------------ | | 83| 79.3k|#define R_XMM DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_XMM) | | ------------------ | | | | 37| 79.3k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ for(size_t i = 0; i < (R_XMM * QWORDS_IN_XMM); i += QWORDS_IN_XMM) { ------------------ | | 60| 79.3k|#define QWORDS_IN_XMM (BYTES_IN_XMM / sizeof(uint64_t)) | | ------------------ | | | | 47| 79.3k|#define BYTES_IN_XMM 0x10 | | ------------------ ------------------ for(size_t i = 0; i < (R_XMM * QWORDS_IN_XMM); i += QWORDS_IN_XMM) { ------------------ | | 60| 78.5k|#define QWORDS_IN_XMM (BYTES_IN_XMM / sizeof(uint64_t)) | | ------------------ | | | | 47| 78.5k|#define BYTES_IN_XMM 0x10 | | ------------------ ------------------ | Branch (140:21): [True: 78.5k, False: 810] ------------------ 141| 78.5k| va = LOAD128(&a64[i]); ------------------ | | 12| 78.5k|#define LOAD128(mem) _mm_loadu_si128((const void *)(mem)) ------------------ 142| | 143| 78.5k| vr0 = CLMUL(va, va, 0x00); ------------------ | | 16| 78.5k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 144| 78.5k| vr1 = CLMUL(va, va, 0x11); ------------------ | | 16| 78.5k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 145| | 146| 78.5k| STORE128(&c64[i * 2], vr0); ------------------ | | 13| 78.5k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 147| 78.5k| STORE128(&c64[i * 2 + QWORDS_IN_XMM], vr1); ------------------ | | 13| 78.5k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 148| 78.5k| } 149| 810|} gf2x_mul_base_pclmul.c:gf2x_mul4_int: 26| 359k|{ 27| | // a_lo = [a1 | a0]; a_hi = [a3 | a2]; 28| | // b_lo = [b1 | b0]; b_hi = [b3 | b2]; 29| | // 4x4 Karatsuba requires three 2x2 multiplications: 30| | // (1) a_lo * b_lo 31| | // (2) a_hi * b_hi 32| | // (3) aa * bb = (a_lo + a_hi) * (b_lo + b_hi) 33| | // Each of the three 2x2 multiplications requires three 1x1 multiplications: 34| | // (1) is computed by a0*b0, a1*b1, (a0+a1)*(b0+b1) 35| | // (2) is computed by a2*b2, a3*b3, (a2+a3)*(b2+b3) 36| | // (3) is computed by aa0*bb0, aa1*bb1, (aa0+aa1)*(bb0+bb1) 37| | // All the required additions are performed in the end. 38| | 39| 359k| __m128i aa, bb; 40| 359k| __m128i xx, yy, uu, vv, m; 41| 359k| __m128i lo[2], hi[2], mi[2]; 42| 359k| __m128i t[9]; 43| | 44| 359k| aa = a_lo ^ a_hi; 45| 359k| bb = b_lo ^ b_hi; 46| | 47| | // xx <-- [(a2+a3) | (a0+a1)] 48| | // yy <-- [(b2+b3) | (b0+b1)] 49| 359k| xx = UNPACKLO(a_lo, a_hi); ------------------ | | 14| 359k|#define UNPACKLO(x, y) _mm_unpacklo_epi64((x), (y)) ------------------ 50| 359k| yy = UNPACKLO(b_lo, b_hi); ------------------ | | 14| 359k|#define UNPACKLO(x, y) _mm_unpacklo_epi64((x), (y)) ------------------ 51| 359k| xx = xx ^ UNPACKHI(a_lo, a_hi); ------------------ | | 15| 359k|#define UNPACKHI(x, y) _mm_unpackhi_epi64((x), (y)) ------------------ 52| 359k| yy = yy ^ UNPACKHI(b_lo, b_hi); ------------------ | | 15| 359k|#define UNPACKHI(x, y) _mm_unpackhi_epi64((x), (y)) ------------------ 53| | 54| | // uu <-- [ 0 | (aa0+aa1)] 55| | // vv <-- [ 0 | (bb0+bb1)] 56| 359k| uu = aa ^ BSRLI(aa, 8); ------------------ | | 17| 359k|#define BSRLI(x, imm) _mm_bsrli_si128((x), (imm)) ------------------ 57| 359k| vv = bb ^ BSRLI(bb, 8); ------------------ | | 17| 359k|#define BSRLI(x, imm) _mm_bsrli_si128((x), (imm)) ------------------ 58| | 59| | // 9 multiplications 60| 359k| t[0] = CLMUL(a_lo, b_lo, 0x00); ------------------ | | 16| 359k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 61| 359k| t[1] = CLMUL(a_lo, b_lo, 0x11); ------------------ | | 16| 359k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 62| 359k| t[2] = CLMUL(a_hi, b_hi, 0x00); ------------------ | | 16| 359k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 63| 359k| t[3] = CLMUL(a_hi, b_hi, 0x11); ------------------ | | 16| 359k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 64| 359k| t[4] = CLMUL(xx, yy, 0x00); ------------------ | | 16| 359k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 65| 359k| t[5] = CLMUL(xx, yy, 0x11); ------------------ | | 16| 359k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 66| 359k| t[6] = CLMUL(aa, bb, 0x00); ------------------ | | 16| 359k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 67| 359k| t[7] = CLMUL(aa, bb, 0x11); ------------------ | | 16| 359k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 68| 359k| t[8] = CLMUL(uu, vv, 0x00); ------------------ | | 16| 359k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 69| | 70| 359k| t[4] ^= (t[0] ^ t[1]); 71| 359k| t[5] ^= (t[2] ^ t[3]); 72| 359k| t[8] ^= (t[6] ^ t[7]); 73| | 74| 359k| lo[0] = t[0] ^ BSLLI(t[4], 8); ------------------ | | 18| 359k|#define BSLLI(x, imm) _mm_bslli_si128((x), (imm)) ------------------ 75| 359k| lo[1] = t[1] ^ BSRLI(t[4], 8); ------------------ | | 17| 359k|#define BSRLI(x, imm) _mm_bsrli_si128((x), (imm)) ------------------ 76| 359k| hi[0] = t[2] ^ BSLLI(t[5], 8); ------------------ | | 18| 359k|#define BSLLI(x, imm) _mm_bslli_si128((x), (imm)) ------------------ 77| 359k| hi[1] = t[3] ^ BSRLI(t[5], 8); ------------------ | | 17| 359k|#define BSRLI(x, imm) _mm_bsrli_si128((x), (imm)) ------------------ 78| 359k| mi[0] = t[6] ^ BSLLI(t[8], 8); ------------------ | | 18| 359k|#define BSLLI(x, imm) _mm_bslli_si128((x), (imm)) ------------------ 79| 359k| mi[1] = t[7] ^ BSRLI(t[8], 8); ------------------ | | 17| 359k|#define BSRLI(x, imm) _mm_bsrli_si128((x), (imm)) ------------------ 80| | 81| 359k| m = lo[1] ^ hi[0]; 82| | 83| 359k| c[0] = lo[0]; 84| 359k| c[1] = lo[0] ^ mi[0] ^ m; 85| 359k| c[2] = hi[1] ^ mi[1] ^ m; 86| 359k| c[3] = hi[1]; 87| 359k|} OQS_KEM_bike_l3_gf2x_mul_base_pclmul: 94| 22.7k|{ 95| 22.7k| __m128i va[4], vb[4]; 96| 22.7k| __m128i aa[2], bb[2]; 97| 22.7k| __m128i lo[4], hi[4], mi[4], m[2]; 98| | 99| 113k| for(size_t i = 0; i < 4; i++) { ------------------ | Branch (99:21): [True: 90.8k, False: 22.7k] ------------------ 100| 90.8k| va[i] = LOAD128(&a[QWORDS_IN_XMM * i]); ------------------ | | 12| 90.8k|#define LOAD128(mem) _mm_loadu_si128((const void *)(mem)) ------------------ 101| 90.8k| vb[i] = LOAD128(&b[QWORDS_IN_XMM * i]); ------------------ | | 12| 90.8k|#define LOAD128(mem) _mm_loadu_si128((const void *)(mem)) ------------------ 102| 90.8k| } 103| | 104| | // Multiply the low and the high halves of a and b 105| | // lo <-- a_lo * b_lo 106| | // hi <-- a_hi * b_hi 107| 22.7k| gf2x_mul4_int(lo, va[0], va[1], vb[0], vb[1]); 108| 22.7k| gf2x_mul4_int(hi, va[2], va[3], vb[2], vb[3]); 109| | 110| | // Compute the middle multiplication 111| | // aa <-- a_lo + a_hi 112| | // bb <-- b_lo + b_hi 113| | // mi <-- aa * bb 114| 22.7k| aa[0] = va[0] ^ va[2]; 115| 22.7k| aa[1] = va[1] ^ va[3]; 116| 22.7k| bb[0] = vb[0] ^ vb[2]; 117| 22.7k| bb[1] = vb[1] ^ vb[3]; 118| 22.7k| gf2x_mul4_int(mi, aa[0], aa[1], bb[0], bb[1]); 119| | 120| 22.7k| m[0] = lo[2] ^ hi[0]; 121| 22.7k| m[1] = lo[3] ^ hi[1]; 122| | 123| 22.7k| STORE128(&c[0 * QWORDS_IN_XMM], lo[0]); ------------------ | | 13| 22.7k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 124| 22.7k| STORE128(&c[1 * QWORDS_IN_XMM], lo[1]); ------------------ | | 13| 22.7k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 125| 22.7k| STORE128(&c[2 * QWORDS_IN_XMM], mi[0] ^ lo[0] ^ m[0]); ------------------ | | 13| 22.7k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 126| 22.7k| STORE128(&c[3 * QWORDS_IN_XMM], mi[1] ^ lo[1] ^ m[1]); ------------------ | | 13| 22.7k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 127| 22.7k| STORE128(&c[4 * QWORDS_IN_XMM], mi[2] ^ hi[2] ^ m[0]); ------------------ | | 13| 22.7k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 128| 22.7k| STORE128(&c[5 * QWORDS_IN_XMM], mi[3] ^ hi[3] ^ m[1]); ------------------ | | 13| 22.7k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 129| 22.7k| STORE128(&c[6 * QWORDS_IN_XMM], hi[2]); ------------------ | | 13| 22.7k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 130| 22.7k| STORE128(&c[7 * QWORDS_IN_XMM], hi[3]); ------------------ | | 13| 22.7k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 131| 22.7k|} OQS_KEM_bike_l3_gf2x_sqr_pclmul: 134| 146|{ 135| 146| __m128i va, vr0, vr1; 136| | 137| 146| const uint64_t *a64 = (const uint64_t *)a; 138| 146| uint64_t * c64 = (uint64_t *)c; 139| | 140| 28.3k| for(size_t i = 0; i < (R_XMM * QWORDS_IN_XMM); i += QWORDS_IN_XMM) { ------------------ | | 83| 28.3k|#define R_XMM DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_XMM) | | ------------------ | | | | 37| 28.3k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ for(size_t i = 0; i < (R_XMM * QWORDS_IN_XMM); i += QWORDS_IN_XMM) { ------------------ | | 60| 28.3k|#define QWORDS_IN_XMM (BYTES_IN_XMM / sizeof(uint64_t)) | | ------------------ | | | | 47| 28.3k|#define BYTES_IN_XMM 0x10 | | ------------------ ------------------ for(size_t i = 0; i < (R_XMM * QWORDS_IN_XMM); i += QWORDS_IN_XMM) { ------------------ | | 60| 28.1k|#define QWORDS_IN_XMM (BYTES_IN_XMM / sizeof(uint64_t)) | | ------------------ | | | | 47| 28.1k|#define BYTES_IN_XMM 0x10 | | ------------------ ------------------ | Branch (140:21): [True: 28.1k, False: 146] ------------------ 141| 28.1k| va = LOAD128(&a64[i]); ------------------ | | 12| 28.1k|#define LOAD128(mem) _mm_loadu_si128((const void *)(mem)) ------------------ 142| | 143| 28.1k| vr0 = CLMUL(va, va, 0x00); ------------------ | | 16| 28.1k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 144| 28.1k| vr1 = CLMUL(va, va, 0x11); ------------------ | | 16| 28.1k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 145| | 146| 28.1k| STORE128(&c64[i * 2], vr0); ------------------ | | 13| 28.1k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 147| 28.1k| STORE128(&c64[i * 2 + QWORDS_IN_XMM], vr1); ------------------ | | 13| 28.1k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 148| 28.1k| } 149| 146|} OQS_KEM_bike_l5_gf2x_mul_base_pclmul: 94| 61.2k|{ 95| 61.2k| __m128i va[4], vb[4]; 96| 61.2k| __m128i aa[2], bb[2]; 97| 61.2k| __m128i lo[4], hi[4], mi[4], m[2]; 98| | 99| 306k| for(size_t i = 0; i < 4; i++) { ------------------ | Branch (99:21): [True: 244k, False: 61.2k] ------------------ 100| 244k| va[i] = LOAD128(&a[QWORDS_IN_XMM * i]); ------------------ | | 12| 244k|#define LOAD128(mem) _mm_loadu_si128((const void *)(mem)) ------------------ 101| 244k| vb[i] = LOAD128(&b[QWORDS_IN_XMM * i]); ------------------ | | 12| 244k|#define LOAD128(mem) _mm_loadu_si128((const void *)(mem)) ------------------ 102| 244k| } 103| | 104| | // Multiply the low and the high halves of a and b 105| | // lo <-- a_lo * b_lo 106| | // hi <-- a_hi * b_hi 107| 61.2k| gf2x_mul4_int(lo, va[0], va[1], vb[0], vb[1]); 108| 61.2k| gf2x_mul4_int(hi, va[2], va[3], vb[2], vb[3]); 109| | 110| | // Compute the middle multiplication 111| | // aa <-- a_lo + a_hi 112| | // bb <-- b_lo + b_hi 113| | // mi <-- aa * bb 114| 61.2k| aa[0] = va[0] ^ va[2]; 115| 61.2k| aa[1] = va[1] ^ va[3]; 116| 61.2k| bb[0] = vb[0] ^ vb[2]; 117| 61.2k| bb[1] = vb[1] ^ vb[3]; 118| 61.2k| gf2x_mul4_int(mi, aa[0], aa[1], bb[0], bb[1]); 119| | 120| 61.2k| m[0] = lo[2] ^ hi[0]; 121| 61.2k| m[1] = lo[3] ^ hi[1]; 122| | 123| 61.2k| STORE128(&c[0 * QWORDS_IN_XMM], lo[0]); ------------------ | | 13| 61.2k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 124| 61.2k| STORE128(&c[1 * QWORDS_IN_XMM], lo[1]); ------------------ | | 13| 61.2k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 125| 61.2k| STORE128(&c[2 * QWORDS_IN_XMM], mi[0] ^ lo[0] ^ m[0]); ------------------ | | 13| 61.2k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 126| 61.2k| STORE128(&c[3 * QWORDS_IN_XMM], mi[1] ^ lo[1] ^ m[1]); ------------------ | | 13| 61.2k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 127| 61.2k| STORE128(&c[4 * QWORDS_IN_XMM], mi[2] ^ hi[2] ^ m[0]); ------------------ | | 13| 61.2k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 128| 61.2k| STORE128(&c[5 * QWORDS_IN_XMM], mi[3] ^ hi[3] ^ m[1]); ------------------ | | 13| 61.2k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 129| 61.2k| STORE128(&c[6 * QWORDS_IN_XMM], hi[2]); ------------------ | | 13| 61.2k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 130| 61.2k| STORE128(&c[7 * QWORDS_IN_XMM], hi[3]); ------------------ | | 13| 61.2k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 131| 61.2k|} OQS_KEM_bike_l5_gf2x_sqr_pclmul: 134| 143|{ 135| 143| __m128i va, vr0, vr1; 136| | 137| 143| const uint64_t *a64 = (const uint64_t *)a; 138| 143| uint64_t * c64 = (uint64_t *)c; 139| | 140| 46.0k| for(size_t i = 0; i < (R_XMM * QWORDS_IN_XMM); i += QWORDS_IN_XMM) { ------------------ | | 83| 46.0k|#define R_XMM DIVIDE_AND_CEIL(R_BITS, 8 * BYTES_IN_XMM) | | ------------------ | | | | 37| 46.0k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ for(size_t i = 0; i < (R_XMM * QWORDS_IN_XMM); i += QWORDS_IN_XMM) { ------------------ | | 60| 46.0k|#define QWORDS_IN_XMM (BYTES_IN_XMM / sizeof(uint64_t)) | | ------------------ | | | | 47| 46.0k|#define BYTES_IN_XMM 0x10 | | ------------------ ------------------ for(size_t i = 0; i < (R_XMM * QWORDS_IN_XMM); i += QWORDS_IN_XMM) { ------------------ | | 60| 45.9k|#define QWORDS_IN_XMM (BYTES_IN_XMM / sizeof(uint64_t)) | | ------------------ | | | | 47| 45.9k|#define BYTES_IN_XMM 0x10 | | ------------------ ------------------ | Branch (140:21): [True: 45.9k, False: 143] ------------------ 141| 45.9k| va = LOAD128(&a64[i]); ------------------ | | 12| 45.9k|#define LOAD128(mem) _mm_loadu_si128((const void *)(mem)) ------------------ 142| | 143| 45.9k| vr0 = CLMUL(va, va, 0x00); ------------------ | | 16| 45.9k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 144| 45.9k| vr1 = CLMUL(va, va, 0x11); ------------------ | | 16| 45.9k|#define CLMUL(x, y, imm) _mm_clmulepi64_si128((x), (y), (imm)) ------------------ 145| | 146| 45.9k| STORE128(&c64[i * 2], vr0); ------------------ | | 13| 45.9k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 147| 45.9k| STORE128(&c64[i * 2 + QWORDS_IN_XMM], vr1); ------------------ | | 13| 45.9k|#define STORE128(mem, reg) _mm_storeu_si128((void *)(mem), (reg)) ------------------ 148| 45.9k| } 149| 143|} OQS_KEM_bike_l1_keypair: 133| 5|{ 134| 5| DEFER_CLEANUP(aligned_sk_t l_sk = {0}, sk_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 135| | 136| | // The secret key is (h0, h1), 137| | // and the public key h=(h0^-1 * h1). 138| | // Padded structures are used internally, and are required by the 139| | // decoder and the gf2x multiplication. 140| 5| DEFER_CLEANUP(pad_r_t h0 = {0}, pad_r_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 141| 5| DEFER_CLEANUP(pad_r_t h1 = {0}, pad_r_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 142| 5| DEFER_CLEANUP(pad_r_t h0inv = {0}, pad_r_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 143| 5| DEFER_CLEANUP(pad_r_t h = {0}, pad_r_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 144| | 145| | // The randomness of the key generation 146| 5| DEFER_CLEANUP(seeds_t seeds = {0}, seeds_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 147| | 148| 5| get_seeds(&seeds); ------------------ | | 128| 5|#define get_seeds RENAME_FUNC_NAME(get_seeds) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 5| GUARD(generate_secret_key(&h0, &h1, ------------------ | | 17| 5| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 5|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 5] | | ------------------ ------------------ 150| 5| l_sk.wlist[0].val, l_sk.wlist[1].val, 151| 5| &seeds.seed[0])); 152| | 153| | // Generate sigma 154| 5| convert_seed_to_m_type(&l_sk.sigma, &seeds.seed[1]); 155| | 156| | // Calculate the public key 157| 5| gf2x_mod_inv(&h0inv, &h0); ------------------ | | 124| 5|#define gf2x_mod_inv RENAME_FUNC_NAME(gf2x_mod_inv) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 5| gf2x_mod_mul(&h, &h1, &h0inv); ------------------ | | 60| 5|#define gf2x_mod_mul RENAME_FUNC_NAME(gf2x_mod_mul) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 159| | 160| | // Fill the secret key data structure with contents - cancel the padding 161| 5| l_sk.bin[0] = h0.val; 162| 5| l_sk.bin[1] = h1.val; 163| 5| l_sk.pk = h.val; 164| | 165| | // Copy the data to the output buffers 166| 5| bike_memcpy(sk, &l_sk, sizeof(l_sk)); 167| 5| bike_memcpy(pk, &l_sk.pk, sizeof(l_sk.pk)); 168| | 169| 5| print("h: ", (uint64_t *)&l_sk.pk, R_BITS); 170| 5| print("h0: ", (uint64_t *)&l_sk.bin[0], R_BITS); 171| 5| print("h1: ", (uint64_t *)&l_sk.bin[1], R_BITS); 172| 5| print("h0 wlist:", (uint64_t *)&l_sk.wlist[0], SIZEOF_BITS(compressed_idx_d_t)); 173| 5| print("h1 wlist:", (uint64_t *)&l_sk.wlist[1], SIZEOF_BITS(compressed_idx_d_t)); 174| 5| print("sigma: ", (uint64_t *)l_sk.sigma.raw, M_BITS); 175| | 176| 5| return SUCCESS; ------------------ | | 12| 5|#define SUCCESS OQS_SUCCESS ------------------ 177| 5|} OQS_KEM_bike_l1_encaps: 185| 5|{ 186| | // Public values (they do not require cleanup on exit). 187| 5| pk_t l_pk; 188| 5| ct_t l_ct; 189| | 190| 5| DEFER_CLEANUP(m_t m, m_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 191| 5| DEFER_CLEANUP(ss_t l_ss, ss_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 192| 5| DEFER_CLEANUP(seeds_t seeds = {0}, seeds_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 193| 5| DEFER_CLEANUP(pad_e_t e, pad_e_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 194| | 195| | // Copy the data from the input buffer. This is required in order to avoid 196| | // alignment issues on non x86_64 processors. 197| 5| bike_memcpy(&l_pk, pk, sizeof(l_pk)); 198| | 199| 5| get_seeds(&seeds); ------------------ | | 128| 5|#define get_seeds RENAME_FUNC_NAME(get_seeds) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 200| | 201| | // e = H(m) = H(seed[0]) 202| 5| convert_seed_to_m_type(&m, &seeds.seed[0]); 203| 5| GUARD(function_h(&e, &m, &l_pk)); ------------------ | | 17| 5| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 5|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 5] | | ------------------ ------------------ 204| | 205| | // Calculate the ciphertext 206| 5| GUARD(encrypt(&l_ct, &e, &l_pk, &m)); ------------------ | | 17| 5| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 5|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 5] | | ------------------ ------------------ 207| | 208| | // Generate the shared secret 209| 5| GUARD(function_k(&l_ss, &m, &l_ct)); ------------------ | | 17| 5| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 5|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 5] | | ------------------ ------------------ 210| | 211| 5| print("ss: ", (uint64_t *)l_ss.raw, SIZEOF_BITS(l_ss)); 212| | 213| | // Copy the data to the output buffers 214| 5| bike_memcpy(ct, &l_ct, sizeof(l_ct)); 215| 5| bike_memcpy(ss, &l_ss, sizeof(l_ss)); 216| | 217| 5| return SUCCESS; ------------------ | | 12| 5|#define SUCCESS OQS_SUCCESS ------------------ 218| 5|} OQS_KEM_bike_l1_decaps: 226| 5|{ 227| | // Public values, does not require a cleanup on exit 228| 5| ct_t l_ct; 229| | 230| 5| DEFER_CLEANUP(ss_t l_ss, ss_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 231| 5| DEFER_CLEANUP(aligned_sk_t l_sk, sk_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 232| 5| DEFER_CLEANUP(e_t e, e_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 233| 5| DEFER_CLEANUP(m_t m_prime, m_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 234| 5| DEFER_CLEANUP(pad_e_t e_tmp, pad_e_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 235| 5| DEFER_CLEANUP(pad_e_t e_prime = {0}, pad_e_cleanup); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 236| | 237| | // Copy the data from the input buffers. This is required in order to avoid 238| | // alignment issues on non x86_64 processors. 239| 5| bike_memcpy(&l_ct, ct, sizeof(l_ct)); 240| 5| bike_memcpy(&l_sk, sk, sizeof(l_sk)); 241| | 242| | // Decode. 243| 5| decode(&e, &l_ct, &l_sk); ------------------ | | 57| 5|#define decode RENAME_FUNC_NAME(decode) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 244| | 245| | // Copy the error vector in the padded struct. 246| 5| e_prime.val[0].val = e.val[0]; 247| 5| e_prime.val[1].val = e.val[1]; 248| | 249| 5| GUARD(reencrypt(&m_prime, &e_prime, &l_ct)); ------------------ | | 17| 5| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 5|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 5] | | ------------------ ------------------ 250| | 251| | // Check if H(m') is equal to (e0', e1') 252| | // (in constant-time) 253| 5| GUARD(function_h(&e_tmp, &m_prime, &l_sk.pk)); ------------------ | | 17| 5| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 5|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 5] | | ------------------ ------------------ 254| 5| uint32_t success_cond; 255| 5| success_cond = secure_cmp(PE0_RAW(&e_prime), PE0_RAW(&e_tmp), R_BYTES); ------------------ | | 95| 5|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ success_cond = secure_cmp(PE0_RAW(&e_prime), PE0_RAW(&e_tmp), R_BYTES); ------------------ | | 95| 5|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ success_cond = secure_cmp(PE0_RAW(&e_prime), PE0_RAW(&e_tmp), R_BYTES); ------------------ | | 81| 5|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 5|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 256| 5| success_cond &= secure_cmp(PE1_RAW(&e_prime), PE1_RAW(&e_tmp), R_BYTES); ------------------ | | 96| 5|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ success_cond &= secure_cmp(PE1_RAW(&e_prime), PE1_RAW(&e_tmp), R_BYTES); ------------------ | | 96| 5|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ success_cond &= secure_cmp(PE1_RAW(&e_prime), PE1_RAW(&e_tmp), R_BYTES); ------------------ | | 81| 5|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 5|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 257| | 258| | // Compute either K(m', C) or K(sigma, C) based on the success condition 259| 5| uint32_t mask = secure_l32_mask(0, success_cond); 260| 165| for(size_t i = 0; i < M_BYTES; i++) { ------------------ | | 104| 165|#define M_BYTES (M_BITS / 8) | | ------------------ | | | | 103| 165|#define M_BITS 256 | | ------------------ ------------------ | Branch (260:21): [True: 160, False: 5] ------------------ 261| 160| m_prime.raw[i] &= u8_barrier(~mask); 262| 160| m_prime.raw[i] |= (u8_barrier(mask) & l_sk.sigma.raw[i]); 263| 160| } 264| | 265| | // Generate the shared secret 266| 5| GUARD(function_k(&l_ss, &m_prime, &l_ct)); ------------------ | | 17| 5| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 5|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 5] | | ------------------ ------------------ 267| | 268| | // Copy the data into the output buffer 269| 5| bike_memcpy(ss, &l_ss, sizeof(l_ss)); 270| | 271| 5| return SUCCESS; ------------------ | | 12| 5|#define SUCCESS OQS_SUCCESS ------------------ 272| 5|} kem.c:convert_seed_to_m_type: 18| 14|{ 19| 14| bike_static_assert(sizeof(*m) == sizeof(*seed), m_size_eq_seed_size); ------------------ | | 33| 14| typedef char static_assertion_##MSG[(COND) ? 1 : -1] BIKE_UNUSED_ATT ------------------ 20| 14| bike_memcpy(m->raw, seed->raw, sizeof(*m)); 21| 14|} kem.c:OQS_KEM_bike_l1_function_h: 31| 10|{ 32| 10| DEFER_CLEANUP(seed_t seed = {0}, seed_cleanup); ------------------ | | 16| 10| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 33| | // pk is unused parameter in this case so we do this to avoid 34| | // clang sanitizers complaining. 35| 10| (void)pk; 36| | 37| 10| convert_m_to_seed_type(&seed, m); 38| | 39| 10| return generate_error_vector(e, &seed); ------------------ | | 132| 10|#define generate_error_vector RENAME_FUNC_NAME(generate_error_vector) | | ------------------ | | | | 44| 10|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 10|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 10|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 40| 10|} kem.c:convert_m_to_seed_type: 24| 14|{ 25| 14| bike_static_assert(sizeof(*m) == sizeof(*seed), m_size_eq_seed_size); ------------------ | | 33| 14| typedef char static_assertion_##MSG[(COND) ? 1 : -1] BIKE_UNUSED_ATT ------------------ 26| 14| bike_memcpy(seed->raw, m->raw, sizeof(*seed)); 27| 14|} kem.c:encrypt: 86| 7|{ 87| | // Pad the public key and the ciphertext 88| 7| pad_r_t p_ct = {0}; 89| 7| pad_r_t p_pk = {0}; 90| 7| p_pk.val = *pk; 91| | 92| | // Generate the ciphertext 93| | // ct = pk * e1 + e0 94| 7| gf2x_mod_mul(&p_ct, &e->val[1], &p_pk); ------------------ | | 60| 7|#define gf2x_mod_mul RENAME_FUNC_NAME(gf2x_mod_mul) | | ------------------ | | | | 44| 7|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 7|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 7|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 95| 7| gf2x_mod_add(&p_ct, &p_ct, &e->val[0]); ------------------ | | 123| 7|#define gf2x_mod_add RENAME_FUNC_NAME(gf2x_mod_add) | | ------------------ | | | | 44| 7|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 7|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 7|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 96| | 97| 7| ct->c0 = p_ct.val; 98| | 99| | // c1 = L(e0, e1) 100| 7| GUARD(function_l(&ct->c1, e)); ------------------ | | 17| 7| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 7|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 7] | | ------------------ ------------------ 101| | 102| | // m xor L(e0, e1) 103| 231| for(size_t i = 0; i < sizeof(*m); i++) { ------------------ | Branch (103:21): [True: 224, False: 7] ------------------ 104| 224| ct->c1.raw[i] ^= m->raw[i]; 105| 224| } 106| | 107| 7| print("e0: ", (const uint64_t *)PE0_RAW(e), R_BITS); 108| 7| print("e1: ", (const uint64_t *)PE1_RAW(e), R_BITS); 109| 7| print("c0: ", (uint64_t *)ct->c0.raw, R_BITS); 110| 7| print("c1: ", (uint64_t *)ct->c1.raw, M_BITS); 111| | 112| 7| return SUCCESS; ------------------ | | 12| 7|#define SUCCESS OQS_SUCCESS ------------------ 113| 7|} kem.c:function_l: 44| 14|{ 45| 14| DEFER_CLEANUP(sha_dgst_t dgst = {0}, sha_dgst_cleanup); ------------------ | | 16| 14| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 46| 14| DEFER_CLEANUP(e_t tmp, e_cleanup); ------------------ | | 16| 14| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 47| | 48| | // Take the padding away 49| 14| tmp.val[0] = e->val[0].val; 50| 14| tmp.val[1] = e->val[1].val; 51| | 52| 14| GUARD(sha(&dgst, sizeof(tmp), (uint8_t *)&tmp)); ------------------ | | 17| 14| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 14|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 14] | | ------------------ ------------------ 53| | 54| | // Truncate the SHA384 digest to a 256-bits m_t 55| 14| bike_static_assert(sizeof(dgst) >= sizeof(*out), dgst_size_lt_m_size); ------------------ | | 33| 14| typedef char static_assertion_##MSG[(COND) ? 1 : -1] BIKE_UNUSED_ATT ------------------ 56| 14| bike_memcpy(out->raw, dgst.u.raw, sizeof(*out)); 57| | 58| 14| return SUCCESS; ------------------ | | 12| 14|#define SUCCESS OQS_SUCCESS ------------------ 59| 14|} kem.c:function_k: 63| 14|{ 64| 14| DEFER_CLEANUP(func_k_t tmp, func_k_cleanup); ------------------ | | 16| 14| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 65| 14| DEFER_CLEANUP(sha_dgst_t dgst = {0}, sha_dgst_cleanup); ------------------ | | 16| 14| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 66| | 67| | // Copy every element, padded to the nearest byte 68| 14| tmp.m = *m; 69| 14| tmp.c0 = ct->c0; 70| 14| tmp.c1 = ct->c1; 71| | 72| 14| GUARD(sha(&dgst, sizeof(tmp), (uint8_t *)&tmp)); ------------------ | | 17| 14| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 14|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 14] | | ------------------ ------------------ 73| | 74| | // Truncate the SHA384 digest to a 256-bits value 75| | // to subsequently use it as a seed. 76| 14| bike_static_assert(sizeof(dgst) >= sizeof(*out), dgst_size_lt_out_size); ------------------ | | 33| 14| typedef char static_assertion_##MSG[(COND) ? 1 : -1] BIKE_UNUSED_ATT ------------------ 77| 14| bike_memcpy(out->raw, dgst.u.raw, sizeof(*out)); 78| | 79| 14| return SUCCESS; ------------------ | | 12| 14|#define SUCCESS OQS_SUCCESS ------------------ 80| 14|} kem.c:reencrypt: 116| 7|{ 117| 7| DEFER_CLEANUP(m_t tmp, m_cleanup); ------------------ | | 16| 7| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 118| | 119| 7| GUARD(function_l(&tmp, e)); ------------------ | | 17| 7| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 7|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 7] | | ------------------ ------------------ 120| | 121| | // m' = c1 ^ L(e') 122| 231| for(size_t i = 0; i < sizeof(*m); i++) { ------------------ | Branch (122:21): [True: 224, False: 7] ------------------ 123| 224| m->raw[i] = tmp.raw[i] ^ l_ct->c1.raw[i]; 124| 224| } 125| | 126| 7| return SUCCESS; ------------------ | | 12| 7|#define SUCCESS OQS_SUCCESS ------------------ 127| 7|} OQS_KEM_bike_l3_keypair: 133| 1|{ 134| 1| DEFER_CLEANUP(aligned_sk_t l_sk = {0}, sk_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 135| | 136| | // The secret key is (h0, h1), 137| | // and the public key h=(h0^-1 * h1). 138| | // Padded structures are used internally, and are required by the 139| | // decoder and the gf2x multiplication. 140| 1| DEFER_CLEANUP(pad_r_t h0 = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 141| 1| DEFER_CLEANUP(pad_r_t h1 = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 142| 1| DEFER_CLEANUP(pad_r_t h0inv = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 143| 1| DEFER_CLEANUP(pad_r_t h = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 144| | 145| | // The randomness of the key generation 146| 1| DEFER_CLEANUP(seeds_t seeds = {0}, seeds_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 147| | 148| 1| get_seeds(&seeds); ------------------ | | 128| 1|#define get_seeds RENAME_FUNC_NAME(get_seeds) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 1| GUARD(generate_secret_key(&h0, &h1, ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 150| 1| l_sk.wlist[0].val, l_sk.wlist[1].val, 151| 1| &seeds.seed[0])); 152| | 153| | // Generate sigma 154| 1| convert_seed_to_m_type(&l_sk.sigma, &seeds.seed[1]); 155| | 156| | // Calculate the public key 157| 1| gf2x_mod_inv(&h0inv, &h0); ------------------ | | 124| 1|#define gf2x_mod_inv RENAME_FUNC_NAME(gf2x_mod_inv) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 1| gf2x_mod_mul(&h, &h1, &h0inv); ------------------ | | 60| 1|#define gf2x_mod_mul RENAME_FUNC_NAME(gf2x_mod_mul) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 159| | 160| | // Fill the secret key data structure with contents - cancel the padding 161| 1| l_sk.bin[0] = h0.val; 162| 1| l_sk.bin[1] = h1.val; 163| 1| l_sk.pk = h.val; 164| | 165| | // Copy the data to the output buffers 166| 1| bike_memcpy(sk, &l_sk, sizeof(l_sk)); 167| 1| bike_memcpy(pk, &l_sk.pk, sizeof(l_sk.pk)); 168| | 169| 1| print("h: ", (uint64_t *)&l_sk.pk, R_BITS); 170| 1| print("h0: ", (uint64_t *)&l_sk.bin[0], R_BITS); 171| 1| print("h1: ", (uint64_t *)&l_sk.bin[1], R_BITS); 172| 1| print("h0 wlist:", (uint64_t *)&l_sk.wlist[0], SIZEOF_BITS(compressed_idx_d_t)); 173| 1| print("h1 wlist:", (uint64_t *)&l_sk.wlist[1], SIZEOF_BITS(compressed_idx_d_t)); 174| 1| print("sigma: ", (uint64_t *)l_sk.sigma.raw, M_BITS); 175| | 176| 1| return SUCCESS; ------------------ | | 12| 1|#define SUCCESS OQS_SUCCESS ------------------ 177| 1|} OQS_KEM_bike_l3_encaps: 185| 1|{ 186| | // Public values (they do not require cleanup on exit). 187| 1| pk_t l_pk; 188| 1| ct_t l_ct; 189| | 190| 1| DEFER_CLEANUP(m_t m, m_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 191| 1| DEFER_CLEANUP(ss_t l_ss, ss_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 192| 1| DEFER_CLEANUP(seeds_t seeds = {0}, seeds_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 193| 1| DEFER_CLEANUP(pad_e_t e, pad_e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 194| | 195| | // Copy the data from the input buffer. This is required in order to avoid 196| | // alignment issues on non x86_64 processors. 197| 1| bike_memcpy(&l_pk, pk, sizeof(l_pk)); 198| | 199| 1| get_seeds(&seeds); ------------------ | | 128| 1|#define get_seeds RENAME_FUNC_NAME(get_seeds) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 200| | 201| | // e = H(m) = H(seed[0]) 202| 1| convert_seed_to_m_type(&m, &seeds.seed[0]); 203| 1| GUARD(function_h(&e, &m, &l_pk)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 204| | 205| | // Calculate the ciphertext 206| 1| GUARD(encrypt(&l_ct, &e, &l_pk, &m)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 207| | 208| | // Generate the shared secret 209| 1| GUARD(function_k(&l_ss, &m, &l_ct)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 210| | 211| 1| print("ss: ", (uint64_t *)l_ss.raw, SIZEOF_BITS(l_ss)); 212| | 213| | // Copy the data to the output buffers 214| 1| bike_memcpy(ct, &l_ct, sizeof(l_ct)); 215| 1| bike_memcpy(ss, &l_ss, sizeof(l_ss)); 216| | 217| 1| return SUCCESS; ------------------ | | 12| 1|#define SUCCESS OQS_SUCCESS ------------------ 218| 1|} OQS_KEM_bike_l3_decaps: 226| 1|{ 227| | // Public values, does not require a cleanup on exit 228| 1| ct_t l_ct; 229| | 230| 1| DEFER_CLEANUP(ss_t l_ss, ss_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 231| 1| DEFER_CLEANUP(aligned_sk_t l_sk, sk_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 232| 1| DEFER_CLEANUP(e_t e, e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 233| 1| DEFER_CLEANUP(m_t m_prime, m_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 234| 1| DEFER_CLEANUP(pad_e_t e_tmp, pad_e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 235| 1| DEFER_CLEANUP(pad_e_t e_prime = {0}, pad_e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 236| | 237| | // Copy the data from the input buffers. This is required in order to avoid 238| | // alignment issues on non x86_64 processors. 239| 1| bike_memcpy(&l_ct, ct, sizeof(l_ct)); 240| 1| bike_memcpy(&l_sk, sk, sizeof(l_sk)); 241| | 242| | // Decode. 243| 1| decode(&e, &l_ct, &l_sk); ------------------ | | 57| 1|#define decode RENAME_FUNC_NAME(decode) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 244| | 245| | // Copy the error vector in the padded struct. 246| 1| e_prime.val[0].val = e.val[0]; 247| 1| e_prime.val[1].val = e.val[1]; 248| | 249| 1| GUARD(reencrypt(&m_prime, &e_prime, &l_ct)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 250| | 251| | // Check if H(m') is equal to (e0', e1') 252| | // (in constant-time) 253| 1| GUARD(function_h(&e_tmp, &m_prime, &l_sk.pk)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 254| 1| uint32_t success_cond; 255| 1| success_cond = secure_cmp(PE0_RAW(&e_prime), PE0_RAW(&e_tmp), R_BYTES); ------------------ | | 95| 1|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ success_cond = secure_cmp(PE0_RAW(&e_prime), PE0_RAW(&e_tmp), R_BYTES); ------------------ | | 95| 1|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ success_cond = secure_cmp(PE0_RAW(&e_prime), PE0_RAW(&e_tmp), R_BYTES); ------------------ | | 81| 1|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 1|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 256| 1| success_cond &= secure_cmp(PE1_RAW(&e_prime), PE1_RAW(&e_tmp), R_BYTES); ------------------ | | 96| 1|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ success_cond &= secure_cmp(PE1_RAW(&e_prime), PE1_RAW(&e_tmp), R_BYTES); ------------------ | | 96| 1|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ success_cond &= secure_cmp(PE1_RAW(&e_prime), PE1_RAW(&e_tmp), R_BYTES); ------------------ | | 81| 1|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 1|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 257| | 258| | // Compute either K(m', C) or K(sigma, C) based on the success condition 259| 1| uint32_t mask = secure_l32_mask(0, success_cond); 260| 33| for(size_t i = 0; i < M_BYTES; i++) { ------------------ | | 104| 33|#define M_BYTES (M_BITS / 8) | | ------------------ | | | | 103| 33|#define M_BITS 256 | | ------------------ ------------------ | Branch (260:21): [True: 32, False: 1] ------------------ 261| 32| m_prime.raw[i] &= u8_barrier(~mask); 262| 32| m_prime.raw[i] |= (u8_barrier(mask) & l_sk.sigma.raw[i]); 263| 32| } 264| | 265| | // Generate the shared secret 266| 1| GUARD(function_k(&l_ss, &m_prime, &l_ct)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 267| | 268| | // Copy the data into the output buffer 269| 1| bike_memcpy(ss, &l_ss, sizeof(l_ss)); 270| | 271| 1| return SUCCESS; ------------------ | | 12| 1|#define SUCCESS OQS_SUCCESS ------------------ 272| 1|} kem.c:OQS_KEM_bike_l3_function_h: 31| 2|{ 32| 2| DEFER_CLEANUP(seed_t seed = {0}, seed_cleanup); ------------------ | | 16| 2| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 33| | // pk is unused parameter in this case so we do this to avoid 34| | // clang sanitizers complaining. 35| 2| (void)pk; 36| | 37| 2| convert_m_to_seed_type(&seed, m); 38| | 39| 2| return generate_error_vector(e, &seed); ------------------ | | 132| 2|#define generate_error_vector RENAME_FUNC_NAME(generate_error_vector) | | ------------------ | | | | 44| 2|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 40| 2|} OQS_KEM_bike_l5_keypair: 133| 1|{ 134| 1| DEFER_CLEANUP(aligned_sk_t l_sk = {0}, sk_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 135| | 136| | // The secret key is (h0, h1), 137| | // and the public key h=(h0^-1 * h1). 138| | // Padded structures are used internally, and are required by the 139| | // decoder and the gf2x multiplication. 140| 1| DEFER_CLEANUP(pad_r_t h0 = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 141| 1| DEFER_CLEANUP(pad_r_t h1 = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 142| 1| DEFER_CLEANUP(pad_r_t h0inv = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 143| 1| DEFER_CLEANUP(pad_r_t h = {0}, pad_r_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 144| | 145| | // The randomness of the key generation 146| 1| DEFER_CLEANUP(seeds_t seeds = {0}, seeds_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 147| | 148| 1| get_seeds(&seeds); ------------------ | | 128| 1|#define get_seeds RENAME_FUNC_NAME(get_seeds) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 1| GUARD(generate_secret_key(&h0, &h1, ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 150| 1| l_sk.wlist[0].val, l_sk.wlist[1].val, 151| 1| &seeds.seed[0])); 152| | 153| | // Generate sigma 154| 1| convert_seed_to_m_type(&l_sk.sigma, &seeds.seed[1]); 155| | 156| | // Calculate the public key 157| 1| gf2x_mod_inv(&h0inv, &h0); ------------------ | | 124| 1|#define gf2x_mod_inv RENAME_FUNC_NAME(gf2x_mod_inv) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 1| gf2x_mod_mul(&h, &h1, &h0inv); ------------------ | | 60| 1|#define gf2x_mod_mul RENAME_FUNC_NAME(gf2x_mod_mul) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 159| | 160| | // Fill the secret key data structure with contents - cancel the padding 161| 1| l_sk.bin[0] = h0.val; 162| 1| l_sk.bin[1] = h1.val; 163| 1| l_sk.pk = h.val; 164| | 165| | // Copy the data to the output buffers 166| 1| bike_memcpy(sk, &l_sk, sizeof(l_sk)); 167| 1| bike_memcpy(pk, &l_sk.pk, sizeof(l_sk.pk)); 168| | 169| 1| print("h: ", (uint64_t *)&l_sk.pk, R_BITS); 170| 1| print("h0: ", (uint64_t *)&l_sk.bin[0], R_BITS); 171| 1| print("h1: ", (uint64_t *)&l_sk.bin[1], R_BITS); 172| 1| print("h0 wlist:", (uint64_t *)&l_sk.wlist[0], SIZEOF_BITS(compressed_idx_d_t)); 173| 1| print("h1 wlist:", (uint64_t *)&l_sk.wlist[1], SIZEOF_BITS(compressed_idx_d_t)); 174| 1| print("sigma: ", (uint64_t *)l_sk.sigma.raw, M_BITS); 175| | 176| 1| return SUCCESS; ------------------ | | 12| 1|#define SUCCESS OQS_SUCCESS ------------------ 177| 1|} OQS_KEM_bike_l5_encaps: 185| 1|{ 186| | // Public values (they do not require cleanup on exit). 187| 1| pk_t l_pk; 188| 1| ct_t l_ct; 189| | 190| 1| DEFER_CLEANUP(m_t m, m_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 191| 1| DEFER_CLEANUP(ss_t l_ss, ss_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 192| 1| DEFER_CLEANUP(seeds_t seeds = {0}, seeds_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 193| 1| DEFER_CLEANUP(pad_e_t e, pad_e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 194| | 195| | // Copy the data from the input buffer. This is required in order to avoid 196| | // alignment issues on non x86_64 processors. 197| 1| bike_memcpy(&l_pk, pk, sizeof(l_pk)); 198| | 199| 1| get_seeds(&seeds); ------------------ | | 128| 1|#define get_seeds RENAME_FUNC_NAME(get_seeds) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 200| | 201| | // e = H(m) = H(seed[0]) 202| 1| convert_seed_to_m_type(&m, &seeds.seed[0]); 203| 1| GUARD(function_h(&e, &m, &l_pk)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 204| | 205| | // Calculate the ciphertext 206| 1| GUARD(encrypt(&l_ct, &e, &l_pk, &m)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 207| | 208| | // Generate the shared secret 209| 1| GUARD(function_k(&l_ss, &m, &l_ct)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 210| | 211| 1| print("ss: ", (uint64_t *)l_ss.raw, SIZEOF_BITS(l_ss)); 212| | 213| | // Copy the data to the output buffers 214| 1| bike_memcpy(ct, &l_ct, sizeof(l_ct)); 215| 1| bike_memcpy(ss, &l_ss, sizeof(l_ss)); 216| | 217| 1| return SUCCESS; ------------------ | | 12| 1|#define SUCCESS OQS_SUCCESS ------------------ 218| 1|} OQS_KEM_bike_l5_decaps: 226| 1|{ 227| | // Public values, does not require a cleanup on exit 228| 1| ct_t l_ct; 229| | 230| 1| DEFER_CLEANUP(ss_t l_ss, ss_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 231| 1| DEFER_CLEANUP(aligned_sk_t l_sk, sk_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 232| 1| DEFER_CLEANUP(e_t e, e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 233| 1| DEFER_CLEANUP(m_t m_prime, m_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 234| 1| DEFER_CLEANUP(pad_e_t e_tmp, pad_e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 235| 1| DEFER_CLEANUP(pad_e_t e_prime = {0}, pad_e_cleanup); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 236| | 237| | // Copy the data from the input buffers. This is required in order to avoid 238| | // alignment issues on non x86_64 processors. 239| 1| bike_memcpy(&l_ct, ct, sizeof(l_ct)); 240| 1| bike_memcpy(&l_sk, sk, sizeof(l_sk)); 241| | 242| | // Decode. 243| 1| decode(&e, &l_ct, &l_sk); ------------------ | | 57| 1|#define decode RENAME_FUNC_NAME(decode) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 244| | 245| | // Copy the error vector in the padded struct. 246| 1| e_prime.val[0].val = e.val[0]; 247| 1| e_prime.val[1].val = e.val[1]; 248| | 249| 1| GUARD(reencrypt(&m_prime, &e_prime, &l_ct)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 250| | 251| | // Check if H(m') is equal to (e0', e1') 252| | // (in constant-time) 253| 1| GUARD(function_h(&e_tmp, &m_prime, &l_sk.pk)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 254| 1| uint32_t success_cond; 255| 1| success_cond = secure_cmp(PE0_RAW(&e_prime), PE0_RAW(&e_tmp), R_BYTES); ------------------ | | 95| 1|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ success_cond = secure_cmp(PE0_RAW(&e_prime), PE0_RAW(&e_tmp), R_BYTES); ------------------ | | 95| 1|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ success_cond = secure_cmp(PE0_RAW(&e_prime), PE0_RAW(&e_tmp), R_BYTES); ------------------ | | 81| 1|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 1|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 256| 1| success_cond &= secure_cmp(PE1_RAW(&e_prime), PE1_RAW(&e_tmp), R_BYTES); ------------------ | | 96| 1|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ success_cond &= secure_cmp(PE1_RAW(&e_prime), PE1_RAW(&e_tmp), R_BYTES); ------------------ | | 96| 1|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ success_cond &= secure_cmp(PE1_RAW(&e_prime), PE1_RAW(&e_tmp), R_BYTES); ------------------ | | 81| 1|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 1|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 257| | 258| | // Compute either K(m', C) or K(sigma, C) based on the success condition 259| 1| uint32_t mask = secure_l32_mask(0, success_cond); 260| 33| for(size_t i = 0; i < M_BYTES; i++) { ------------------ | | 104| 33|#define M_BYTES (M_BITS / 8) | | ------------------ | | | | 103| 33|#define M_BITS 256 | | ------------------ ------------------ | Branch (260:21): [True: 32, False: 1] ------------------ 261| 32| m_prime.raw[i] &= u8_barrier(~mask); 262| 32| m_prime.raw[i] |= (u8_barrier(mask) & l_sk.sigma.raw[i]); 263| 32| } 264| | 265| | // Generate the shared secret 266| 1| GUARD(function_k(&l_ss, &m_prime, &l_ct)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 267| | 268| | // Copy the data into the output buffer 269| 1| bike_memcpy(ss, &l_ss, sizeof(l_ss)); 270| | 271| 1| return SUCCESS; ------------------ | | 12| 1|#define SUCCESS OQS_SUCCESS ------------------ 272| 1|} kem.c:OQS_KEM_bike_l5_function_h: 31| 2|{ 32| 2| DEFER_CLEANUP(seed_t seed = {0}, seed_cleanup); ------------------ | | 16| 2| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 33| | // pk is unused parameter in this case so we do this to avoid 34| | // clang sanitizers complaining. 35| 2| (void)pk; 36| | 37| 2| convert_m_to_seed_type(&seed, m); 38| | 39| 2| return generate_error_vector(e, &seed); ------------------ | | 132| 2|#define generate_error_vector RENAME_FUNC_NAME(generate_error_vector) | | ------------------ | | | | 44| 2|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 40| 2|} OQS_KEM_bike_l1_get_seeds: 17| 10|{ 18| 10| OQS_randombytes((uint8_t *)seeds, NUM_OF_SEEDS * sizeof(seed_t)); ------------------ | | 76| 10|#define NUM_OF_SEEDS 2 ------------------ 19| | 20| 30| for(uint32_t i = 0; i < NUM_OF_SEEDS; ++i) { ------------------ | | 76| 30|#define NUM_OF_SEEDS 2 ------------------ | Branch (20:23): [True: 20, False: 10] ------------------ 21| 20| print("s: ", (uint64_t *)&seeds->seed[i], SIZEOF_BITS(seed_t)); 22| 20| } 23| 10|} OQS_KEM_bike_l1_sample_indices_fisher_yates: 60| 20| IN OUT prf_state_t *prf_state) { 61| | 62| 2.07k| for (size_t i = num_indices; i-- > 0;) { ------------------ | Branch (62:34): [True: 2.05k, False: 20] ------------------ 63| 2.05k|#define CWW_RAND_BYTES 4 64| 2.05k| uint64_t rand = 0ULL; 65| 2.05k| GUARD(get_prf_output((uint8_t *)&rand, prf_state, CWW_RAND_BYTES)); ------------------ | | 17| 2.05k| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 2.05k|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 2.05k] | | ------------------ ------------------ 66| 2.05k| rand *= (max_idx_val - i); 67| | 68| | // new index l is such that i <= l < max_idx_val 69| 2.05k| uint32_t l = i + (uint32_t)(rand >> (CWW_RAND_BYTES * 8)); ------------------ | | 63| 2.05k|#define CWW_RAND_BYTES 4 ------------------ 70| | 71| | // Loop over (the end of) the output array to determine if l is a duplicate 72| 2.05k| uint32_t is_dup = 0; 73| 116k| for (size_t j = i + 1; j < num_indices; ++j) { ------------------ | Branch (73:32): [True: 113k, False: 2.05k] ------------------ 74| 113k| is_dup |= secure_cmp32(l, out[j]); 75| 113k| } 76| | 77| | // if l is a duplicate out[i] gets i else out[i] gets l 78| | // mask is all 1 if l is a duplicate, all 0 else 79| 2.05k| uint32_t mask = -is_dup; 80| 2.05k| out[i] = (mask & i) ^ (~mask & l); 81| 2.05k| } 82| | 83| 20| return SUCCESS; ------------------ | | 12| 20|#define SUCCESS OQS_SUCCESS ------------------ 84| 20|} OQS_KEM_bike_l1_generate_secret_key: 105| 5|{ 106| | // Initialize the sampling context. 107| 5| sampling_ctx ctx = {0}; 108| 5| sampling_ctx_init(&ctx); ------------------ | | 138| 5|#define sampling_ctx_init RENAME_FUNC_NAME(sampling_ctx_init) | | ------------------ | | | | 44| 5|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 5|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 5|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 109| | 110| 5| DEFER_CLEANUP(prf_state_t prf_state = {0}, clean_prf_state); ------------------ | | 16| 5| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 111| | 112| 5| GUARD(init_prf_state(&prf_state, MAX_PRF_INVOCATION, seed)); ------------------ | | 17| 5| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 5|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 5] | | ------------------ ------------------ 113| | 114| 5| GUARD(generate_sparse_rep_for_sk(h0, h0_wlist, &prf_state, &ctx)); ------------------ | | 17| 5| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 5|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 5] | | ------------------ ------------------ 115| 5| GUARD(generate_sparse_rep_for_sk(h1, h1_wlist, &prf_state, &ctx)); ------------------ | | 17| 5| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 5|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 5] | | ------------------ ------------------ 116| | 117| 5| return SUCCESS; ------------------ | | 12| 5|#define SUCCESS OQS_SUCCESS ------------------ 118| 5|} OQS_KEM_bike_l1_generate_error_vector: 121| 10|{ 122| | // Initialize the sampling context. 123| 10| sampling_ctx ctx; 124| 10| sampling_ctx_init(&ctx); ------------------ | | 138| 10|#define sampling_ctx_init RENAME_FUNC_NAME(sampling_ctx_init) | | ------------------ | | | | 44| 10|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 10|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 10|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 125| | 126| 10| DEFER_CLEANUP(prf_state_t prf_state = {0}, clean_prf_state); ------------------ | | 16| 10| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 127| | 128| 10| GUARD(init_prf_state(&prf_state, MAX_PRF_INVOCATION, seed)); ------------------ | | 17| 10| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 10|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 10] | | ------------------ ------------------ 129| | 130| 10| idx_t wlist[T]; 131| 10| GUARD(sample_indices_fisher_yates(wlist, T, N_BITS, &prf_state)); ------------------ | | 17| 10| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 10|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 10] | | ------------------ ------------------ 132| | 133| | // (e0, e1) hold bits 0..R_BITS-1 and R_BITS..2*R_BITS-1 of the error, resp. 134| 10| ctx.secure_set_bits(&e->val[0], 0, wlist, T); ------------------ | | 61| 10|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 10|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 10|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 10|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx.secure_set_bits(&e->val[0], 0, wlist, T); ------------------ | | 25| 10|# define T 134 ------------------ 135| 10| ctx.secure_set_bits(&e->val[1], R_BITS, wlist, T); ------------------ | | 61| 10|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 10|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 10|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 10|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx.secure_set_bits(&e->val[1], R_BITS, wlist, T); ------------------ | | 23| 10|# define R_BITS 12323 ------------------ ctx.secure_set_bits(&e->val[1], R_BITS, wlist, T); ------------------ | | 25| 10|# define T 134 ------------------ 136| | 137| | // Clean the padding of the elements. 138| 10| PE0_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 95| 10|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ PE0_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 81| 10|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 10|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ PE0_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 98| 10|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 10|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 10|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 139| 10| PE1_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 96| 10|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ PE1_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 81| 10|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 10|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ PE1_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 98| 10|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 10|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 10|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 140| 10| bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 95| 10|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 10|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 10|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 89| 10|#define R_PADDED_BYTES (R_PADDED / 8) | | ------------------ | | | | 88| 10|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 10|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 10|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 40| 10|# define BLOCK_BITS 16384 | | | | ------------------ | | ------------------ ------------------ bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 10|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 10|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 141| 10| bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 96| 10|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 10|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 10|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 89| 10|#define R_PADDED_BYTES (R_PADDED / 8) | | ------------------ | | | | 88| 10|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 10|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 10|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 40| 10|# define BLOCK_BITS 16384 | | | | ------------------ | | ------------------ ------------------ bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 10|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 10|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 142| | 143| 10| secure_clean((uint8_t *)wlist, sizeof(wlist)); ------------------ | | 33| 10|#define secure_clean OQS_MEM_cleanse ------------------ 144| | 145| 10| return SUCCESS; ------------------ | | 12| 10|#define SUCCESS OQS_SUCCESS ------------------ 146| 10|} sampling.c:OQS_KEM_bike_l1_generate_sparse_rep_for_sk: 90| 10|{ 91| 10| idx_t wlist_temp[D] = {0}; 92| | 93| 10| GUARD(sample_indices_fisher_yates(wlist_temp, D, R_BITS, prf_state)); ------------------ | | 17| 10| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 10|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 10] | | ------------------ ------------------ 94| | 95| 10| bike_memcpy(wlist, wlist_temp, D * sizeof(idx_t)); ------------------ | | 24| 10|# define D 71 ------------------ 96| 10| ctx->secure_set_bits(r, 0, wlist, D); ------------------ | | 61| 10|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 10|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 10|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 10|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits(r, 0, wlist, D); ------------------ | | 24| 10|# define D 71 ------------------ 97| | 98| 10| secure_clean((uint8_t *)wlist_temp, sizeof(wlist_temp)); ------------------ | | 33| 10|#define secure_clean OQS_MEM_cleanse ------------------ 99| 10| return SUCCESS; ------------------ | | 12| 10|#define SUCCESS OQS_SUCCESS ------------------ 100| 10|} OQS_KEM_bike_l3_get_seeds: 17| 2|{ 18| 2| OQS_randombytes((uint8_t *)seeds, NUM_OF_SEEDS * sizeof(seed_t)); ------------------ | | 76| 2|#define NUM_OF_SEEDS 2 ------------------ 19| | 20| 6| for(uint32_t i = 0; i < NUM_OF_SEEDS; ++i) { ------------------ | | 76| 6|#define NUM_OF_SEEDS 2 ------------------ | Branch (20:23): [True: 4, False: 2] ------------------ 21| 4| print("s: ", (uint64_t *)&seeds->seed[i], SIZEOF_BITS(seed_t)); 22| 4| } 23| 2|} OQS_KEM_bike_l3_sample_indices_fisher_yates: 60| 4| IN OUT prf_state_t *prf_state) { 61| | 62| 608| for (size_t i = num_indices; i-- > 0;) { ------------------ | Branch (62:34): [True: 604, False: 4] ------------------ 63| 604|#define CWW_RAND_BYTES 4 64| 604| uint64_t rand = 0ULL; 65| 604| GUARD(get_prf_output((uint8_t *)&rand, prf_state, CWW_RAND_BYTES)); ------------------ | | 17| 604| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 604|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 604] | | ------------------ ------------------ 66| 604| rand *= (max_idx_val - i); 67| | 68| | // new index l is such that i <= l < max_idx_val 69| 604| uint32_t l = i + (uint32_t)(rand >> (CWW_RAND_BYTES * 8)); ------------------ | | 63| 604|#define CWW_RAND_BYTES 4 ------------------ 70| | 71| | // Loop over (the end of) the output array to determine if l is a duplicate 72| 604| uint32_t is_dup = 0; 73| 50.5k| for (size_t j = i + 1; j < num_indices; ++j) { ------------------ | Branch (73:32): [True: 49.9k, False: 604] ------------------ 74| 49.9k| is_dup |= secure_cmp32(l, out[j]); 75| 49.9k| } 76| | 77| | // if l is a duplicate out[i] gets i else out[i] gets l 78| | // mask is all 1 if l is a duplicate, all 0 else 79| 604| uint32_t mask = -is_dup; 80| 604| out[i] = (mask & i) ^ (~mask & l); 81| 604| } 82| | 83| 4| return SUCCESS; ------------------ | | 12| 4|#define SUCCESS OQS_SUCCESS ------------------ 84| 4|} OQS_KEM_bike_l3_generate_secret_key: 105| 1|{ 106| | // Initialize the sampling context. 107| 1| sampling_ctx ctx = {0}; 108| 1| sampling_ctx_init(&ctx); ------------------ | | 138| 1|#define sampling_ctx_init RENAME_FUNC_NAME(sampling_ctx_init) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 109| | 110| 1| DEFER_CLEANUP(prf_state_t prf_state = {0}, clean_prf_state); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 111| | 112| 1| GUARD(init_prf_state(&prf_state, MAX_PRF_INVOCATION, seed)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 113| | 114| 1| GUARD(generate_sparse_rep_for_sk(h0, h0_wlist, &prf_state, &ctx)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 115| 1| GUARD(generate_sparse_rep_for_sk(h1, h1_wlist, &prf_state, &ctx)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 116| | 117| 1| return SUCCESS; ------------------ | | 12| 1|#define SUCCESS OQS_SUCCESS ------------------ 118| 1|} OQS_KEM_bike_l3_generate_error_vector: 121| 2|{ 122| | // Initialize the sampling context. 123| 2| sampling_ctx ctx; 124| 2| sampling_ctx_init(&ctx); ------------------ | | 138| 2|#define sampling_ctx_init RENAME_FUNC_NAME(sampling_ctx_init) | | ------------------ | | | | 44| 2|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 125| | 126| 2| DEFER_CLEANUP(prf_state_t prf_state = {0}, clean_prf_state); ------------------ | | 16| 2| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 127| | 128| 2| GUARD(init_prf_state(&prf_state, MAX_PRF_INVOCATION, seed)); ------------------ | | 17| 2| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 2|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 2] | | ------------------ ------------------ 129| | 130| 2| idx_t wlist[T]; 131| 2| GUARD(sample_indices_fisher_yates(wlist, T, N_BITS, &prf_state)); ------------------ | | 17| 2| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 2|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 2] | | ------------------ ------------------ 132| | 133| | // (e0, e1) hold bits 0..R_BITS-1 and R_BITS..2*R_BITS-1 of the error, resp. 134| 2| ctx.secure_set_bits(&e->val[0], 0, wlist, T); ------------------ | | 61| 2|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 2|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx.secure_set_bits(&e->val[0], 0, wlist, T); ------------------ | | 45| 2|# define T 199 ------------------ 135| 2| ctx.secure_set_bits(&e->val[1], R_BITS, wlist, T); ------------------ | | 61| 2|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 2|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx.secure_set_bits(&e->val[1], R_BITS, wlist, T); ------------------ | | 43| 2|# define R_BITS 24659 ------------------ ctx.secure_set_bits(&e->val[1], R_BITS, wlist, T); ------------------ | | 45| 2|# define T 199 ------------------ 136| | 137| | // Clean the padding of the elements. 138| 2| PE0_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 95| 2|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ PE0_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ PE0_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 98| 2|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 2|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 2|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 139| 2| PE1_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 96| 2|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ PE1_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ PE1_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 98| 2|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 2|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 2|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 140| 2| bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 95| 2|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 89| 2|#define R_PADDED_BYTES (R_PADDED / 8) | | ------------------ | | | | 88| 2|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 2|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 56| 2|# define BLOCK_BITS 32768 | | | | ------------------ | | ------------------ ------------------ bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 141| 2| bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 96| 2|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 89| 2|#define R_PADDED_BYTES (R_PADDED / 8) | | ------------------ | | | | 88| 2|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 2|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 56| 2|# define BLOCK_BITS 32768 | | | | ------------------ | | ------------------ ------------------ bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 142| | 143| 2| secure_clean((uint8_t *)wlist, sizeof(wlist)); ------------------ | | 33| 2|#define secure_clean OQS_MEM_cleanse ------------------ 144| | 145| 2| return SUCCESS; ------------------ | | 12| 2|#define SUCCESS OQS_SUCCESS ------------------ 146| 2|} sampling.c:OQS_KEM_bike_l3_generate_sparse_rep_for_sk: 90| 2|{ 91| 2| idx_t wlist_temp[D] = {0}; 92| | 93| 2| GUARD(sample_indices_fisher_yates(wlist_temp, D, R_BITS, prf_state)); ------------------ | | 17| 2| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 2|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 2] | | ------------------ ------------------ 94| | 95| 2| bike_memcpy(wlist, wlist_temp, D * sizeof(idx_t)); ------------------ | | 44| 2|# define D 103 ------------------ 96| 2| ctx->secure_set_bits(r, 0, wlist, D); ------------------ | | 61| 2|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 2|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits(r, 0, wlist, D); ------------------ | | 44| 2|# define D 103 ------------------ 97| | 98| 2| secure_clean((uint8_t *)wlist_temp, sizeof(wlist_temp)); ------------------ | | 33| 2|#define secure_clean OQS_MEM_cleanse ------------------ 99| 2| return SUCCESS; ------------------ | | 12| 2|#define SUCCESS OQS_SUCCESS ------------------ 100| 2|} OQS_KEM_bike_l5_get_seeds: 17| 2|{ 18| 2| OQS_randombytes((uint8_t *)seeds, NUM_OF_SEEDS * sizeof(seed_t)); ------------------ | | 76| 2|#define NUM_OF_SEEDS 2 ------------------ 19| | 20| 6| for(uint32_t i = 0; i < NUM_OF_SEEDS; ++i) { ------------------ | | 76| 6|#define NUM_OF_SEEDS 2 ------------------ | Branch (20:23): [True: 4, False: 2] ------------------ 21| 4| print("s: ", (uint64_t *)&seeds->seed[i], SIZEOF_BITS(seed_t)); 22| 4| } 23| 2|} OQS_KEM_bike_l5_sample_indices_fisher_yates: 60| 4| IN OUT prf_state_t *prf_state) { 61| | 62| 806| for (size_t i = num_indices; i-- > 0;) { ------------------ | Branch (62:34): [True: 802, False: 4] ------------------ 63| 802|#define CWW_RAND_BYTES 4 64| 802| uint64_t rand = 0ULL; 65| 802| GUARD(get_prf_output((uint8_t *)&rand, prf_state, CWW_RAND_BYTES)); ------------------ | | 17| 802| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 802|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 802] | | ------------------ ------------------ 66| 802| rand *= (max_idx_val - i); 67| | 68| | // new index l is such that i <= l < max_idx_val 69| 802| uint32_t l = i + (uint32_t)(rand >> (CWW_RAND_BYTES * 8)); ------------------ | | 63| 802|#define CWW_RAND_BYTES 4 ------------------ 70| | 71| | // Loop over (the end of) the output array to determine if l is a duplicate 72| 802| uint32_t is_dup = 0; 73| 88.8k| for (size_t j = i + 1; j < num_indices; ++j) { ------------------ | Branch (73:32): [True: 88.0k, False: 802] ------------------ 74| 88.0k| is_dup |= secure_cmp32(l, out[j]); 75| 88.0k| } 76| | 77| | // if l is a duplicate out[i] gets i else out[i] gets l 78| | // mask is all 1 if l is a duplicate, all 0 else 79| 802| uint32_t mask = -is_dup; 80| 802| out[i] = (mask & i) ^ (~mask & l); 81| 802| } 82| | 83| 4| return SUCCESS; ------------------ | | 12| 4|#define SUCCESS OQS_SUCCESS ------------------ 84| 4|} OQS_KEM_bike_l5_generate_secret_key: 105| 1|{ 106| | // Initialize the sampling context. 107| 1| sampling_ctx ctx = {0}; 108| 1| sampling_ctx_init(&ctx); ------------------ | | 138| 1|#define sampling_ctx_init RENAME_FUNC_NAME(sampling_ctx_init) | | ------------------ | | | | 44| 1|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 1|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 1|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 109| | 110| 1| DEFER_CLEANUP(prf_state_t prf_state = {0}, clean_prf_state); ------------------ | | 16| 1| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 111| | 112| 1| GUARD(init_prf_state(&prf_state, MAX_PRF_INVOCATION, seed)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 113| | 114| 1| GUARD(generate_sparse_rep_for_sk(h0, h0_wlist, &prf_state, &ctx)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 115| 1| GUARD(generate_sparse_rep_for_sk(h1, h1_wlist, &prf_state, &ctx)); ------------------ | | 17| 1| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 1|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 1] | | ------------------ ------------------ 116| | 117| 1| return SUCCESS; ------------------ | | 12| 1|#define SUCCESS OQS_SUCCESS ------------------ 118| 1|} OQS_KEM_bike_l5_generate_error_vector: 121| 2|{ 122| | // Initialize the sampling context. 123| 2| sampling_ctx ctx; 124| 2| sampling_ctx_init(&ctx); ------------------ | | 138| 2|#define sampling_ctx_init RENAME_FUNC_NAME(sampling_ctx_init) | | ------------------ | | | | 44| 2|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 125| | 126| 2| DEFER_CLEANUP(prf_state_t prf_state = {0}, clean_prf_state); ------------------ | | 16| 2| __attribute__((cleanup(_thecleanup))) _thealloc ------------------ 127| | 128| 2| GUARD(init_prf_state(&prf_state, MAX_PRF_INVOCATION, seed)); ------------------ | | 17| 2| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 2|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 2] | | ------------------ ------------------ 129| | 130| 2| idx_t wlist[T]; 131| 2| GUARD(sample_indices_fisher_yates(wlist, T, N_BITS, &prf_state)); ------------------ | | 17| 2| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 2|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 2] | | ------------------ ------------------ 132| | 133| | // (e0, e1) hold bits 0..R_BITS-1 and R_BITS..2*R_BITS-1 of the error, resp. 134| 2| ctx.secure_set_bits(&e->val[0], 0, wlist, T); ------------------ | | 61| 2|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 2|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx.secure_set_bits(&e->val[0], 0, wlist, T); ------------------ | | 61| 2|# define T 264 ------------------ 135| 2| ctx.secure_set_bits(&e->val[1], R_BITS, wlist, T); ------------------ | | 61| 2|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 2|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx.secure_set_bits(&e->val[1], R_BITS, wlist, T); ------------------ | | 59| 2|# define R_BITS 40973 ------------------ ctx.secure_set_bits(&e->val[1], R_BITS, wlist, T); ------------------ | | 61| 2|# define T 264 ------------------ 136| | 137| | // Clean the padding of the elements. 138| 2| PE0_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 95| 2|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ PE0_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ PE0_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 98| 2|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 2|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 2|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 139| 2| PE1_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 96| 2|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ PE1_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ PE1_RAW(e)[R_BYTES - 1] &= LAST_R_BYTE_MASK; ------------------ | | 98| 2|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 2|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 2|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 140| 2| bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 95| 2|#define PE0_RAW(e) ((e)->val[0].val.raw) ------------------ bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 89| 2|#define R_PADDED_BYTES (R_PADDED / 8) | | ------------------ | | | | 88| 2|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 2|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 71| 2|# define BLOCK_BITS 65536 | | | | ------------------ | | ------------------ ------------------ bike_memset(&PE0_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 141| 2| bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 96| 2|#define PE1_RAW(e) ((e)->val[1].val.raw) ------------------ bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 89| 2|#define R_PADDED_BYTES (R_PADDED / 8) | | ------------------ | | | | 88| 2|#define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 87| 2|#define R_BLOCKS DIVIDE_AND_CEIL(R_BITS, BLOCK_BITS) | | | | | | ------------------ | | | | | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | | | | | ------------------ | | | | ------------------ | | | | #define R_PADDED (R_BLOCKS * BLOCK_BITS) | | | | ------------------ | | | | | | 71| 2|# define BLOCK_BITS 65536 | | | | ------------------ | | ------------------ ------------------ bike_memset(&PE1_RAW(e)[R_BYTES], 0, R_PADDED_BYTES - R_BYTES); ------------------ | | 81| 2|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 2|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ 142| | 143| 2| secure_clean((uint8_t *)wlist, sizeof(wlist)); ------------------ | | 33| 2|#define secure_clean OQS_MEM_cleanse ------------------ 144| | 145| 2| return SUCCESS; ------------------ | | 12| 2|#define SUCCESS OQS_SUCCESS ------------------ 146| 2|} sampling.c:OQS_KEM_bike_l5_generate_sparse_rep_for_sk: 90| 2|{ 91| 2| idx_t wlist_temp[D] = {0}; 92| | 93| 2| GUARD(sample_indices_fisher_yates(wlist_temp, D, R_BITS, prf_state)); ------------------ | | 17| 2| if((x) != SUCCESS) return FAIL | | ------------------ | | | | 12| 2|#define SUCCESS OQS_SUCCESS | | ------------------ | | if((x) != SUCCESS) return FAIL | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | | Branch (17:6): [True: 0, False: 2] | | ------------------ ------------------ 94| | 95| 2| bike_memcpy(wlist, wlist_temp, D * sizeof(idx_t)); ------------------ | | 60| 2|# define D 137 ------------------ 96| 2| ctx->secure_set_bits(r, 0, wlist, D); ------------------ | | 61| 2|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 2|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 2|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 2|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits(r, 0, wlist, D); ------------------ | | 60| 2|# define D 137 ------------------ 97| | 98| 2| secure_clean((uint8_t *)wlist_temp, sizeof(wlist_temp)); ------------------ | | 33| 2|#define secure_clean OQS_MEM_cleanse ------------------ 99| 2| return SUCCESS; ------------------ | | 12| 2|#define SUCCESS OQS_SUCCESS ------------------ 100| 2|} OQS_KEM_bike_l1_secure_set_bits_avx2: 23| 30|{ 24| | // The function assumes that the size of r is a multiple 25| | // of the cumulative size of used YMM registers. 26| 30| assert((sizeof(*r) / sizeof(uint64_t)) % YMMS_QWORDS == 0); 27| | 28| | // va vectors hold the bits of the output array "r" 29| | // va_pos_qw vectors hold the qw position indices of "r" 30| | // The algorithm works as follows: 31| | // 1. Initialize va_pos_qw with starting positions of qw's of "r" 32| | // va_pos_qw = (3, 2, 1, 0); 33| | // 2. While the size of "r" is not exceeded: 34| | // 3. For each w in wlist: 35| | // 4. Compare the pos_qw of w with positions in va_pos_qw 36| | // and for the position which is equal set the appropriate 37| | // bit in va vector. 38| | // 5. Set va_pos_qw to the next qw positions of "r" 39| 30| __m256i va[NUM_YMMS], va_pos_qw[NUM_YMMS], va_mask; 40| 30| __m256i w_pos_qw, w_pos_bit; 41| 30| __m256i one, inc; 42| | 43| 30| uint64_t *r64 = (uint64_t *)r; 44| | 45| 30| one = SET1_I64(1); ------------------ | | 71| 30|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 46| 30| inc = SET1_I64(QWORDS_IN_YMM); ------------------ | | 71| 30|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 47| | 48| | // 1. Initialize 49| 30| va_pos_qw[0] = SET_I64(3, 2, 1, 0); ------------------ | | 67| 30|# define SET_I64(...) _mm256_set_epi64x(__VA_ARGS__) ------------------ 50| 120| for(size_t i = 1; i < NUM_YMMS; i++) { ------------------ | | 16| 120|#define NUM_YMMS (4) ------------------ | Branch (50:21): [True: 90, False: 30] ------------------ 51| 90| va_pos_qw[i] = ADD_I64(va_pos_qw[i - 1], inc); ------------------ | | 80| 90|# define ADD_I64(a, b) _mm256_add_epi64(a, b) ------------------ 52| 90| } 53| | 54| | // va_pos_qw vectors hold qw positions 0 .. (NUM_YMMS * QWORDS_IN_YMM - 1) 55| | // Therefore, we set the increment vector inc such that by adding it to 56| | // va_pos_qw vectors, they hold the next YMM_QWORDS qw positions. 57| 30| inc = SET1_I64(YMMS_QWORDS); ------------------ | | 71| 30|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 58| | 59| 510| for(size_t i = 0; i < (sizeof(*r) / sizeof(uint64_t)); i += YMMS_QWORDS) { ------------------ | | 17| 480|#define YMMS_QWORDS (QWORDS_IN_YMM * NUM_YMMS) | | ------------------ | | | | 61| 480|#define QWORDS_IN_YMM (BYTES_IN_YMM / sizeof(uint64_t)) | | | | ------------------ | | | | | | 48| 480|#define BYTES_IN_YMM 0x20 | | | | ------------------ | | ------------------ | | #define YMMS_QWORDS (QWORDS_IN_YMM * NUM_YMMS) | | ------------------ | | | | 16| 480|#define NUM_YMMS (4) | | ------------------ ------------------ | Branch (59:21): [True: 480, False: 30] ------------------ 60| 2.40k| for(size_t va_iter = 0; va_iter < NUM_YMMS; va_iter++) { ------------------ | | 16| 2.40k|#define NUM_YMMS (4) ------------------ | Branch (60:29): [True: 1.92k, False: 480] ------------------ 61| 1.92k| va[va_iter] = SET_ZERO; ------------------ | | 72| 1.92k|# define SET_ZERO _mm256_setzero_si256() ------------------ 62| 1.92k| } 63| | 64| 54.7k| for(size_t w_iter = 0; w_iter < w_size; w_iter++) { ------------------ | Branch (64:28): [True: 54.2k, False: 480] ------------------ 65| 54.2k| int32_t w = wlist[w_iter] - first_pos; 66| 54.2k| w_pos_qw = SET1_I64(w >> 6); ------------------ | | 71| 54.2k|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 67| 54.2k| w_pos_bit = SLLI_I64(one, w & MASK(6)); ------------------ | | 31| 54.2k|# define SLLI_I64(a, imm) _mm256_slli_epi64(a, imm) ------------------ 68| | 69| | // 4. Compare the positions in va_pos_qw with w_pos_qw 70| | // and set the appropriate bit in va 71| 271k| for(size_t va_iter = 0; va_iter < NUM_YMMS; va_iter++) { ------------------ | | 16| 271k|#define NUM_YMMS (4) ------------------ | Branch (71:31): [True: 216k, False: 54.2k] ------------------ 72| 216k| va_mask = CMPEQ_I64(va_pos_qw[va_iter], w_pos_qw); ------------------ | | 89| 216k|# define CMPEQ_I64(a, b) _mm256_cmpeq_epi64(a, b) ------------------ 73| 216k| va[va_iter] |= (va_mask & w_pos_bit); 74| 216k| } 75| 54.2k| } 76| | 77| | // 5. Set the va_pos_qw to the next qw positions of r 78| | // and store the previously computed data in r 79| 2.40k| for(size_t va_iter = 0; va_iter < NUM_YMMS; va_iter++) { ------------------ | | 16| 2.40k|#define NUM_YMMS (4) ------------------ | Branch (79:29): [True: 1.92k, False: 480] ------------------ 80| 1.92k| STORE(&r64[i + (va_iter * QWORDS_IN_YMM)], va[va_iter]); ------------------ | | 29| 1.92k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 81| 1.92k| va_pos_qw[va_iter] = ADD_I64(va_pos_qw[va_iter], inc); ------------------ | | 80| 1.92k|# define ADD_I64(a, b) _mm256_add_epi64(a, b) ------------------ 82| 1.92k| } 83| 480| } 84| 30|} OQS_KEM_bike_l3_secure_set_bits_avx2: 23| 6|{ 24| | // The function assumes that the size of r is a multiple 25| | // of the cumulative size of used YMM registers. 26| 6| assert((sizeof(*r) / sizeof(uint64_t)) % YMMS_QWORDS == 0); 27| | 28| | // va vectors hold the bits of the output array "r" 29| | // va_pos_qw vectors hold the qw position indices of "r" 30| | // The algorithm works as follows: 31| | // 1. Initialize va_pos_qw with starting positions of qw's of "r" 32| | // va_pos_qw = (3, 2, 1, 0); 33| | // 2. While the size of "r" is not exceeded: 34| | // 3. For each w in wlist: 35| | // 4. Compare the pos_qw of w with positions in va_pos_qw 36| | // and for the position which is equal set the appropriate 37| | // bit in va vector. 38| | // 5. Set va_pos_qw to the next qw positions of "r" 39| 6| __m256i va[NUM_YMMS], va_pos_qw[NUM_YMMS], va_mask; 40| 6| __m256i w_pos_qw, w_pos_bit; 41| 6| __m256i one, inc; 42| | 43| 6| uint64_t *r64 = (uint64_t *)r; 44| | 45| 6| one = SET1_I64(1); ------------------ | | 71| 6|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 46| 6| inc = SET1_I64(QWORDS_IN_YMM); ------------------ | | 71| 6|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 47| | 48| | // 1. Initialize 49| 6| va_pos_qw[0] = SET_I64(3, 2, 1, 0); ------------------ | | 67| 6|# define SET_I64(...) _mm256_set_epi64x(__VA_ARGS__) ------------------ 50| 24| for(size_t i = 1; i < NUM_YMMS; i++) { ------------------ | | 16| 24|#define NUM_YMMS (4) ------------------ | Branch (50:21): [True: 18, False: 6] ------------------ 51| 18| va_pos_qw[i] = ADD_I64(va_pos_qw[i - 1], inc); ------------------ | | 80| 18|# define ADD_I64(a, b) _mm256_add_epi64(a, b) ------------------ 52| 18| } 53| | 54| | // va_pos_qw vectors hold qw positions 0 .. (NUM_YMMS * QWORDS_IN_YMM - 1) 55| | // Therefore, we set the increment vector inc such that by adding it to 56| | // va_pos_qw vectors, they hold the next YMM_QWORDS qw positions. 57| 6| inc = SET1_I64(YMMS_QWORDS); ------------------ | | 71| 6|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 58| | 59| 198| for(size_t i = 0; i < (sizeof(*r) / sizeof(uint64_t)); i += YMMS_QWORDS) { ------------------ | | 17| 192|#define YMMS_QWORDS (QWORDS_IN_YMM * NUM_YMMS) | | ------------------ | | | | 61| 192|#define QWORDS_IN_YMM (BYTES_IN_YMM / sizeof(uint64_t)) | | | | ------------------ | | | | | | 48| 192|#define BYTES_IN_YMM 0x20 | | | | ------------------ | | ------------------ | | #define YMMS_QWORDS (QWORDS_IN_YMM * NUM_YMMS) | | ------------------ | | | | 16| 192|#define NUM_YMMS (4) | | ------------------ ------------------ | Branch (59:21): [True: 192, False: 6] ------------------ 60| 960| for(size_t va_iter = 0; va_iter < NUM_YMMS; va_iter++) { ------------------ | | 16| 960|#define NUM_YMMS (4) ------------------ | Branch (60:29): [True: 768, False: 192] ------------------ 61| 768| va[va_iter] = SET_ZERO; ------------------ | | 72| 768|# define SET_ZERO _mm256_setzero_si256() ------------------ 62| 768| } 63| | 64| 32.2k| for(size_t w_iter = 0; w_iter < w_size; w_iter++) { ------------------ | Branch (64:28): [True: 32.0k, False: 192] ------------------ 65| 32.0k| int32_t w = wlist[w_iter] - first_pos; 66| 32.0k| w_pos_qw = SET1_I64(w >> 6); ------------------ | | 71| 32.0k|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 67| 32.0k| w_pos_bit = SLLI_I64(one, w & MASK(6)); ------------------ | | 31| 32.0k|# define SLLI_I64(a, imm) _mm256_slli_epi64(a, imm) ------------------ 68| | 69| | // 4. Compare the positions in va_pos_qw with w_pos_qw 70| | // and set the appropriate bit in va 71| 160k| for(size_t va_iter = 0; va_iter < NUM_YMMS; va_iter++) { ------------------ | | 16| 160k|#define NUM_YMMS (4) ------------------ | Branch (71:31): [True: 128k, False: 32.0k] ------------------ 72| 128k| va_mask = CMPEQ_I64(va_pos_qw[va_iter], w_pos_qw); ------------------ | | 89| 128k|# define CMPEQ_I64(a, b) _mm256_cmpeq_epi64(a, b) ------------------ 73| 128k| va[va_iter] |= (va_mask & w_pos_bit); 74| 128k| } 75| 32.0k| } 76| | 77| | // 5. Set the va_pos_qw to the next qw positions of r 78| | // and store the previously computed data in r 79| 960| for(size_t va_iter = 0; va_iter < NUM_YMMS; va_iter++) { ------------------ | | 16| 960|#define NUM_YMMS (4) ------------------ | Branch (79:29): [True: 768, False: 192] ------------------ 80| 768| STORE(&r64[i + (va_iter * QWORDS_IN_YMM)], va[va_iter]); ------------------ | | 29| 768|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 81| 768| va_pos_qw[va_iter] = ADD_I64(va_pos_qw[va_iter], inc); ------------------ | | 80| 768|# define ADD_I64(a, b) _mm256_add_epi64(a, b) ------------------ 82| 768| } 83| 192| } 84| 6|} OQS_KEM_bike_l5_secure_set_bits_avx2: 23| 6|{ 24| | // The function assumes that the size of r is a multiple 25| | // of the cumulative size of used YMM registers. 26| 6| assert((sizeof(*r) / sizeof(uint64_t)) % YMMS_QWORDS == 0); 27| | 28| | // va vectors hold the bits of the output array "r" 29| | // va_pos_qw vectors hold the qw position indices of "r" 30| | // The algorithm works as follows: 31| | // 1. Initialize va_pos_qw with starting positions of qw's of "r" 32| | // va_pos_qw = (3, 2, 1, 0); 33| | // 2. While the size of "r" is not exceeded: 34| | // 3. For each w in wlist: 35| | // 4. Compare the pos_qw of w with positions in va_pos_qw 36| | // and for the position which is equal set the appropriate 37| | // bit in va vector. 38| | // 5. Set va_pos_qw to the next qw positions of "r" 39| 6| __m256i va[NUM_YMMS], va_pos_qw[NUM_YMMS], va_mask; 40| 6| __m256i w_pos_qw, w_pos_bit; 41| 6| __m256i one, inc; 42| | 43| 6| uint64_t *r64 = (uint64_t *)r; 44| | 45| 6| one = SET1_I64(1); ------------------ | | 71| 6|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 46| 6| inc = SET1_I64(QWORDS_IN_YMM); ------------------ | | 71| 6|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 47| | 48| | // 1. Initialize 49| 6| va_pos_qw[0] = SET_I64(3, 2, 1, 0); ------------------ | | 67| 6|# define SET_I64(...) _mm256_set_epi64x(__VA_ARGS__) ------------------ 50| 24| for(size_t i = 1; i < NUM_YMMS; i++) { ------------------ | | 16| 24|#define NUM_YMMS (4) ------------------ | Branch (50:21): [True: 18, False: 6] ------------------ 51| 18| va_pos_qw[i] = ADD_I64(va_pos_qw[i - 1], inc); ------------------ | | 80| 18|# define ADD_I64(a, b) _mm256_add_epi64(a, b) ------------------ 52| 18| } 53| | 54| | // va_pos_qw vectors hold qw positions 0 .. (NUM_YMMS * QWORDS_IN_YMM - 1) 55| | // Therefore, we set the increment vector inc such that by adding it to 56| | // va_pos_qw vectors, they hold the next YMM_QWORDS qw positions. 57| 6| inc = SET1_I64(YMMS_QWORDS); ------------------ | | 71| 6|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 58| | 59| 390| for(size_t i = 0; i < (sizeof(*r) / sizeof(uint64_t)); i += YMMS_QWORDS) { ------------------ | | 17| 384|#define YMMS_QWORDS (QWORDS_IN_YMM * NUM_YMMS) | | ------------------ | | | | 61| 384|#define QWORDS_IN_YMM (BYTES_IN_YMM / sizeof(uint64_t)) | | | | ------------------ | | | | | | 48| 384|#define BYTES_IN_YMM 0x20 | | | | ------------------ | | ------------------ | | #define YMMS_QWORDS (QWORDS_IN_YMM * NUM_YMMS) | | ------------------ | | | | 16| 384|#define NUM_YMMS (4) | | ------------------ ------------------ | Branch (59:21): [True: 384, False: 6] ------------------ 60| 1.92k| for(size_t va_iter = 0; va_iter < NUM_YMMS; va_iter++) { ------------------ | | 16| 1.92k|#define NUM_YMMS (4) ------------------ | Branch (60:29): [True: 1.53k, False: 384] ------------------ 61| 1.53k| va[va_iter] = SET_ZERO; ------------------ | | 72| 1.53k|# define SET_ZERO _mm256_setzero_si256() ------------------ 62| 1.53k| } 63| | 64| 85.5k| for(size_t w_iter = 0; w_iter < w_size; w_iter++) { ------------------ | Branch (64:28): [True: 85.1k, False: 384] ------------------ 65| 85.1k| int32_t w = wlist[w_iter] - first_pos; 66| 85.1k| w_pos_qw = SET1_I64(w >> 6); ------------------ | | 71| 85.1k|# define SET1_I64(a) _mm256_set1_epi64x(a) ------------------ 67| 85.1k| w_pos_bit = SLLI_I64(one, w & MASK(6)); ------------------ | | 31| 85.1k|# define SLLI_I64(a, imm) _mm256_slli_epi64(a, imm) ------------------ 68| | 69| | // 4. Compare the positions in va_pos_qw with w_pos_qw 70| | // and set the appropriate bit in va 71| 425k| for(size_t va_iter = 0; va_iter < NUM_YMMS; va_iter++) { ------------------ | | 16| 425k|#define NUM_YMMS (4) ------------------ | Branch (71:31): [True: 340k, False: 85.1k] ------------------ 72| 340k| va_mask = CMPEQ_I64(va_pos_qw[va_iter], w_pos_qw); ------------------ | | 89| 340k|# define CMPEQ_I64(a, b) _mm256_cmpeq_epi64(a, b) ------------------ 73| 340k| va[va_iter] |= (va_mask & w_pos_bit); 74| 340k| } 75| 85.1k| } 76| | 77| | // 5. Set the va_pos_qw to the next qw positions of r 78| | // and store the previously computed data in r 79| 1.92k| for(size_t va_iter = 0; va_iter < NUM_YMMS; va_iter++) { ------------------ | | 16| 1.92k|#define NUM_YMMS (4) ------------------ | Branch (79:29): [True: 1.53k, False: 384] ------------------ 80| 1.53k| STORE(&r64[i + (va_iter * QWORDS_IN_YMM)], va[va_iter]); ------------------ | | 29| 1.53k|# define STORE(mem, reg) _mm256_storeu_si256((void *)(mem), (reg)) ------------------ 81| 1.53k| va_pos_qw[va_iter] = ADD_I64(va_pos_qw[va_iter], inc); ------------------ | | 80| 1.53k|# define ADD_I64(a, b) _mm256_add_epi64(a, b) ------------------ 82| 1.53k| } 83| 384| } 84| 6|} sampling.c:OQS_KEM_bike_l1_sampling_ctx_init: 39| 15|{ 40| 15|#if defined(X86_64) 41| 15|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 42| 15| if(is_avx512_enabled()) { ------------------ | | 98| 15|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 15|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 15|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 15|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (42:6): [True: 0, False: 15] ------------------ 43| 0| ctx->secure_set_bits = secure_set_bits_avx512; ------------------ | | 61| 0|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits = secure_set_bits_avx512; ------------------ | | 137| 0|#define secure_set_bits_avx512 RENAME_FUNC_NAME(secure_set_bits_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 44| 0| } else 45| 15|#endif 46| 15|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 47| 15| if(is_avx2_enabled()) { ------------------ | | 97| 15|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 15|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 15|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 15|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (47:6): [True: 15, False: 0] ------------------ 48| 15| ctx->secure_set_bits = secure_set_bits_avx2; ------------------ | | 61| 15|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 15|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 15|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 15|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits = secure_set_bits_avx2; ------------------ | | 136| 15|#define secure_set_bits_avx2 RENAME_FUNC_NAME(secure_set_bits_avx2) | | ------------------ | | | | 44| 15|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 15|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 15|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 49| 15| } else 50| 0|#endif 51| 0|#endif 52| 0| { 53| 0| ctx->secure_set_bits = secure_set_bits_port; ------------------ | | 61| 0|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits = secure_set_bits_port; ------------------ | | 135| 0|#define secure_set_bits_port RENAME_FUNC_NAME(secure_set_bits_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 0| } 55| 15|} sampling.c:OQS_KEM_bike_l3_sampling_ctx_init: 39| 3|{ 40| 3|#if defined(X86_64) 41| 3|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 42| 3| if(is_avx512_enabled()) { ------------------ | | 98| 3|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 3|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 3|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 3|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (42:6): [True: 0, False: 3] ------------------ 43| 0| ctx->secure_set_bits = secure_set_bits_avx512; ------------------ | | 61| 0|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits = secure_set_bits_avx512; ------------------ | | 137| 0|#define secure_set_bits_avx512 RENAME_FUNC_NAME(secure_set_bits_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 44| 0| } else 45| 3|#endif 46| 3|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 47| 3| if(is_avx2_enabled()) { ------------------ | | 97| 3|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 3|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 3|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 3|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (47:6): [True: 3, False: 0] ------------------ 48| 3| ctx->secure_set_bits = secure_set_bits_avx2; ------------------ | | 61| 3|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 3|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 3|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 3|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits = secure_set_bits_avx2; ------------------ | | 136| 3|#define secure_set_bits_avx2 RENAME_FUNC_NAME(secure_set_bits_avx2) | | ------------------ | | | | 44| 3|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 3|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 3|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 49| 3| } else 50| 0|#endif 51| 0|#endif 52| 0| { 53| 0| ctx->secure_set_bits = secure_set_bits_port; ------------------ | | 61| 0|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits = secure_set_bits_port; ------------------ | | 135| 0|#define secure_set_bits_port RENAME_FUNC_NAME(secure_set_bits_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 0| } 55| 3|} sampling.c:OQS_KEM_bike_l5_sampling_ctx_init: 39| 3|{ 40| 3|#if defined(X86_64) 41| 3|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX512_INSTRUCTIONS) 42| 3| if(is_avx512_enabled()) { ------------------ | | 98| 3|#define is_avx512_enabled RENAME_FUNC_NAME(is_avx512_enabled) | | ------------------ | | | | 44| 3|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 3|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 3|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (42:6): [True: 0, False: 3] ------------------ 43| 0| ctx->secure_set_bits = secure_set_bits_avx512; ------------------ | | 61| 0|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits = secure_set_bits_avx512; ------------------ | | 137| 0|#define secure_set_bits_avx512 RENAME_FUNC_NAME(secure_set_bits_avx512) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 44| 0| } else 45| 3|#endif 46| 3|#if defined(OQS_DIST_X86_64_BUILD) || defined(OQS_USE_AVX2_INSTRUCTIONS) 47| 3| if(is_avx2_enabled()) { ------------------ | | 97| 3|#define is_avx2_enabled RENAME_FUNC_NAME(is_avx2_enabled) | | ------------------ | | | | 44| 3|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 3|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 3|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (47:6): [True: 3, False: 0] ------------------ 48| 3| ctx->secure_set_bits = secure_set_bits_avx2; ------------------ | | 61| 3|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 3|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 3|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 3|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits = secure_set_bits_avx2; ------------------ | | 136| 3|#define secure_set_bits_avx2 RENAME_FUNC_NAME(secure_set_bits_avx2) | | ------------------ | | | | 44| 3|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 3|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 3|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 49| 3| } else 50| 0|#endif 51| 0|#endif 52| 0| { 53| 0| ctx->secure_set_bits = secure_set_bits_port; ------------------ | | 61| 0|#define secure_set_bits RENAME_FUNC_NAME(secure_set_bits) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ ctx->secure_set_bits = secure_set_bits_port; ------------------ | | 135| 0|#define secure_set_bits_port RENAME_FUNC_NAME(secure_set_bits_port) | | ------------------ | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | ------------------ | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | ------------------ | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 0| } 55| 3|} kem.c:sha_dgst_cleanup: 27| 28|sha_dgst_cleanup(IN OUT sha_dgst_t *o) { 28| 28| secure_clean(o->u.raw, sizeof(*o)); ------------------ | | 33| 28|#define secure_clean OQS_MEM_cleanse ------------------ 29| 28|} kem.c:OQS_KEM_bike_l1_sha: 32| 20|sha(OUT sha_dgst_t *hash_out, IN const uint32_t byte_len, IN const uint8_t *msg) { 33| 20| OQS_SHA3_sha3_384(hash_out->u.raw, msg, byte_len); 34| 20| return SUCCESS; ------------------ | | 12| 20|#define SUCCESS OQS_SUCCESS ------------------ 35| 20|} kem.c:OQS_KEM_bike_l3_sha: 32| 4|sha(OUT sha_dgst_t *hash_out, IN const uint32_t byte_len, IN const uint8_t *msg) { 33| 4| OQS_SHA3_sha3_384(hash_out->u.raw, msg, byte_len); 34| 4| return SUCCESS; ------------------ | | 12| 4|#define SUCCESS OQS_SUCCESS ------------------ 35| 4|} kem.c:OQS_KEM_bike_l5_sha: 32| 4|sha(OUT sha_dgst_t *hash_out, IN const uint32_t byte_len, IN const uint8_t *msg) { 33| 4| OQS_SHA3_sha3_384(hash_out->u.raw, msg, byte_len); 34| 4| return SUCCESS; ------------------ | | 12| 4|#define SUCCESS OQS_SUCCESS ------------------ 35| 4|} OQS_KEM_bike_l1_init_prf_state: 14| 15|{ 15| 15| if(0 == max_num_invocations) { ------------------ | Branch (15:6): [True: 0, False: 15] ------------------ 16| 0| BIKE_ERROR(E_SHAKE_PRF_INIT_FAIL); ------------------ | | 31| 0| do { \ | | 32| 0| bike_errno = (x); \ | | ------------------ | | | | 68| 0|#define bike_errno RENAME_FUNC_NAME(bike_errno) | | | | ------------------ | | | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | | | ------------------ | | | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | | | ------------------ | | | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 33| 0| return FAIL; \ | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | 34| 0| } while(0) | | ------------------ | | | Branch (34:11): [Folded, False: 0] | | ------------------ ------------------ 17| 0| } 18| | 19| 15| OQS_SHA3_shake256_inc_init(&s->s); 20| | 21| | // Initialize the SHAKE state with the given seed. 22| 15| OQS_SHA3_shake256_inc_absorb(&s->s, seed->raw, sizeof(*seed)); 23| | 24| 15| OQS_SHA3_shake256_inc_finalize(&s->s); 25| | 26| | // Initialize the PRF parameters. 27| 15| s->curr_pos_in_buffer = OQS_SHA3_SHAKE256_RATE; ------------------ | | 320| 15|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 28| 15| s->rem_invocations = max_num_invocations; 29| | 30| 15| return SUCCESS; ------------------ | | 12| 15|#define SUCCESS OQS_SUCCESS ------------------ 31| 15|} OQS_KEM_bike_l1_get_prf_output: 35| 2.05k|{ 36| | // Check if the maximum number of SHAKE invocations is reached. 37| 2.05k| if (s->rem_invocations == 0) ------------------ | Branch (37:7): [True: 0, False: 2.05k] ------------------ 38| 0| { 39| 0| BIKE_ERROR(E_SHAKE_OVER_USED); ------------------ | | 31| 0| do { \ | | 32| 0| bike_errno = (x); \ | | ------------------ | | | | 68| 0|#define bike_errno RENAME_FUNC_NAME(bike_errno) | | | | ------------------ | | | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | | | ------------------ | | | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | | | ------------------ | | | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 33| 0| return FAIL; \ | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | 34| 0| } while(0) | | ------------------ | | | Branch (34:11): [Folded, False: 0] | | ------------------ ------------------ 40| 0| } 41| | 42| | // When |len| is smaller then use what's left in the buffer, 43| | // there is no need for additional SHAKE256 invocations. 44| 2.05k| if((len + s->curr_pos_in_buffer) <= OQS_SHA3_SHAKE256_RATE) { ------------------ | | 320| 2.05k|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ | Branch (44:6): [True: 1.98k, False: 65] ------------------ 45| 1.98k| bike_memcpy(out, &s->buffer[s->curr_pos_in_buffer], len); 46| 1.98k| s->curr_pos_in_buffer += len; 47| | 48| 1.98k| return SUCCESS; ------------------ | | 12| 1.98k|#define SUCCESS OQS_SUCCESS ------------------ 49| 1.98k| } 50| | 51| | // Generate one block (SHAKE256_RATE bytes) of random data with SHAKE256. 52| 65| OQS_SHA3_shake256_inc_squeeze(s->buffer, OQS_SHA3_SHAKE256_RATE, &s->s); ------------------ | | 320| 65|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 53| | 54| | // Copy |len| bytes to the output, set the new buffer position indicator, 55| | // and update the remaining allowable number of SHAKE invocations. 56| 65| bike_memcpy(out, s->buffer, len); 57| 65| s->curr_pos_in_buffer = len; 58| 65| s->rem_invocations -= 1; 59| | 60| 65| return SUCCESS; ------------------ | | 12| 65|#define SUCCESS OQS_SUCCESS ------------------ 61| 2.05k|} OQS_KEM_bike_l1_clean_prf_state: 64| 15|{ 65| 15| OQS_SHA3_shake256_inc_ctx_release(&s->s); 66| 15| secure_clean((uint8_t*)s, sizeof(*s)); ------------------ | | 33| 15|#define secure_clean OQS_MEM_cleanse ------------------ 67| 15|} OQS_KEM_bike_l3_init_prf_state: 14| 3|{ 15| 3| if(0 == max_num_invocations) { ------------------ | Branch (15:6): [True: 0, False: 3] ------------------ 16| 0| BIKE_ERROR(E_SHAKE_PRF_INIT_FAIL); ------------------ | | 31| 0| do { \ | | 32| 0| bike_errno = (x); \ | | ------------------ | | | | 68| 0|#define bike_errno RENAME_FUNC_NAME(bike_errno) | | | | ------------------ | | | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | | | ------------------ | | | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | | | ------------------ | | | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 33| 0| return FAIL; \ | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | 34| 0| } while(0) | | ------------------ | | | Branch (34:11): [Folded, False: 0] | | ------------------ ------------------ 17| 0| } 18| | 19| 3| OQS_SHA3_shake256_inc_init(&s->s); 20| | 21| | // Initialize the SHAKE state with the given seed. 22| 3| OQS_SHA3_shake256_inc_absorb(&s->s, seed->raw, sizeof(*seed)); 23| | 24| 3| OQS_SHA3_shake256_inc_finalize(&s->s); 25| | 26| | // Initialize the PRF parameters. 27| 3| s->curr_pos_in_buffer = OQS_SHA3_SHAKE256_RATE; ------------------ | | 320| 3|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 28| 3| s->rem_invocations = max_num_invocations; 29| | 30| 3| return SUCCESS; ------------------ | | 12| 3|#define SUCCESS OQS_SUCCESS ------------------ 31| 3|} OQS_KEM_bike_l3_get_prf_output: 35| 604|{ 36| | // Check if the maximum number of SHAKE invocations is reached. 37| 604| if (s->rem_invocations == 0) ------------------ | Branch (37:7): [True: 0, False: 604] ------------------ 38| 0| { 39| 0| BIKE_ERROR(E_SHAKE_OVER_USED); ------------------ | | 31| 0| do { \ | | 32| 0| bike_errno = (x); \ | | ------------------ | | | | 68| 0|#define bike_errno RENAME_FUNC_NAME(bike_errno) | | | | ------------------ | | | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | | | ------------------ | | | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | | | ------------------ | | | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 33| 0| return FAIL; \ | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | 34| 0| } while(0) | | ------------------ | | | Branch (34:11): [Folded, False: 0] | | ------------------ ------------------ 40| 0| } 41| | 42| | // When |len| is smaller then use what's left in the buffer, 43| | // there is no need for additional SHAKE256 invocations. 44| 604| if((len + s->curr_pos_in_buffer) <= OQS_SHA3_SHAKE256_RATE) { ------------------ | | 320| 604|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ | Branch (44:6): [True: 585, False: 19] ------------------ 45| 585| bike_memcpy(out, &s->buffer[s->curr_pos_in_buffer], len); 46| 585| s->curr_pos_in_buffer += len; 47| | 48| 585| return SUCCESS; ------------------ | | 12| 585|#define SUCCESS OQS_SUCCESS ------------------ 49| 585| } 50| | 51| | // Generate one block (SHAKE256_RATE bytes) of random data with SHAKE256. 52| 19| OQS_SHA3_shake256_inc_squeeze(s->buffer, OQS_SHA3_SHAKE256_RATE, &s->s); ------------------ | | 320| 19|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 53| | 54| | // Copy |len| bytes to the output, set the new buffer position indicator, 55| | // and update the remaining allowable number of SHAKE invocations. 56| 19| bike_memcpy(out, s->buffer, len); 57| 19| s->curr_pos_in_buffer = len; 58| 19| s->rem_invocations -= 1; 59| | 60| 19| return SUCCESS; ------------------ | | 12| 19|#define SUCCESS OQS_SUCCESS ------------------ 61| 604|} OQS_KEM_bike_l3_clean_prf_state: 64| 3|{ 65| 3| OQS_SHA3_shake256_inc_ctx_release(&s->s); 66| 3| secure_clean((uint8_t*)s, sizeof(*s)); ------------------ | | 33| 3|#define secure_clean OQS_MEM_cleanse ------------------ 67| 3|} OQS_KEM_bike_l5_init_prf_state: 14| 3|{ 15| 3| if(0 == max_num_invocations) { ------------------ | Branch (15:6): [True: 0, False: 3] ------------------ 16| 0| BIKE_ERROR(E_SHAKE_PRF_INIT_FAIL); ------------------ | | 31| 0| do { \ | | 32| 0| bike_errno = (x); \ | | ------------------ | | | | 68| 0|#define bike_errno RENAME_FUNC_NAME(bike_errno) | | | | ------------------ | | | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | | | ------------------ | | | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | | | ------------------ | | | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 33| 0| return FAIL; \ | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | 34| 0| } while(0) | | ------------------ | | | Branch (34:11): [Folded, False: 0] | | ------------------ ------------------ 17| 0| } 18| | 19| 3| OQS_SHA3_shake256_inc_init(&s->s); 20| | 21| | // Initialize the SHAKE state with the given seed. 22| 3| OQS_SHA3_shake256_inc_absorb(&s->s, seed->raw, sizeof(*seed)); 23| | 24| 3| OQS_SHA3_shake256_inc_finalize(&s->s); 25| | 26| | // Initialize the PRF parameters. 27| 3| s->curr_pos_in_buffer = OQS_SHA3_SHAKE256_RATE; ------------------ | | 320| 3|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 28| 3| s->rem_invocations = max_num_invocations; 29| | 30| 3| return SUCCESS; ------------------ | | 12| 3|#define SUCCESS OQS_SUCCESS ------------------ 31| 3|} OQS_KEM_bike_l5_get_prf_output: 35| 802|{ 36| | // Check if the maximum number of SHAKE invocations is reached. 37| 802| if (s->rem_invocations == 0) ------------------ | Branch (37:7): [True: 0, False: 802] ------------------ 38| 0| { 39| 0| BIKE_ERROR(E_SHAKE_OVER_USED); ------------------ | | 31| 0| do { \ | | 32| 0| bike_errno = (x); \ | | ------------------ | | | | 68| 0|#define bike_errno RENAME_FUNC_NAME(bike_errno) | | | | ------------------ | | | | | | 44| 0|#define RENAME_FUNC_NAME(fname) EVALUATOR(FUNC_PREFIX, fname) | | | | | | ------------------ | | | | | | | | 43| 0|#define EVALUATOR(x, y) PASTER(x, y) | | | | | | | | ------------------ | | | | | | | | | | 42| 0|#define PASTER(x, y) x##_##y | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 33| 0| return FAIL; \ | | ------------------ | | | | 13| 0|#define FAIL OQS_ERROR | | ------------------ | | 34| 0| } while(0) | | ------------------ | | | Branch (34:11): [Folded, False: 0] | | ------------------ ------------------ 40| 0| } 41| | 42| | // When |len| is smaller then use what's left in the buffer, 43| | // there is no need for additional SHAKE256 invocations. 44| 802| if((len + s->curr_pos_in_buffer) <= OQS_SHA3_SHAKE256_RATE) { ------------------ | | 320| 802|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ | Branch (44:6): [True: 777, False: 25] ------------------ 45| 777| bike_memcpy(out, &s->buffer[s->curr_pos_in_buffer], len); 46| 777| s->curr_pos_in_buffer += len; 47| | 48| 777| return SUCCESS; ------------------ | | 12| 777|#define SUCCESS OQS_SUCCESS ------------------ 49| 777| } 50| | 51| | // Generate one block (SHAKE256_RATE bytes) of random data with SHAKE256. 52| 25| OQS_SHA3_shake256_inc_squeeze(s->buffer, OQS_SHA3_SHAKE256_RATE, &s->s); ------------------ | | 320| 25|#define OQS_SHA3_SHAKE256_RATE 136 ------------------ 53| | 54| | // Copy |len| bytes to the output, set the new buffer position indicator, 55| | // and update the remaining allowable number of SHAKE invocations. 56| 25| bike_memcpy(out, s->buffer, len); 57| 25| s->curr_pos_in_buffer = len; 58| 25| s->rem_invocations -= 1; 59| | 60| 25| return SUCCESS; ------------------ | | 12| 25|#define SUCCESS OQS_SUCCESS ------------------ 61| 802|} OQS_KEM_bike_l5_clean_prf_state: 64| 3|{ 65| 3| OQS_SHA3_shake256_inc_ctx_release(&s->s); 66| 3| secure_clean((uint8_t*)s, sizeof(*s)); ------------------ | | 33| 3|#define secure_clean OQS_MEM_cleanse ------------------ 67| 3|} OQS_KEM_bike_l1_r_bits_vector_weight: 16| 25|{ 17| 25| uint64_t acc = 0; 18| 38.5k| for(size_t i = 0; i < (R_BYTES - 1); i++) { ------------------ | | 81| 38.5k|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 38.5k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (18:21): [True: 38.5k, False: 25] ------------------ 19| 38.5k| acc += __builtin_popcount(in->raw[i]); 20| 38.5k| } 21| | 22| 25| acc += __builtin_popcount(in->raw[R_BYTES - 1] & LAST_R_BYTE_MASK); ------------------ | | 81| 25|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 25|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ acc += __builtin_popcount(in->raw[R_BYTES - 1] & LAST_R_BYTE_MASK); ------------------ | | 98| 25|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 25|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 25|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 23| 25| return acc; 24| 25|} OQS_KEM_bike_l3_r_bits_vector_weight: 16| 5|{ 17| 5| uint64_t acc = 0; 18| 15.4k| for(size_t i = 0; i < (R_BYTES - 1); i++) { ------------------ | | 81| 15.4k|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 15.4k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (18:21): [True: 15.4k, False: 5] ------------------ 19| 15.4k| acc += __builtin_popcount(in->raw[i]); 20| 15.4k| } 21| | 22| 5| acc += __builtin_popcount(in->raw[R_BYTES - 1] & LAST_R_BYTE_MASK); ------------------ | | 81| 5|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 5|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ acc += __builtin_popcount(in->raw[R_BYTES - 1] & LAST_R_BYTE_MASK); ------------------ | | 98| 5|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 5|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 5|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 23| 5| return acc; 24| 5|} OQS_KEM_bike_l5_r_bits_vector_weight: 16| 5|{ 17| 5| uint64_t acc = 0; 18| 25.6k| for(size_t i = 0; i < (R_BYTES - 1); i++) { ------------------ | | 81| 25.6k|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 25.6k|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ | Branch (18:21): [True: 25.6k, False: 5] ------------------ 19| 25.6k| acc += __builtin_popcount(in->raw[i]); 20| 25.6k| } 21| | 22| 5| acc += __builtin_popcount(in->raw[R_BYTES - 1] & LAST_R_BYTE_MASK); ------------------ | | 81| 5|#define R_BYTES DIVIDE_AND_CEIL(R_BITS, 8) | | ------------------ | | | | 37| 5|#define DIVIDE_AND_CEIL(x, divider) (((x) + (divider) - 1) / (divider)) | | ------------------ ------------------ acc += __builtin_popcount(in->raw[R_BYTES - 1] & LAST_R_BYTE_MASK); ------------------ | | 98| 5|#define LAST_R_BYTE_MASK MASK(LAST_R_BYTE_LEAD) | | ------------------ | | | | 43| 5|#define MASK(len) (BIT(len) - 1) | | | | ------------------ | | | | | | 42| 5|#define BIT(len) (1ULL << (len)) | | | | ------------------ | | ------------------ ------------------ 23| 5| return acc; 24| 5|} kem.c:bike_memcpy: 148| 112|{ 149| 112| if(byte_len == 0) { ------------------ | Branch (149:6): [True: 0, False: 112] ------------------ 150| 0| return dst; 151| 0| } 152| | 153| 112| return memcpy(dst, src, byte_len); 154| 112|} kem.c:secure_cmp: 65| 14|{ 66| 14| volatile uint8_t res = 0; 67| | 68| 31.8k| for(uint32_t i = 0; i < size; ++i) { ------------------ | Branch (68:23): [True: 31.8k, False: 14] ------------------ 69| 31.8k| res |= (a[i] ^ b[i]); 70| 31.8k| } 71| | 72| 14| return (0 == res); 73| 14|} kem.c:secure_l32_mask: 111| 7|{ 112| |#if defined(__aarch64__) 113| | uint32_t res; 114| | __asm__ __volatile__("cmp %w[V2], %w[V1]; \n " 115| | "cset %w[RES], HI; \n" 116| | : [RES] "=r"(res) 117| | : [V1] "r"(v1), [V2] "r"(v2) 118| | : "cc" /*The condition code flag*/); 119| | return (res - 1); 120| |#elif defined(__x86_64__) || defined(__i386__) 121| | uint32_t res; 122| 7| __asm__ __volatile__("xor %%edx, %%edx; \n" 123| 7| "cmp %1, %2; \n " 124| 7| "setl %%dl; \n" 125| 7| "dec %%edx; \n" 126| 7| "mov %%edx, %0; \n" 127| | 128| 7| : "=r"(res) 129| 7| : "r"(v2), "r"(v1) 130| 7| : "rdx"); 131| | 132| 7| return res; 133| |#else 134| | // If v1 >= v2 then the subtraction result is 0^32||(v1-v2). 135| | // else it is 1^32||(v2-v1+1). Subsequently, negating the upper 136| | // 32 bits gives 0 if v1 < v2 and otherwise (-1). 137| | return ~((uint32_t)(((uint64_t)v1 - (uint64_t)v2) >> 32)); 138| |#endif 139| 7|} kem.c:u8_barrier: 48| 448| { \ 49| 448| __asm__("" : "+r"(a) : /* no inputs */); \ 50| 448| return a; \ 51| 448| } sampling.c:secure_cmp32: 77| 251k|{ 78| |#if defined(__aarch64__) 79| | uint32_t res; 80| | __asm__ __volatile__("cmp %w[V1], %w[V2]; \n " 81| | "cset %w[RES], EQ; \n" 82| | : [RES] "=r"(res) 83| | : [V1] "r"(v1), [V2] "r"(v2) 84| | : "cc" /*The condition code flag*/); 85| | return res; 86| |#elif defined(__x86_64__) || defined(__i386__) 87| | uint32_t res; 88| 251k| __asm__ __volatile__("xor %%edx, %%edx; \n" 89| 251k| "cmp %1, %2; \n " 90| 251k| "sete %%dl; \n" 91| 251k| "mov %%edx, %0; \n" 92| 251k| : "=r"(res) 93| 251k| : "r"(v1), "r"(v2) 94| 251k| : "rdx"); 95| 251k| return res; 96| |#else 97| | // Insecure comparison: The main purpose of secure_cmp32 is to avoid 98| | // branches to prevent potential side channel leaks. To do that, 99| | // we normally leverage some special CPU instructions such as "sete" 100| | // (for __x86_64__) and "cset" (for __aarch64__). When dealing with general 101| | // CPU architectures, the interpretation of the line below is left for the 102| | // compiler. It could lead to an "insecure" branch. This case needs to be 103| | // checked individually on such platforms 104| | // (e.g., by checking the compiler-generated assembly). 105| | return (v1 == v2 ? 1 : 0); 106| |#endif 107| 251k|} sampling.c:bike_memcpy: 148| 14|{ 149| 14| if(byte_len == 0) { ------------------ | Branch (149:6): [True: 0, False: 14] ------------------ 150| 0| return dst; 151| 0| } 152| | 153| 14| return memcpy(dst, src, byte_len); 154| 14|} sampling.c:bike_memset: 158| 28|{ 159| 28| if(byte_len == 0) { ------------------ | Branch (159:6): [True: 0, False: 28] ------------------ 160| 0| return dst; 161| 0| } 162| | 163| 28| return memset(dst, ch, byte_len); 164| 28|} decode.c:bike_memcpy: 148| 56|{ 149| 56| if(byte_len == 0) { ------------------ | Branch (149:6): [True: 0, False: 56] ------------------ 150| 0| return dst; 151| 0| } 152| | 153| 56| return memcpy(dst, src, byte_len); 154| 56|} decode.c:bike_memset: 158| 315|{ 159| 315| if(byte_len == 0) { ------------------ | Branch (159:6): [True: 0, False: 315] ------------------ 160| 0| return dst; 161| 0| } 162| | 163| 315| return memset(dst, ch, byte_len); 164| 315|} decode.c:secure_l32_mask: 111| 35|{ 112| |#if defined(__aarch64__) 113| | uint32_t res; 114| | __asm__ __volatile__("cmp %w[V2], %w[V1]; \n " 115| | "cset %w[RES], HI; \n" 116| | : [RES] "=r"(res) 117| | : [V1] "r"(v1), [V2] "r"(v2) 118| | : "cc" /*The condition code flag*/); 119| | return (res - 1); 120| |#elif defined(__x86_64__) || defined(__i386__) 121| | uint32_t res; 122| 35| __asm__ __volatile__("xor %%edx, %%edx; \n" 123| 35| "cmp %1, %2; \n " 124| 35| "setl %%dl; \n" 125| 35| "dec %%edx; \n" 126| 35| "mov %%edx, %0; \n" 127| | 128| 35| : "=r"(res) 129| 35| : "r"(v2), "r"(v1) 130| 35| : "rdx"); 131| | 132| 35| return res; 133| |#else 134| | // If v1 >= v2 then the subtraction result is 0^32||(v1-v2). 135| | // else it is 1^32||(v2-v1+1). Subsequently, negating the upper 136| | // 32 bits gives 0 if v1 < v2 and otherwise (-1). 137| | return ~((uint32_t)(((uint64_t)v1 - (uint64_t)v2) >> 32)); 138| |#endif 139| 35|} decode.c:u32_barrier: 48| 70| { \ 49| 70| __asm__("" : "+r"(a) : /* no inputs */); \ 50| 70| return a; \ 51| 70| } shake_prf.c:bike_memcpy: 148| 3.45k|{ 149| 3.45k| if(byte_len == 0) { ------------------ | Branch (149:6): [True: 0, False: 3.45k] ------------------ 150| 0| return dst; 151| 0| } 152| | 153| 3.45k| return memcpy(dst, src, byte_len); 154| 3.45k|} decode_avx2.c:secure_l32_mask: 111| 55.2k|{ 112| |#if defined(__aarch64__) 113| | uint32_t res; 114| | __asm__ __volatile__("cmp %w[V2], %w[V1]; \n " 115| | "cset %w[RES], HI; \n" 116| | : [RES] "=r"(res) 117| | : [V1] "r"(v1), [V2] "r"(v2) 118| | : "cc" /*The condition code flag*/); 119| | return (res - 1); 120| |#elif defined(__x86_64__) || defined(__i386__) 121| | uint32_t res; 122| 55.2k| __asm__ __volatile__("xor %%edx, %%edx; \n" 123| 55.2k| "cmp %1, %2; \n " 124| 55.2k| "setl %%dl; \n" 125| 55.2k| "dec %%edx; \n" 126| 55.2k| "mov %%edx, %0; \n" 127| | 128| 55.2k| : "=r"(res) 129| 55.2k| : "r"(v2), "r"(v1) 130| 55.2k| : "rdx"); 131| | 132| 55.2k| return res; 133| |#else 134| | // If v1 >= v2 then the subtraction result is 0^32||(v1-v2). 135| | // else it is 1^32||(v2-v1+1). Subsequently, negating the upper 136| | // 32 bits gives 0 if v1 < v2 and otherwise (-1). 137| | return ~((uint32_t)(((uint64_t)v1 - (uint64_t)v2) >> 32)); 138| |#endif 139| 55.2k|} OQS_KEM_bike_l1_new: 8| 5|OQS_KEM *OQS_KEM_bike_l1_new(void) { 9| 5| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 10| 5| if (kem == NULL) { ------------------ | Branch (10:6): [True: 0, False: 5] ------------------ 11| 0| return NULL; 12| 0| } 13| 5| kem->method_name = OQS_KEM_alg_bike_l1; ------------------ | | 35| 5|#define OQS_KEM_alg_bike_l1 "BIKE-L1" ------------------ 14| 5| kem->alg_version = "Additional - 01/27/2023"; 15| | 16| 5| kem->claimed_nist_level = 1; 17| 5| kem->ind_cca = false; 18| | 19| 5| kem->length_public_key = OQS_KEM_bike_l1_length_public_key; ------------------ | | 11| 5|#define OQS_KEM_bike_l1_length_public_key 1541 ------------------ 20| 5| kem->length_secret_key = OQS_KEM_bike_l1_length_secret_key; ------------------ | | 10| 5|#define OQS_KEM_bike_l1_length_secret_key 5223 ------------------ 21| 5| kem->length_ciphertext = OQS_KEM_bike_l1_length_ciphertext; ------------------ | | 12| 5|#define OQS_KEM_bike_l1_length_ciphertext 1573 ------------------ 22| 5| kem->length_shared_secret = OQS_KEM_bike_l1_length_shared_secret; ------------------ | | 13| 5|#define OQS_KEM_bike_l1_length_shared_secret 32 ------------------ 23| 5| kem->length_keypair_seed = OQS_KEM_bike_l1_length_keypair_seed; ------------------ | | 14| 5|#define OQS_KEM_bike_l1_length_keypair_seed 0 ------------------ 24| 5| kem->length_encaps_seed = OQS_KEM_bike_l1_length_encaps_seed; ------------------ | | 15| 5|#define OQS_KEM_bike_l1_length_encaps_seed 0 ------------------ 25| | 26| 5| kem->keypair = OQS_KEM_bike_l1_keypair; 27| 5| kem->keypair_derand = OQS_KEM_bike_l1_keypair_derand; 28| 5| kem->encaps = OQS_KEM_bike_l1_encaps; 29| 5| kem->encaps_derand = OQS_KEM_bike_l1_encaps_derand; 30| 5| kem->decaps = OQS_KEM_bike_l1_decaps; 31| | 32| 5| return kem; 33| 5|} OQS_KEM_bike_l3_new: 37| 1|OQS_KEM *OQS_KEM_bike_l3_new(void) { 38| 1| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 39| 1| if (kem == NULL) { ------------------ | Branch (39:6): [True: 0, False: 1] ------------------ 40| 0| return NULL; 41| 0| } 42| 1| kem->method_name = OQS_KEM_alg_bike_l3; ------------------ | | 37| 1|#define OQS_KEM_alg_bike_l3 "BIKE-L3" ------------------ 43| 1| kem->alg_version = "Additional - 01/27/2023"; 44| | 45| 1| kem->claimed_nist_level = 3; 46| 1| kem->ind_cca = false; 47| | 48| 1| kem->length_public_key = OQS_KEM_bike_l3_length_public_key; ------------------ | | 26| 1|#define OQS_KEM_bike_l3_length_public_key 3083 ------------------ 49| 1| kem->length_secret_key = OQS_KEM_bike_l3_length_secret_key; ------------------ | | 25| 1|#define OQS_KEM_bike_l3_length_secret_key 10105 ------------------ 50| 1| kem->length_ciphertext = OQS_KEM_bike_l3_length_ciphertext; ------------------ | | 27| 1|#define OQS_KEM_bike_l3_length_ciphertext 3115 ------------------ 51| 1| kem->length_shared_secret = OQS_KEM_bike_l3_length_shared_secret; ------------------ | | 28| 1|#define OQS_KEM_bike_l3_length_shared_secret 32 ------------------ 52| 1| kem->length_keypair_seed = OQS_KEM_bike_l3_length_keypair_seed; ------------------ | | 29| 1|#define OQS_KEM_bike_l3_length_keypair_seed 0 ------------------ 53| 1| kem->length_encaps_seed = OQS_KEM_bike_l3_length_encaps_seed; ------------------ | | 30| 1|#define OQS_KEM_bike_l3_length_encaps_seed 0 ------------------ 54| | 55| 1| kem->keypair = OQS_KEM_bike_l3_keypair; 56| 1| kem->keypair_derand = OQS_KEM_bike_l3_keypair_derand; 57| 1| kem->encaps = OQS_KEM_bike_l3_encaps; 58| 1| kem->encaps_derand = OQS_KEM_bike_l3_encaps_derand; 59| 1| kem->decaps = OQS_KEM_bike_l3_decaps; 60| | 61| 1| return kem; 62| 1|} OQS_KEM_bike_l5_new: 66| 1|OQS_KEM *OQS_KEM_bike_l5_new(void) { 67| 1| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 68| 1| if (kem == NULL) { ------------------ | Branch (68:6): [True: 0, False: 1] ------------------ 69| 0| return NULL; 70| 0| } 71| 1| kem->method_name = OQS_KEM_alg_bike_l5; ------------------ | | 39| 1|#define OQS_KEM_alg_bike_l5 "BIKE-L5" ------------------ 72| 1| kem->alg_version = "Additional - 01/07/2023"; 73| | 74| 1| kem->claimed_nist_level = 5; 75| 1| kem->ind_cca = false; 76| | 77| 1| kem->length_public_key = OQS_KEM_bike_l5_length_public_key; ------------------ | | 41| 1|#define OQS_KEM_bike_l5_length_public_key 5122 ------------------ 78| 1| kem->length_secret_key = OQS_KEM_bike_l5_length_secret_key; ------------------ | | 40| 1|#define OQS_KEM_bike_l5_length_secret_key 16494 ------------------ 79| 1| kem->length_ciphertext = OQS_KEM_bike_l5_length_ciphertext; ------------------ | | 42| 1|#define OQS_KEM_bike_l5_length_ciphertext 5154 ------------------ 80| 1| kem->length_shared_secret = OQS_KEM_bike_l5_length_shared_secret; ------------------ | | 43| 1|#define OQS_KEM_bike_l5_length_shared_secret 32 ------------------ 81| 1| kem->length_keypair_seed = OQS_KEM_bike_l5_length_keypair_seed; ------------------ | | 44| 1|#define OQS_KEM_bike_l5_length_keypair_seed 0 ------------------ 82| 1| kem->length_encaps_seed = OQS_KEM_bike_l5_length_encaps_seed; ------------------ | | 45| 1|#define OQS_KEM_bike_l5_length_encaps_seed 0 ------------------ 83| | 84| 1| kem->keypair = OQS_KEM_bike_l5_keypair; 85| 1| kem->keypair_derand = OQS_KEM_bike_l5_keypair_derand; 86| 1| kem->encaps = OQS_KEM_bike_l5_encaps; 87| 1| kem->encaps_derand = OQS_KEM_bike_l5_encaps_derand; 88| 1| kem->decaps = OQS_KEM_bike_l5_decaps; 89| | 90| 1| return kem; 91| 1|} OQS_KEM_classic_mceliece_348864_new: 9| 102|OQS_KEM *OQS_KEM_classic_mceliece_348864_new(void) { 10| | 11| 102| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 102| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 102] ------------------ 13| 0| return NULL; 14| 0| } 15| 102| kem->method_name = OQS_KEM_alg_classic_mceliece_348864; ------------------ | | 42| 102|#define OQS_KEM_alg_classic_mceliece_348864 "Classic-McEliece-348864" ------------------ 16| 102| kem->alg_version = "SUPERCOP-20221025"; 17| | 18| 102| kem->claimed_nist_level = 1; 19| 102| kem->ind_cca = true; 20| | 21| 102| kem->length_public_key = OQS_KEM_classic_mceliece_348864_length_public_key; ------------------ | | 9| 102|#define OQS_KEM_classic_mceliece_348864_length_public_key 261120 ------------------ 22| 102| kem->length_secret_key = OQS_KEM_classic_mceliece_348864_length_secret_key; ------------------ | | 10| 102|#define OQS_KEM_classic_mceliece_348864_length_secret_key 6492 ------------------ 23| 102| kem->length_ciphertext = OQS_KEM_classic_mceliece_348864_length_ciphertext; ------------------ | | 11| 102|#define OQS_KEM_classic_mceliece_348864_length_ciphertext 96 ------------------ 24| 102| kem->length_shared_secret = OQS_KEM_classic_mceliece_348864_length_shared_secret; ------------------ | | 12| 102|#define OQS_KEM_classic_mceliece_348864_length_shared_secret 32 ------------------ 25| 102| kem->length_keypair_seed = OQS_KEM_classic_mceliece_348864_length_keypair_seed; ------------------ | | 13| 102|#define OQS_KEM_classic_mceliece_348864_length_keypair_seed 0 ------------------ 26| 102| kem->length_encaps_seed = OQS_KEM_classic_mceliece_348864_length_encaps_seed; ------------------ | | 14| 102|#define OQS_KEM_classic_mceliece_348864_length_encaps_seed 0 ------------------ 27| | 28| 102| kem->keypair = OQS_KEM_classic_mceliece_348864_keypair; 29| 102| kem->keypair_derand = OQS_KEM_classic_mceliece_348864_keypair_derand; 30| 102| kem->encaps = OQS_KEM_classic_mceliece_348864_encaps; 31| 102| kem->encaps_derand = OQS_KEM_classic_mceliece_348864_encaps_derand; 32| 102| kem->decaps = OQS_KEM_classic_mceliece_348864_decaps; 33| | 34| 102| return kem; 35| 102|} OQS_KEM_classic_mceliece_348864_keypair: 54| 102|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_348864_keypair(uint8_t *public_key, uint8_t *secret_key) { 55| 102|#if defined(OQS_ENABLE_KEM_classic_mceliece_348864_avx2) 56| 102|#if defined(OQS_DIST_BUILD) 57| 102| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (57:6): [True: 102, False: 0] | Branch (57:49): [True: 102, False: 0] ------------------ 58| 102|#endif /* OQS_DIST_BUILD */ 59| 102| return (OQS_STATUS) PQCLEAN_MCELIECE348864_AVX2_crypto_kem_keypair(public_key, secret_key); 60| 102|#if defined(OQS_DIST_BUILD) 61| 102| } else { 62| 0| return (OQS_STATUS) PQCLEAN_MCELIECE348864_CLEAN_crypto_kem_keypair(public_key, secret_key); 63| 0| } 64| 102|#endif /* OQS_DIST_BUILD */ 65| |#else 66| | return (OQS_STATUS) PQCLEAN_MCELIECE348864_CLEAN_crypto_kem_keypair(public_key, secret_key); 67| |#endif 68| 102|} OQS_KEM_classic_mceliece_348864_encaps: 78| 102|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_348864_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 102|#if defined(OQS_ENABLE_KEM_classic_mceliece_348864_avx2) 80| 102|#if defined(OQS_DIST_BUILD) 81| 102| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (81:6): [True: 102, False: 0] | Branch (81:49): [True: 102, False: 0] ------------------ 82| 102|#endif /* OQS_DIST_BUILD */ 83| 102| return (OQS_STATUS) PQCLEAN_MCELIECE348864_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 102|#if defined(OQS_DIST_BUILD) 85| 102| } else { 86| 0| return (OQS_STATUS) PQCLEAN_MCELIECE348864_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 102|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_MCELIECE348864_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 102|} OQS_KEM_classic_mceliece_348864_decaps: 94| 102|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_348864_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 102|#if defined(OQS_ENABLE_KEM_classic_mceliece_348864_avx2) 96| 102|#if defined(OQS_DIST_BUILD) 97| 102| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (97:6): [True: 102, False: 0] | Branch (97:49): [True: 102, False: 0] ------------------ 98| 102|#endif /* OQS_DIST_BUILD */ 99| 102| return (OQS_STATUS) PQCLEAN_MCELIECE348864_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 102|#if defined(OQS_DIST_BUILD) 101| 102| } else { 102| 0| return (OQS_STATUS) PQCLEAN_MCELIECE348864_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 102|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_MCELIECE348864_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 102|} OQS_KEM_classic_mceliece_348864f_new: 9| 78|OQS_KEM *OQS_KEM_classic_mceliece_348864f_new(void) { 10| | 11| 78| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 78| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 78] ------------------ 13| 0| return NULL; 14| 0| } 15| 78| kem->method_name = OQS_KEM_alg_classic_mceliece_348864f; ------------------ | | 44| 78|#define OQS_KEM_alg_classic_mceliece_348864f "Classic-McEliece-348864f" ------------------ 16| 78| kem->alg_version = "SUPERCOP-20221025"; 17| | 18| 78| kem->claimed_nist_level = 1; 19| 78| kem->ind_cca = true; 20| | 21| 78| kem->length_public_key = OQS_KEM_classic_mceliece_348864f_length_public_key; ------------------ | | 24| 78|#define OQS_KEM_classic_mceliece_348864f_length_public_key 261120 ------------------ 22| 78| kem->length_secret_key = OQS_KEM_classic_mceliece_348864f_length_secret_key; ------------------ | | 25| 78|#define OQS_KEM_classic_mceliece_348864f_length_secret_key 6492 ------------------ 23| 78| kem->length_ciphertext = OQS_KEM_classic_mceliece_348864f_length_ciphertext; ------------------ | | 26| 78|#define OQS_KEM_classic_mceliece_348864f_length_ciphertext 96 ------------------ 24| 78| kem->length_shared_secret = OQS_KEM_classic_mceliece_348864f_length_shared_secret; ------------------ | | 27| 78|#define OQS_KEM_classic_mceliece_348864f_length_shared_secret 32 ------------------ 25| 78| kem->length_keypair_seed = OQS_KEM_classic_mceliece_348864f_length_keypair_seed; ------------------ | | 28| 78|#define OQS_KEM_classic_mceliece_348864f_length_keypair_seed 0 ------------------ 26| 78| kem->length_encaps_seed = OQS_KEM_classic_mceliece_348864f_length_encaps_seed; ------------------ | | 29| 78|#define OQS_KEM_classic_mceliece_348864f_length_encaps_seed 0 ------------------ 27| | 28| 78| kem->keypair = OQS_KEM_classic_mceliece_348864f_keypair; 29| 78| kem->keypair_derand = OQS_KEM_classic_mceliece_348864f_keypair_derand; 30| 78| kem->encaps = OQS_KEM_classic_mceliece_348864f_encaps; 31| 78| kem->encaps_derand = OQS_KEM_classic_mceliece_348864f_encaps_derand; 32| 78| kem->decaps = OQS_KEM_classic_mceliece_348864f_decaps; 33| | 34| 78| return kem; 35| 78|} OQS_KEM_classic_mceliece_348864f_keypair: 54| 78|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_348864f_keypair(uint8_t *public_key, uint8_t *secret_key) { 55| 78|#if defined(OQS_ENABLE_KEM_classic_mceliece_348864f_avx2) 56| 78|#if defined(OQS_DIST_BUILD) 57| 78| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (57:6): [True: 78, False: 0] | Branch (57:49): [True: 78, False: 0] | Branch (57:94): [True: 78, False: 0] ------------------ 58| 78|#endif /* OQS_DIST_BUILD */ 59| 78| return (OQS_STATUS) PQCLEAN_MCELIECE348864F_AVX2_crypto_kem_keypair(public_key, secret_key); 60| 78|#if defined(OQS_DIST_BUILD) 61| 78| } else { 62| 0| return (OQS_STATUS) PQCLEAN_MCELIECE348864F_CLEAN_crypto_kem_keypair(public_key, secret_key); 63| 0| } 64| 78|#endif /* OQS_DIST_BUILD */ 65| |#else 66| | return (OQS_STATUS) PQCLEAN_MCELIECE348864F_CLEAN_crypto_kem_keypair(public_key, secret_key); 67| |#endif 68| 78|} OQS_KEM_classic_mceliece_348864f_encaps: 78| 78|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_348864f_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 78|#if defined(OQS_ENABLE_KEM_classic_mceliece_348864f_avx2) 80| 78|#if defined(OQS_DIST_BUILD) 81| 78| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (81:6): [True: 78, False: 0] | Branch (81:49): [True: 78, False: 0] | Branch (81:94): [True: 78, False: 0] ------------------ 82| 78|#endif /* OQS_DIST_BUILD */ 83| 78| return (OQS_STATUS) PQCLEAN_MCELIECE348864F_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 78|#if defined(OQS_DIST_BUILD) 85| 78| } else { 86| 0| return (OQS_STATUS) PQCLEAN_MCELIECE348864F_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 78|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_MCELIECE348864F_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 78|} OQS_KEM_classic_mceliece_348864f_decaps: 94| 78|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_348864f_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 78|#if defined(OQS_ENABLE_KEM_classic_mceliece_348864f_avx2) 96| 78|#if defined(OQS_DIST_BUILD) 97| 78| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (97:6): [True: 78, False: 0] | Branch (97:49): [True: 78, False: 0] | Branch (97:94): [True: 78, False: 0] ------------------ 98| 78|#endif /* OQS_DIST_BUILD */ 99| 78| return (OQS_STATUS) PQCLEAN_MCELIECE348864F_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 78|#if defined(OQS_DIST_BUILD) 101| 78| } else { 102| 0| return (OQS_STATUS) PQCLEAN_MCELIECE348864F_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 78|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_MCELIECE348864F_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 78|} OQS_KEM_classic_mceliece_460896_new: 9| 116|OQS_KEM *OQS_KEM_classic_mceliece_460896_new(void) { 10| | 11| 116| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 116| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 116] ------------------ 13| 0| return NULL; 14| 0| } 15| 116| kem->method_name = OQS_KEM_alg_classic_mceliece_460896; ------------------ | | 46| 116|#define OQS_KEM_alg_classic_mceliece_460896 "Classic-McEliece-460896" ------------------ 16| 116| kem->alg_version = "SUPERCOP-20221025"; 17| | 18| 116| kem->claimed_nist_level = 3; 19| 116| kem->ind_cca = true; 20| | 21| 116| kem->length_public_key = OQS_KEM_classic_mceliece_460896_length_public_key; ------------------ | | 39| 116|#define OQS_KEM_classic_mceliece_460896_length_public_key 524160 ------------------ 22| 116| kem->length_secret_key = OQS_KEM_classic_mceliece_460896_length_secret_key; ------------------ | | 40| 116|#define OQS_KEM_classic_mceliece_460896_length_secret_key 13608 ------------------ 23| 116| kem->length_ciphertext = OQS_KEM_classic_mceliece_460896_length_ciphertext; ------------------ | | 41| 116|#define OQS_KEM_classic_mceliece_460896_length_ciphertext 156 ------------------ 24| 116| kem->length_shared_secret = OQS_KEM_classic_mceliece_460896_length_shared_secret; ------------------ | | 42| 116|#define OQS_KEM_classic_mceliece_460896_length_shared_secret 32 ------------------ 25| 116| kem->length_keypair_seed = OQS_KEM_classic_mceliece_460896_length_keypair_seed; ------------------ | | 43| 116|#define OQS_KEM_classic_mceliece_460896_length_keypair_seed 0 ------------------ 26| 116| kem->length_encaps_seed = OQS_KEM_classic_mceliece_460896_length_encaps_seed; ------------------ | | 44| 116|#define OQS_KEM_classic_mceliece_460896_length_encaps_seed 0 ------------------ 27| | 28| 116| kem->keypair = OQS_KEM_classic_mceliece_460896_keypair; 29| 116| kem->keypair_derand = OQS_KEM_classic_mceliece_460896_keypair_derand; 30| 116| kem->encaps = OQS_KEM_classic_mceliece_460896_encaps; 31| 116| kem->encaps_derand = OQS_KEM_classic_mceliece_460896_encaps_derand; 32| 116| kem->decaps = OQS_KEM_classic_mceliece_460896_decaps; 33| | 34| 116| return kem; 35| 116|} OQS_KEM_classic_mceliece_460896_keypair: 54| 116|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_460896_keypair(uint8_t *public_key, uint8_t *secret_key) { 55| 116|#if defined(OQS_ENABLE_KEM_classic_mceliece_460896_avx2) 56| 116|#if defined(OQS_DIST_BUILD) 57| 116| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (57:6): [True: 116, False: 0] | Branch (57:49): [True: 116, False: 0] ------------------ 58| 116|#endif /* OQS_DIST_BUILD */ 59| 116| return (OQS_STATUS) PQCLEAN_MCELIECE460896_AVX2_crypto_kem_keypair(public_key, secret_key); 60| 116|#if defined(OQS_DIST_BUILD) 61| 116| } else { 62| 0| return (OQS_STATUS) PQCLEAN_MCELIECE460896_CLEAN_crypto_kem_keypair(public_key, secret_key); 63| 0| } 64| 116|#endif /* OQS_DIST_BUILD */ 65| |#else 66| | return (OQS_STATUS) PQCLEAN_MCELIECE460896_CLEAN_crypto_kem_keypair(public_key, secret_key); 67| |#endif 68| 116|} OQS_KEM_classic_mceliece_460896_encaps: 78| 116|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_460896_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 116|#if defined(OQS_ENABLE_KEM_classic_mceliece_460896_avx2) 80| 116|#if defined(OQS_DIST_BUILD) 81| 116| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (81:6): [True: 116, False: 0] | Branch (81:49): [True: 116, False: 0] ------------------ 82| 116|#endif /* OQS_DIST_BUILD */ 83| 116| return (OQS_STATUS) PQCLEAN_MCELIECE460896_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 116|#if defined(OQS_DIST_BUILD) 85| 116| } else { 86| 0| return (OQS_STATUS) PQCLEAN_MCELIECE460896_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 116|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_MCELIECE460896_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 116|} OQS_KEM_classic_mceliece_460896_decaps: 94| 116|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_460896_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 116|#if defined(OQS_ENABLE_KEM_classic_mceliece_460896_avx2) 96| 116|#if defined(OQS_DIST_BUILD) 97| 116| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (97:6): [True: 116, False: 0] | Branch (97:49): [True: 116, False: 0] ------------------ 98| 116|#endif /* OQS_DIST_BUILD */ 99| 116| return (OQS_STATUS) PQCLEAN_MCELIECE460896_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 116|#if defined(OQS_DIST_BUILD) 101| 116| } else { 102| 0| return (OQS_STATUS) PQCLEAN_MCELIECE460896_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 116|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_MCELIECE460896_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 116|} OQS_KEM_classic_mceliece_460896f_new: 9| 92|OQS_KEM *OQS_KEM_classic_mceliece_460896f_new(void) { 10| | 11| 92| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 92| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 92] ------------------ 13| 0| return NULL; 14| 0| } 15| 92| kem->method_name = OQS_KEM_alg_classic_mceliece_460896f; ------------------ | | 48| 92|#define OQS_KEM_alg_classic_mceliece_460896f "Classic-McEliece-460896f" ------------------ 16| 92| kem->alg_version = "SUPERCOP-20221025"; 17| | 18| 92| kem->claimed_nist_level = 3; 19| 92| kem->ind_cca = true; 20| | 21| 92| kem->length_public_key = OQS_KEM_classic_mceliece_460896f_length_public_key; ------------------ | | 54| 92|#define OQS_KEM_classic_mceliece_460896f_length_public_key 524160 ------------------ 22| 92| kem->length_secret_key = OQS_KEM_classic_mceliece_460896f_length_secret_key; ------------------ | | 55| 92|#define OQS_KEM_classic_mceliece_460896f_length_secret_key 13608 ------------------ 23| 92| kem->length_ciphertext = OQS_KEM_classic_mceliece_460896f_length_ciphertext; ------------------ | | 56| 92|#define OQS_KEM_classic_mceliece_460896f_length_ciphertext 156 ------------------ 24| 92| kem->length_shared_secret = OQS_KEM_classic_mceliece_460896f_length_shared_secret; ------------------ | | 57| 92|#define OQS_KEM_classic_mceliece_460896f_length_shared_secret 32 ------------------ 25| 92| kem->length_keypair_seed = OQS_KEM_classic_mceliece_460896f_length_keypair_seed; ------------------ | | 58| 92|#define OQS_KEM_classic_mceliece_460896f_length_keypair_seed 0 ------------------ 26| 92| kem->length_encaps_seed = OQS_KEM_classic_mceliece_460896f_length_encaps_seed; ------------------ | | 59| 92|#define OQS_KEM_classic_mceliece_460896f_length_encaps_seed 0 ------------------ 27| | 28| 92| kem->keypair = OQS_KEM_classic_mceliece_460896f_keypair; 29| 92| kem->keypair_derand = OQS_KEM_classic_mceliece_460896f_keypair_derand; 30| 92| kem->encaps = OQS_KEM_classic_mceliece_460896f_encaps; 31| 92| kem->encaps_derand = OQS_KEM_classic_mceliece_460896f_encaps_derand; 32| 92| kem->decaps = OQS_KEM_classic_mceliece_460896f_decaps; 33| | 34| 92| return kem; 35| 92|} OQS_KEM_classic_mceliece_460896f_keypair: 54| 92|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_460896f_keypair(uint8_t *public_key, uint8_t *secret_key) { 55| 92|#if defined(OQS_ENABLE_KEM_classic_mceliece_460896f_avx2) 56| 92|#if defined(OQS_DIST_BUILD) 57| 92| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (57:6): [True: 92, False: 0] | Branch (57:49): [True: 92, False: 0] | Branch (57:94): [True: 92, False: 0] ------------------ 58| 92|#endif /* OQS_DIST_BUILD */ 59| 92| return (OQS_STATUS) PQCLEAN_MCELIECE460896F_AVX2_crypto_kem_keypair(public_key, secret_key); 60| 92|#if defined(OQS_DIST_BUILD) 61| 92| } else { 62| 0| return (OQS_STATUS) PQCLEAN_MCELIECE460896F_CLEAN_crypto_kem_keypair(public_key, secret_key); 63| 0| } 64| 92|#endif /* OQS_DIST_BUILD */ 65| |#else 66| | return (OQS_STATUS) PQCLEAN_MCELIECE460896F_CLEAN_crypto_kem_keypair(public_key, secret_key); 67| |#endif 68| 92|} OQS_KEM_classic_mceliece_460896f_encaps: 78| 92|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_460896f_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 92|#if defined(OQS_ENABLE_KEM_classic_mceliece_460896f_avx2) 80| 92|#if defined(OQS_DIST_BUILD) 81| 92| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (81:6): [True: 92, False: 0] | Branch (81:49): [True: 92, False: 0] | Branch (81:94): [True: 92, False: 0] ------------------ 82| 92|#endif /* OQS_DIST_BUILD */ 83| 92| return (OQS_STATUS) PQCLEAN_MCELIECE460896F_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 92|#if defined(OQS_DIST_BUILD) 85| 92| } else { 86| 0| return (OQS_STATUS) PQCLEAN_MCELIECE460896F_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 92|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_MCELIECE460896F_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 92|} OQS_KEM_classic_mceliece_460896f_decaps: 94| 92|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_460896f_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 92|#if defined(OQS_ENABLE_KEM_classic_mceliece_460896f_avx2) 96| 92|#if defined(OQS_DIST_BUILD) 97| 92| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (97:6): [True: 92, False: 0] | Branch (97:49): [True: 92, False: 0] | Branch (97:94): [True: 92, False: 0] ------------------ 98| 92|#endif /* OQS_DIST_BUILD */ 99| 92| return (OQS_STATUS) PQCLEAN_MCELIECE460896F_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 92|#if defined(OQS_DIST_BUILD) 101| 92| } else { 102| 0| return (OQS_STATUS) PQCLEAN_MCELIECE460896F_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 92|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_MCELIECE460896F_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 92|} OQS_KEM_classic_mceliece_6688128_new: 9| 102|OQS_KEM *OQS_KEM_classic_mceliece_6688128_new(void) { 10| | 11| 102| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 102| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 102] ------------------ 13| 0| return NULL; 14| 0| } 15| 102| kem->method_name = OQS_KEM_alg_classic_mceliece_6688128; ------------------ | | 50| 102|#define OQS_KEM_alg_classic_mceliece_6688128 "Classic-McEliece-6688128" ------------------ 16| 102| kem->alg_version = "SUPERCOP-20221025"; 17| | 18| 102| kem->claimed_nist_level = 5; 19| 102| kem->ind_cca = true; 20| | 21| 102| kem->length_public_key = OQS_KEM_classic_mceliece_6688128_length_public_key; ------------------ | | 69| 102|#define OQS_KEM_classic_mceliece_6688128_length_public_key 1044992 ------------------ 22| 102| kem->length_secret_key = OQS_KEM_classic_mceliece_6688128_length_secret_key; ------------------ | | 70| 102|#define OQS_KEM_classic_mceliece_6688128_length_secret_key 13932 ------------------ 23| 102| kem->length_ciphertext = OQS_KEM_classic_mceliece_6688128_length_ciphertext; ------------------ | | 71| 102|#define OQS_KEM_classic_mceliece_6688128_length_ciphertext 208 ------------------ 24| 102| kem->length_shared_secret = OQS_KEM_classic_mceliece_6688128_length_shared_secret; ------------------ | | 72| 102|#define OQS_KEM_classic_mceliece_6688128_length_shared_secret 32 ------------------ 25| 102| kem->length_keypair_seed = OQS_KEM_classic_mceliece_6688128_length_keypair_seed; ------------------ | | 73| 102|#define OQS_KEM_classic_mceliece_6688128_length_keypair_seed 0 ------------------ 26| 102| kem->length_encaps_seed = OQS_KEM_classic_mceliece_6688128_length_encaps_seed; ------------------ | | 74| 102|#define OQS_KEM_classic_mceliece_6688128_length_encaps_seed 0 ------------------ 27| | 28| 102| kem->keypair = OQS_KEM_classic_mceliece_6688128_keypair; 29| 102| kem->keypair_derand = OQS_KEM_classic_mceliece_6688128_keypair_derand; 30| 102| kem->encaps = OQS_KEM_classic_mceliece_6688128_encaps; 31| 102| kem->encaps_derand = OQS_KEM_classic_mceliece_6688128_encaps_derand; 32| 102| kem->decaps = OQS_KEM_classic_mceliece_6688128_decaps; 33| | 34| 102| return kem; 35| 102|} OQS_KEM_classic_mceliece_6688128_keypair: 54| 102|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6688128_keypair(uint8_t *public_key, uint8_t *secret_key) { 55| 102|#if defined(OQS_ENABLE_KEM_classic_mceliece_6688128_avx2) 56| 102|#if defined(OQS_DIST_BUILD) 57| 102| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (57:6): [True: 102, False: 0] | Branch (57:49): [True: 102, False: 0] ------------------ 58| 102|#endif /* OQS_DIST_BUILD */ 59| 102| return (OQS_STATUS) PQCLEAN_MCELIECE6688128_AVX2_crypto_kem_keypair(public_key, secret_key); 60| 102|#if defined(OQS_DIST_BUILD) 61| 102| } else { 62| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6688128_CLEAN_crypto_kem_keypair(public_key, secret_key); 63| 0| } 64| 102|#endif /* OQS_DIST_BUILD */ 65| |#else 66| | return (OQS_STATUS) PQCLEAN_MCELIECE6688128_CLEAN_crypto_kem_keypair(public_key, secret_key); 67| |#endif 68| 102|} OQS_KEM_classic_mceliece_6688128_encaps: 78| 102|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6688128_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 102|#if defined(OQS_ENABLE_KEM_classic_mceliece_6688128_avx2) 80| 102|#if defined(OQS_DIST_BUILD) 81| 102| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (81:6): [True: 102, False: 0] | Branch (81:49): [True: 102, False: 0] ------------------ 82| 102|#endif /* OQS_DIST_BUILD */ 83| 102| return (OQS_STATUS) PQCLEAN_MCELIECE6688128_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 102|#if defined(OQS_DIST_BUILD) 85| 102| } else { 86| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6688128_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 102|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_MCELIECE6688128_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 102|} OQS_KEM_classic_mceliece_6688128_decaps: 94| 102|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6688128_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 102|#if defined(OQS_ENABLE_KEM_classic_mceliece_6688128_avx2) 96| 102|#if defined(OQS_DIST_BUILD) 97| 102| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (97:6): [True: 102, False: 0] | Branch (97:49): [True: 102, False: 0] ------------------ 98| 102|#endif /* OQS_DIST_BUILD */ 99| 102| return (OQS_STATUS) PQCLEAN_MCELIECE6688128_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 102|#if defined(OQS_DIST_BUILD) 101| 102| } else { 102| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6688128_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 102|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_MCELIECE6688128_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 102|} OQS_KEM_classic_mceliece_6688128f_new: 9| 90|OQS_KEM *OQS_KEM_classic_mceliece_6688128f_new(void) { 10| | 11| 90| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 90| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 90] ------------------ 13| 0| return NULL; 14| 0| } 15| 90| kem->method_name = OQS_KEM_alg_classic_mceliece_6688128f; ------------------ | | 52| 90|#define OQS_KEM_alg_classic_mceliece_6688128f "Classic-McEliece-6688128f" ------------------ 16| 90| kem->alg_version = "SUPERCOP-20221025"; 17| | 18| 90| kem->claimed_nist_level = 5; 19| 90| kem->ind_cca = true; 20| | 21| 90| kem->length_public_key = OQS_KEM_classic_mceliece_6688128f_length_public_key; ------------------ | | 84| 90|#define OQS_KEM_classic_mceliece_6688128f_length_public_key 1044992 ------------------ 22| 90| kem->length_secret_key = OQS_KEM_classic_mceliece_6688128f_length_secret_key; ------------------ | | 85| 90|#define OQS_KEM_classic_mceliece_6688128f_length_secret_key 13932 ------------------ 23| 90| kem->length_ciphertext = OQS_KEM_classic_mceliece_6688128f_length_ciphertext; ------------------ | | 86| 90|#define OQS_KEM_classic_mceliece_6688128f_length_ciphertext 208 ------------------ 24| 90| kem->length_shared_secret = OQS_KEM_classic_mceliece_6688128f_length_shared_secret; ------------------ | | 87| 90|#define OQS_KEM_classic_mceliece_6688128f_length_shared_secret 32 ------------------ 25| 90| kem->length_keypair_seed = OQS_KEM_classic_mceliece_6688128f_length_keypair_seed; ------------------ | | 88| 90|#define OQS_KEM_classic_mceliece_6688128f_length_keypair_seed 0 ------------------ 26| 90| kem->length_encaps_seed = OQS_KEM_classic_mceliece_6688128f_length_encaps_seed; ------------------ | | 89| 90|#define OQS_KEM_classic_mceliece_6688128f_length_encaps_seed 0 ------------------ 27| | 28| 90| kem->keypair = OQS_KEM_classic_mceliece_6688128f_keypair; 29| 90| kem->keypair_derand = OQS_KEM_classic_mceliece_6688128f_keypair_derand; 30| 90| kem->encaps = OQS_KEM_classic_mceliece_6688128f_encaps; 31| 90| kem->encaps_derand = OQS_KEM_classic_mceliece_6688128f_encaps_derand; 32| 90| kem->decaps = OQS_KEM_classic_mceliece_6688128f_decaps; 33| | 34| 90| return kem; 35| 90|} OQS_KEM_classic_mceliece_6688128f_keypair: 54| 90|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6688128f_keypair(uint8_t *public_key, uint8_t *secret_key) { 55| 90|#if defined(OQS_ENABLE_KEM_classic_mceliece_6688128f_avx2) 56| 90|#if defined(OQS_DIST_BUILD) 57| 90| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (57:6): [True: 90, False: 0] | Branch (57:49): [True: 90, False: 0] | Branch (57:94): [True: 90, False: 0] ------------------ 58| 90|#endif /* OQS_DIST_BUILD */ 59| 90| return (OQS_STATUS) PQCLEAN_MCELIECE6688128F_AVX2_crypto_kem_keypair(public_key, secret_key); 60| 90|#if defined(OQS_DIST_BUILD) 61| 90| } else { 62| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6688128F_CLEAN_crypto_kem_keypair(public_key, secret_key); 63| 0| } 64| 90|#endif /* OQS_DIST_BUILD */ 65| |#else 66| | return (OQS_STATUS) PQCLEAN_MCELIECE6688128F_CLEAN_crypto_kem_keypair(public_key, secret_key); 67| |#endif 68| 90|} OQS_KEM_classic_mceliece_6688128f_encaps: 78| 90|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6688128f_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 90|#if defined(OQS_ENABLE_KEM_classic_mceliece_6688128f_avx2) 80| 90|#if defined(OQS_DIST_BUILD) 81| 90| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (81:6): [True: 90, False: 0] | Branch (81:49): [True: 90, False: 0] | Branch (81:94): [True: 90, False: 0] ------------------ 82| 90|#endif /* OQS_DIST_BUILD */ 83| 90| return (OQS_STATUS) PQCLEAN_MCELIECE6688128F_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 90|#if defined(OQS_DIST_BUILD) 85| 90| } else { 86| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6688128F_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 90|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_MCELIECE6688128F_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 90|} OQS_KEM_classic_mceliece_6688128f_decaps: 94| 90|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6688128f_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 90|#if defined(OQS_ENABLE_KEM_classic_mceliece_6688128f_avx2) 96| 90|#if defined(OQS_DIST_BUILD) 97| 90| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (97:6): [True: 90, False: 0] | Branch (97:49): [True: 90, False: 0] | Branch (97:94): [True: 90, False: 0] ------------------ 98| 90|#endif /* OQS_DIST_BUILD */ 99| 90| return (OQS_STATUS) PQCLEAN_MCELIECE6688128F_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 90|#if defined(OQS_DIST_BUILD) 101| 90| } else { 102| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6688128F_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 90|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_MCELIECE6688128F_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 90|} OQS_KEM_classic_mceliece_6960119_new: 9| 114|OQS_KEM *OQS_KEM_classic_mceliece_6960119_new(void) { 10| | 11| 114| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 114| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 114] ------------------ 13| 0| return NULL; 14| 0| } 15| 114| kem->method_name = OQS_KEM_alg_classic_mceliece_6960119; ------------------ | | 54| 114|#define OQS_KEM_alg_classic_mceliece_6960119 "Classic-McEliece-6960119" ------------------ 16| 114| kem->alg_version = "SUPERCOP-20221025"; 17| | 18| 114| kem->claimed_nist_level = 5; 19| 114| kem->ind_cca = true; 20| | 21| 114| kem->length_public_key = OQS_KEM_classic_mceliece_6960119_length_public_key; ------------------ | | 99| 114|#define OQS_KEM_classic_mceliece_6960119_length_public_key 1047319 ------------------ 22| 114| kem->length_secret_key = OQS_KEM_classic_mceliece_6960119_length_secret_key; ------------------ | | 100| 114|#define OQS_KEM_classic_mceliece_6960119_length_secret_key 13948 ------------------ 23| 114| kem->length_ciphertext = OQS_KEM_classic_mceliece_6960119_length_ciphertext; ------------------ | | 101| 114|#define OQS_KEM_classic_mceliece_6960119_length_ciphertext 194 ------------------ 24| 114| kem->length_shared_secret = OQS_KEM_classic_mceliece_6960119_length_shared_secret; ------------------ | | 102| 114|#define OQS_KEM_classic_mceliece_6960119_length_shared_secret 32 ------------------ 25| 114| kem->length_keypair_seed = OQS_KEM_classic_mceliece_6960119_length_keypair_seed; ------------------ | | 103| 114|#define OQS_KEM_classic_mceliece_6960119_length_keypair_seed 0 ------------------ 26| 114| kem->length_encaps_seed = OQS_KEM_classic_mceliece_6960119_length_encaps_seed; ------------------ | | 104| 114|#define OQS_KEM_classic_mceliece_6960119_length_encaps_seed 0 ------------------ 27| | 28| 114| kem->keypair = OQS_KEM_classic_mceliece_6960119_keypair; 29| 114| kem->keypair_derand = OQS_KEM_classic_mceliece_6960119_keypair_derand; 30| 114| kem->encaps = OQS_KEM_classic_mceliece_6960119_encaps; 31| 114| kem->encaps_derand = OQS_KEM_classic_mceliece_6960119_encaps_derand; 32| 114| kem->decaps = OQS_KEM_classic_mceliece_6960119_decaps; 33| | 34| 114| return kem; 35| 114|} OQS_KEM_classic_mceliece_6960119_keypair: 54| 114|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6960119_keypair(uint8_t *public_key, uint8_t *secret_key) { 55| 114|#if defined(OQS_ENABLE_KEM_classic_mceliece_6960119_avx2) 56| 114|#if defined(OQS_DIST_BUILD) 57| 114| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (57:6): [True: 114, False: 0] | Branch (57:49): [True: 114, False: 0] ------------------ 58| 114|#endif /* OQS_DIST_BUILD */ 59| 114| return (OQS_STATUS) PQCLEAN_MCELIECE6960119_AVX2_crypto_kem_keypair(public_key, secret_key); 60| 114|#if defined(OQS_DIST_BUILD) 61| 114| } else { 62| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6960119_CLEAN_crypto_kem_keypair(public_key, secret_key); 63| 0| } 64| 114|#endif /* OQS_DIST_BUILD */ 65| |#else 66| | return (OQS_STATUS) PQCLEAN_MCELIECE6960119_CLEAN_crypto_kem_keypair(public_key, secret_key); 67| |#endif 68| 114|} OQS_KEM_classic_mceliece_6960119_encaps: 78| 114|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6960119_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 114|#if defined(OQS_ENABLE_KEM_classic_mceliece_6960119_avx2) 80| 114|#if defined(OQS_DIST_BUILD) 81| 114| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (81:6): [True: 114, False: 0] | Branch (81:49): [True: 114, False: 0] ------------------ 82| 114|#endif /* OQS_DIST_BUILD */ 83| 114| return (OQS_STATUS) PQCLEAN_MCELIECE6960119_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 114|#if defined(OQS_DIST_BUILD) 85| 114| } else { 86| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6960119_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 114|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_MCELIECE6960119_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 114|} OQS_KEM_classic_mceliece_6960119_decaps: 94| 114|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6960119_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 114|#if defined(OQS_ENABLE_KEM_classic_mceliece_6960119_avx2) 96| 114|#if defined(OQS_DIST_BUILD) 97| 114| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (97:6): [True: 114, False: 0] | Branch (97:49): [True: 114, False: 0] ------------------ 98| 114|#endif /* OQS_DIST_BUILD */ 99| 114| return (OQS_STATUS) PQCLEAN_MCELIECE6960119_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 114|#if defined(OQS_DIST_BUILD) 101| 114| } else { 102| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6960119_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 114|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_MCELIECE6960119_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 114|} OQS_KEM_classic_mceliece_6960119f_new: 9| 88|OQS_KEM *OQS_KEM_classic_mceliece_6960119f_new(void) { 10| | 11| 88| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 88| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 88] ------------------ 13| 0| return NULL; 14| 0| } 15| 88| kem->method_name = OQS_KEM_alg_classic_mceliece_6960119f; ------------------ | | 56| 88|#define OQS_KEM_alg_classic_mceliece_6960119f "Classic-McEliece-6960119f" ------------------ 16| 88| kem->alg_version = "SUPERCOP-20221025"; 17| | 18| 88| kem->claimed_nist_level = 5; 19| 88| kem->ind_cca = true; 20| | 21| 88| kem->length_public_key = OQS_KEM_classic_mceliece_6960119f_length_public_key; ------------------ | | 114| 88|#define OQS_KEM_classic_mceliece_6960119f_length_public_key 1047319 ------------------ 22| 88| kem->length_secret_key = OQS_KEM_classic_mceliece_6960119f_length_secret_key; ------------------ | | 115| 88|#define OQS_KEM_classic_mceliece_6960119f_length_secret_key 13948 ------------------ 23| 88| kem->length_ciphertext = OQS_KEM_classic_mceliece_6960119f_length_ciphertext; ------------------ | | 116| 88|#define OQS_KEM_classic_mceliece_6960119f_length_ciphertext 194 ------------------ 24| 88| kem->length_shared_secret = OQS_KEM_classic_mceliece_6960119f_length_shared_secret; ------------------ | | 117| 88|#define OQS_KEM_classic_mceliece_6960119f_length_shared_secret 32 ------------------ 25| 88| kem->length_keypair_seed = OQS_KEM_classic_mceliece_6960119f_length_keypair_seed; ------------------ | | 118| 88|#define OQS_KEM_classic_mceliece_6960119f_length_keypair_seed 0 ------------------ 26| 88| kem->length_encaps_seed = OQS_KEM_classic_mceliece_6960119f_length_encaps_seed; ------------------ | | 119| 88|#define OQS_KEM_classic_mceliece_6960119f_length_encaps_seed 0 ------------------ 27| | 28| 88| kem->keypair = OQS_KEM_classic_mceliece_6960119f_keypair; 29| 88| kem->keypair_derand = OQS_KEM_classic_mceliece_6960119f_keypair_derand; 30| 88| kem->encaps = OQS_KEM_classic_mceliece_6960119f_encaps; 31| 88| kem->encaps_derand = OQS_KEM_classic_mceliece_6960119f_encaps_derand; 32| 88| kem->decaps = OQS_KEM_classic_mceliece_6960119f_decaps; 33| | 34| 88| return kem; 35| 88|} OQS_KEM_classic_mceliece_6960119f_keypair: 54| 88|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6960119f_keypair(uint8_t *public_key, uint8_t *secret_key) { 55| 88|#if defined(OQS_ENABLE_KEM_classic_mceliece_6960119f_avx2) 56| 88|#if defined(OQS_DIST_BUILD) 57| 88| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (57:6): [True: 88, False: 0] | Branch (57:49): [True: 88, False: 0] | Branch (57:94): [True: 88, False: 0] ------------------ 58| 88|#endif /* OQS_DIST_BUILD */ 59| 88| return (OQS_STATUS) PQCLEAN_MCELIECE6960119F_AVX2_crypto_kem_keypair(public_key, secret_key); 60| 88|#if defined(OQS_DIST_BUILD) 61| 88| } else { 62| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6960119F_CLEAN_crypto_kem_keypair(public_key, secret_key); 63| 0| } 64| 88|#endif /* OQS_DIST_BUILD */ 65| |#else 66| | return (OQS_STATUS) PQCLEAN_MCELIECE6960119F_CLEAN_crypto_kem_keypair(public_key, secret_key); 67| |#endif 68| 88|} OQS_KEM_classic_mceliece_6960119f_encaps: 78| 88|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6960119f_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 88|#if defined(OQS_ENABLE_KEM_classic_mceliece_6960119f_avx2) 80| 88|#if defined(OQS_DIST_BUILD) 81| 88| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (81:6): [True: 88, False: 0] | Branch (81:49): [True: 88, False: 0] | Branch (81:94): [True: 88, False: 0] ------------------ 82| 88|#endif /* OQS_DIST_BUILD */ 83| 88| return (OQS_STATUS) PQCLEAN_MCELIECE6960119F_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 88|#if defined(OQS_DIST_BUILD) 85| 88| } else { 86| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6960119F_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 88|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_MCELIECE6960119F_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 88|} OQS_KEM_classic_mceliece_6960119f_decaps: 94| 88|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_6960119f_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 88|#if defined(OQS_ENABLE_KEM_classic_mceliece_6960119f_avx2) 96| 88|#if defined(OQS_DIST_BUILD) 97| 88| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (97:6): [True: 88, False: 0] | Branch (97:49): [True: 88, False: 0] | Branch (97:94): [True: 88, False: 0] ------------------ 98| 88|#endif /* OQS_DIST_BUILD */ 99| 88| return (OQS_STATUS) PQCLEAN_MCELIECE6960119F_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 88|#if defined(OQS_DIST_BUILD) 101| 88| } else { 102| 0| return (OQS_STATUS) PQCLEAN_MCELIECE6960119F_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 88|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_MCELIECE6960119F_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 88|} OQS_KEM_classic_mceliece_8192128_new: 9| 88|OQS_KEM *OQS_KEM_classic_mceliece_8192128_new(void) { 10| | 11| 88| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 88| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 88] ------------------ 13| 0| return NULL; 14| 0| } 15| 88| kem->method_name = OQS_KEM_alg_classic_mceliece_8192128; ------------------ | | 58| 88|#define OQS_KEM_alg_classic_mceliece_8192128 "Classic-McEliece-8192128" ------------------ 16| 88| kem->alg_version = "SUPERCOP-20221025"; 17| | 18| 88| kem->claimed_nist_level = 5; 19| 88| kem->ind_cca = true; 20| | 21| 88| kem->length_public_key = OQS_KEM_classic_mceliece_8192128_length_public_key; ------------------ | | 129| 88|#define OQS_KEM_classic_mceliece_8192128_length_public_key 1357824 ------------------ 22| 88| kem->length_secret_key = OQS_KEM_classic_mceliece_8192128_length_secret_key; ------------------ | | 130| 88|#define OQS_KEM_classic_mceliece_8192128_length_secret_key 14120 ------------------ 23| 88| kem->length_ciphertext = OQS_KEM_classic_mceliece_8192128_length_ciphertext; ------------------ | | 131| 88|#define OQS_KEM_classic_mceliece_8192128_length_ciphertext 208 ------------------ 24| 88| kem->length_shared_secret = OQS_KEM_classic_mceliece_8192128_length_shared_secret; ------------------ | | 132| 88|#define OQS_KEM_classic_mceliece_8192128_length_shared_secret 32 ------------------ 25| 88| kem->length_keypair_seed = OQS_KEM_classic_mceliece_8192128_length_keypair_seed; ------------------ | | 133| 88|#define OQS_KEM_classic_mceliece_8192128_length_keypair_seed 0 ------------------ 26| 88| kem->length_encaps_seed = OQS_KEM_classic_mceliece_8192128_length_encaps_seed; ------------------ | | 134| 88|#define OQS_KEM_classic_mceliece_8192128_length_encaps_seed 0 ------------------ 27| | 28| 88| kem->keypair = OQS_KEM_classic_mceliece_8192128_keypair; 29| 88| kem->keypair_derand = OQS_KEM_classic_mceliece_8192128_keypair_derand; 30| 88| kem->encaps = OQS_KEM_classic_mceliece_8192128_encaps; 31| 88| kem->encaps_derand = OQS_KEM_classic_mceliece_8192128_encaps_derand; 32| 88| kem->decaps = OQS_KEM_classic_mceliece_8192128_decaps; 33| | 34| 88| return kem; 35| 88|} OQS_KEM_classic_mceliece_8192128_keypair: 54| 88|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_8192128_keypair(uint8_t *public_key, uint8_t *secret_key) { 55| 88|#if defined(OQS_ENABLE_KEM_classic_mceliece_8192128_avx2) 56| 88|#if defined(OQS_DIST_BUILD) 57| 88| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (57:6): [True: 88, False: 0] | Branch (57:49): [True: 88, False: 0] ------------------ 58| 88|#endif /* OQS_DIST_BUILD */ 59| 88| return (OQS_STATUS) PQCLEAN_MCELIECE8192128_AVX2_crypto_kem_keypair(public_key, secret_key); 60| 88|#if defined(OQS_DIST_BUILD) 61| 88| } else { 62| 0| return (OQS_STATUS) PQCLEAN_MCELIECE8192128_CLEAN_crypto_kem_keypair(public_key, secret_key); 63| 0| } 64| 88|#endif /* OQS_DIST_BUILD */ 65| |#else 66| | return (OQS_STATUS) PQCLEAN_MCELIECE8192128_CLEAN_crypto_kem_keypair(public_key, secret_key); 67| |#endif 68| 88|} OQS_KEM_classic_mceliece_8192128_encaps: 78| 88|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_8192128_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 88|#if defined(OQS_ENABLE_KEM_classic_mceliece_8192128_avx2) 80| 88|#if defined(OQS_DIST_BUILD) 81| 88| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (81:6): [True: 88, False: 0] | Branch (81:49): [True: 88, False: 0] ------------------ 82| 88|#endif /* OQS_DIST_BUILD */ 83| 88| return (OQS_STATUS) PQCLEAN_MCELIECE8192128_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 88|#if defined(OQS_DIST_BUILD) 85| 88| } else { 86| 0| return (OQS_STATUS) PQCLEAN_MCELIECE8192128_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 88|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_MCELIECE8192128_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 88|} OQS_KEM_classic_mceliece_8192128_decaps: 94| 88|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_8192128_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 88|#if defined(OQS_ENABLE_KEM_classic_mceliece_8192128_avx2) 96| 88|#if defined(OQS_DIST_BUILD) 97| 88| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (97:6): [True: 88, False: 0] | Branch (97:49): [True: 88, False: 0] ------------------ 98| 88|#endif /* OQS_DIST_BUILD */ 99| 88| return (OQS_STATUS) PQCLEAN_MCELIECE8192128_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 88|#if defined(OQS_DIST_BUILD) 101| 88| } else { 102| 0| return (OQS_STATUS) PQCLEAN_MCELIECE8192128_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 88|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_MCELIECE8192128_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 88|} OQS_KEM_classic_mceliece_8192128f_new: 9| 66|OQS_KEM *OQS_KEM_classic_mceliece_8192128f_new(void) { 10| | 11| 66| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 66| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 66] ------------------ 13| 0| return NULL; 14| 0| } 15| 66| kem->method_name = OQS_KEM_alg_classic_mceliece_8192128f; ------------------ | | 60| 66|#define OQS_KEM_alg_classic_mceliece_8192128f "Classic-McEliece-8192128f" ------------------ 16| 66| kem->alg_version = "SUPERCOP-20221025"; 17| | 18| 66| kem->claimed_nist_level = 5; 19| 66| kem->ind_cca = true; 20| | 21| 66| kem->length_public_key = OQS_KEM_classic_mceliece_8192128f_length_public_key; ------------------ | | 144| 66|#define OQS_KEM_classic_mceliece_8192128f_length_public_key 1357824 ------------------ 22| 66| kem->length_secret_key = OQS_KEM_classic_mceliece_8192128f_length_secret_key; ------------------ | | 145| 66|#define OQS_KEM_classic_mceliece_8192128f_length_secret_key 14120 ------------------ 23| 66| kem->length_ciphertext = OQS_KEM_classic_mceliece_8192128f_length_ciphertext; ------------------ | | 146| 66|#define OQS_KEM_classic_mceliece_8192128f_length_ciphertext 208 ------------------ 24| 66| kem->length_shared_secret = OQS_KEM_classic_mceliece_8192128f_length_shared_secret; ------------------ | | 147| 66|#define OQS_KEM_classic_mceliece_8192128f_length_shared_secret 32 ------------------ 25| 66| kem->length_keypair_seed = OQS_KEM_classic_mceliece_8192128f_length_keypair_seed; ------------------ | | 148| 66|#define OQS_KEM_classic_mceliece_8192128f_length_keypair_seed 0 ------------------ 26| 66| kem->length_encaps_seed = OQS_KEM_classic_mceliece_8192128f_length_encaps_seed; ------------------ | | 149| 66|#define OQS_KEM_classic_mceliece_8192128f_length_encaps_seed 0 ------------------ 27| | 28| 66| kem->keypair = OQS_KEM_classic_mceliece_8192128f_keypair; 29| 66| kem->keypair_derand = OQS_KEM_classic_mceliece_8192128f_keypair_derand; 30| 66| kem->encaps = OQS_KEM_classic_mceliece_8192128f_encaps; 31| 66| kem->encaps_derand = OQS_KEM_classic_mceliece_8192128f_encaps_derand; 32| 66| kem->decaps = OQS_KEM_classic_mceliece_8192128f_decaps; 33| | 34| 66| return kem; 35| 66|} OQS_KEM_classic_mceliece_8192128f_keypair: 54| 66|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_8192128f_keypair(uint8_t *public_key, uint8_t *secret_key) { 55| 66|#if defined(OQS_ENABLE_KEM_classic_mceliece_8192128f_avx2) 56| 66|#if defined(OQS_DIST_BUILD) 57| 66| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (57:6): [True: 66, False: 0] | Branch (57:49): [True: 66, False: 0] | Branch (57:94): [True: 66, False: 0] ------------------ 58| 66|#endif /* OQS_DIST_BUILD */ 59| 66| return (OQS_STATUS) PQCLEAN_MCELIECE8192128F_AVX2_crypto_kem_keypair(public_key, secret_key); 60| 66|#if defined(OQS_DIST_BUILD) 61| 66| } else { 62| 0| return (OQS_STATUS) PQCLEAN_MCELIECE8192128F_CLEAN_crypto_kem_keypair(public_key, secret_key); 63| 0| } 64| 66|#endif /* OQS_DIST_BUILD */ 65| |#else 66| | return (OQS_STATUS) PQCLEAN_MCELIECE8192128F_CLEAN_crypto_kem_keypair(public_key, secret_key); 67| |#endif 68| 66|} OQS_KEM_classic_mceliece_8192128f_encaps: 78| 66|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_8192128f_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 66|#if defined(OQS_ENABLE_KEM_classic_mceliece_8192128f_avx2) 80| 66|#if defined(OQS_DIST_BUILD) 81| 66| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (81:6): [True: 66, False: 0] | Branch (81:49): [True: 66, False: 0] | Branch (81:94): [True: 66, False: 0] ------------------ 82| 66|#endif /* OQS_DIST_BUILD */ 83| 66| return (OQS_STATUS) PQCLEAN_MCELIECE8192128F_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 66|#if defined(OQS_DIST_BUILD) 85| 66| } else { 86| 0| return (OQS_STATUS) PQCLEAN_MCELIECE8192128F_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 66|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_MCELIECE8192128F_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 66|} OQS_KEM_classic_mceliece_8192128f_decaps: 94| 66|OQS_API OQS_STATUS OQS_KEM_classic_mceliece_8192128f_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 66|#if defined(OQS_ENABLE_KEM_classic_mceliece_8192128f_avx2) 96| 66|#if defined(OQS_DIST_BUILD) 97| 66| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI1)) { ------------------ | Branch (97:6): [True: 66, False: 0] | Branch (97:49): [True: 66, False: 0] | Branch (97:94): [True: 66, False: 0] ------------------ 98| 66|#endif /* OQS_DIST_BUILD */ 99| 66| return (OQS_STATUS) PQCLEAN_MCELIECE8192128F_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 66|#if defined(OQS_DIST_BUILD) 101| 66| } else { 102| 0| return (OQS_STATUS) PQCLEAN_MCELIECE8192128F_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 66|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_MCELIECE8192128F_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 66|} PQCLEAN_MCELIECE348864_AVX2_load_bits: 168| 102|void load_bits(uint64_t out[][32], const unsigned char *bits) { 169| 102| int i, low, block = 0; 170| | 171| 102| uint64_t cond[64]; 172| | 173| | // 174| | 175| 714| for (low = 0; low <= 5; low++) { ------------------ | Branch (175:19): [True: 612, False: 102] ------------------ 176| 39.7k| for (i = 0; i < 64; i++) { ------------------ | Branch (176:21): [True: 39.1k, False: 612] ------------------ 177| 39.1k| cond[i] = load4(bits + block * 256 + i * 4); 178| 39.1k| } 179| 612| transpose_64x64(cond); 180| | 181| 20.1k| for (i = 0; i < 32; i++) { ------------------ | Branch (181:21): [True: 19.5k, False: 612] ------------------ 182| 19.5k| out[ block ][i] = cond[i]; 183| 19.5k| } 184| 612| block++; 185| 612| } 186| | 187| 714| for (low = 0; low <= 5; low++) { ------------------ | Branch (187:19): [True: 612, False: 102] ------------------ 188| 20.1k| for (i = 0; i < 32; i++) { ------------------ | Branch (188:21): [True: 19.5k, False: 612] ------------------ 189| 19.5k| out[ block ][i] = load8(bits + block * 256 + i * 8); 190| 19.5k| } 191| 612| block++; 192| 612| } 193| | 194| 612| for (low = 4; low >= 0; low--) { ------------------ | Branch (194:19): [True: 510, False: 102] ------------------ 195| 16.8k| for (i = 0; i < 32; i++) { ------------------ | Branch (195:21): [True: 16.3k, False: 510] ------------------ 196| 16.3k| out[ block ][i] = load8(bits + block * 256 + i * 8); 197| 16.3k| } 198| 510| block++; 199| 510| } 200| | 201| 714| for (low = 5; low >= 0; low--) { ------------------ | Branch (201:19): [True: 612, False: 102] ------------------ 202| 39.7k| for (i = 0; i < 64; i++) { ------------------ | Branch (202:21): [True: 39.1k, False: 612] ------------------ 203| 39.1k| cond[i] = load4(bits + block * 256 + i * 4); 204| 39.1k| } 205| 612| transpose_64x64(cond); 206| | 207| 20.1k| for (i = 0; i < 32; i++) { ------------------ | Branch (207:21): [True: 19.5k, False: 612] ------------------ 208| 19.5k| out[ block ][i] = cond[i]; 209| 19.5k| } 210| 612| block++; 211| 612| } 212| 102|} PQCLEAN_MCELIECE348864_AVX2_benes: 218| 204|void benes(uint64_t *r, uint64_t cond[][32], int rev) { 219| 204| int block, inc; 220| | 221| 204| uint64_t *bs = r; 222| | 223| | // 224| | 225| 204| if (rev == 0) { ------------------ | Branch (225:9): [True: 102, False: 102] ------------------ 226| 102| block = 0; 227| 102| inc = 1; 228| 102| } else { 229| 102| block = 22; 230| 102| inc = -1; 231| 102| } 232| | 233| 204| transpose_64x64(bs); 234| | 235| 204| layer_0(bs, cond[ block ]); 236| 204| block += inc; 237| 204| layer_1(bs, cond[ block ]); 238| 204| block += inc; 239| 204| layer_2(bs, cond[ block ]); 240| 204| block += inc; 241| 204| layer_3(bs, cond[ block ]); 242| 204| block += inc; 243| 204| layer_4(bs, cond[ block ]); 244| 204| block += inc; 245| 204| layer_5(bs, cond[ block ]); 246| 204| block += inc; 247| | 248| 204| transpose_64x64(bs); 249| | 250| 204| layer_0(bs, cond[ block ]); 251| 204| block += inc; 252| 204| layer_1(bs, cond[ block ]); 253| 204| block += inc; 254| 204| layer_2(bs, cond[ block ]); 255| 204| block += inc; 256| 204| layer_3(bs, cond[ block ]); 257| 204| block += inc; 258| 204| layer_4(bs, cond[ block ]); 259| 204| block += inc; 260| 204| layer_5(bs, cond[ block ]); 261| 204| block += inc; 262| 204| layer_4(bs, cond[ block ]); 263| 204| block += inc; 264| 204| layer_3(bs, cond[ block ]); 265| 204| block += inc; 266| 204| layer_2(bs, cond[ block ]); 267| 204| block += inc; 268| 204| layer_1(bs, cond[ block ]); 269| 204| block += inc; 270| 204| layer_0(bs, cond[ block ]); 271| 204| block += inc; 272| | 273| 204| transpose_64x64(bs); 274| | 275| 204| layer_5(bs, cond[ block ]); 276| 204| block += inc; 277| 204| layer_4(bs, cond[ block ]); 278| 204| block += inc; 279| 204| layer_3(bs, cond[ block ]); 280| 204| block += inc; 281| 204| layer_2(bs, cond[ block ]); 282| 204| block += inc; 283| 204| layer_1(bs, cond[ block ]); 284| 204| block += inc; 285| 204| layer_0(bs, cond[ block ]); 286| | 287| 204| transpose_64x64(bs); 288| 204|} benes.c:layer_0: 13| 7.48k|static void layer_0(uint64_t *bs, uint64_t *cond) { 14| 7.48k| int x; 15| 7.48k| uint64_t diff; 16| | 17| 247k| for (x = 0; x < (1 << 6); x += 2) { ------------------ | Branch (17:17): [True: 239k, False: 7.48k] ------------------ 18| 239k| diff = bs[ x ] ^ bs[ x + 1 ]; 19| 239k| diff &= *cond++; 20| 239k| bs[ x ] ^= diff; 21| 239k| bs[ x + 1 ] ^= diff; 22| 239k| } 23| 7.48k|} benes.c:layer_1: 25| 7.48k|static void layer_1(uint64_t *bs, const uint64_t *cond) { 26| 7.48k| int x; 27| 7.48k| uint64_t diff; 28| | 29| 127k| for (x = 0; x < (1 << 6); x += 4) { ------------------ | Branch (29:17): [True: 119k, False: 7.48k] ------------------ 30| 119k| diff = bs[ x + 0 ] ^ bs[ x + 2 ]; 31| 119k| diff &= cond[0]; 32| 119k| bs[ x + 0 ] ^= diff; 33| 119k| bs[ x + 2 ] ^= diff; 34| | 35| 119k| diff = bs[ x + 1 ] ^ bs[ x + 3 ]; 36| 119k| diff &= cond[1]; 37| 119k| bs[ x + 1 ] ^= diff; 38| 119k| bs[ x + 3 ] ^= diff; 39| | 40| 119k| cond += 2; 41| 119k| } 42| 7.48k|} benes.c:layer_2: 44| 7.48k|static void layer_2(uint64_t *bs, const uint64_t *cond) { 45| 7.48k| int x; 46| 7.48k| uint64_t diff; 47| | 48| 67.3k| for (x = 0; x < (1 << 6); x += 8) { ------------------ | Branch (48:17): [True: 59.9k, False: 7.48k] ------------------ 49| 59.9k| diff = bs[ x + 0 ] ^ bs[ x + 4 ]; 50| 59.9k| diff &= cond[0]; 51| 59.9k| bs[ x + 0 ] ^= diff; 52| 59.9k| bs[ x + 4 ] ^= diff; 53| | 54| 59.9k| diff = bs[ x + 1 ] ^ bs[ x + 5 ]; 55| 59.9k| diff &= cond[1]; 56| 59.9k| bs[ x + 1 ] ^= diff; 57| 59.9k| bs[ x + 5 ] ^= diff; 58| | 59| 59.9k| diff = bs[ x + 2 ] ^ bs[ x + 6 ]; 60| 59.9k| diff &= cond[2]; 61| 59.9k| bs[ x + 2 ] ^= diff; 62| 59.9k| bs[ x + 6 ] ^= diff; 63| | 64| 59.9k| diff = bs[ x + 3 ] ^ bs[ x + 7 ]; 65| 59.9k| diff &= cond[3]; 66| 59.9k| bs[ x + 3 ] ^= diff; 67| 59.9k| bs[ x + 7 ] ^= diff; 68| | 69| 59.9k| cond += 4; 70| 59.9k| } 71| 7.48k|} benes.c:layer_3: 73| 7.48k|static void layer_3(uint64_t *bs, const uint64_t *cond) { 74| 7.48k| int x, s; 75| 7.48k| uint64_t diff; 76| | 77| 37.4k| for (x = 0; x < (1 << 6); x += 16) { ------------------ | Branch (77:17): [True: 29.9k, False: 7.48k] ------------------ 78| 89.8k| for (s = x; s < x + 8; s += 4) { ------------------ | Branch (78:21): [True: 59.9k, False: 29.9k] ------------------ 79| 59.9k| diff = bs[ s + 0 ] ^ bs[ s + 8 ]; 80| 59.9k| diff &= cond[0]; 81| 59.9k| bs[ s + 0 ] ^= diff; 82| 59.9k| bs[ s + 8 ] ^= diff; 83| | 84| 59.9k| diff = bs[ s + 1 ] ^ bs[ s + 9 ]; 85| 59.9k| diff &= cond[1]; 86| 59.9k| bs[ s + 1 ] ^= diff; 87| 59.9k| bs[ s + 9 ] ^= diff; 88| | 89| 59.9k| diff = bs[ s + 2 ] ^ bs[ s + 10 ]; 90| 59.9k| diff &= cond[2]; 91| 59.9k| bs[ s + 2 ] ^= diff; 92| 59.9k| bs[ s + 10 ] ^= diff; 93| | 94| 59.9k| diff = bs[ s + 3 ] ^ bs[ s + 11 ]; 95| 59.9k| diff &= cond[3]; 96| 59.9k| bs[ s + 3 ] ^= diff; 97| 59.9k| bs[ s + 11 ] ^= diff; 98| | 99| 59.9k| cond += 4; 100| 59.9k| } 101| 29.9k| } 102| 7.48k|} benes.c:layer_4: 104| 7.48k|static void layer_4(uint64_t *bs, const uint64_t *cond) { 105| 7.48k| int x, s; 106| 7.48k| uint64_t diff; 107| | 108| 22.4k| for (x = 0; x < (1 << 6); x += 32) { ------------------ | Branch (108:17): [True: 14.9k, False: 7.48k] ------------------ 109| 74.8k| for (s = x; s < x + 16; s += 4) { ------------------ | Branch (109:21): [True: 59.9k, False: 14.9k] ------------------ 110| 59.9k| diff = bs[ s + 0 ] ^ bs[ s + 16 ]; 111| 59.9k| diff &= cond[0]; 112| 59.9k| bs[ s + 0 ] ^= diff; 113| 59.9k| bs[ s + 16 ] ^= diff; 114| | 115| 59.9k| diff = bs[ s + 1 ] ^ bs[ s + 17 ]; 116| 59.9k| diff &= cond[1]; 117| 59.9k| bs[ s + 1 ] ^= diff; 118| 59.9k| bs[ s + 17 ] ^= diff; 119| | 120| 59.9k| diff = bs[ s + 2 ] ^ bs[ s + 18 ]; 121| 59.9k| diff &= cond[2]; 122| 59.9k| bs[ s + 2 ] ^= diff; 123| 59.9k| bs[ s + 18 ] ^= diff; 124| | 125| 59.9k| diff = bs[ s + 3 ] ^ bs[ s + 19 ]; 126| 59.9k| diff &= cond[3]; 127| 59.9k| bs[ s + 3 ] ^= diff; 128| 59.9k| bs[ s + 19 ] ^= diff; 129| | 130| 59.9k| cond += 4; 131| 59.9k| } 132| 14.9k| } 133| 7.48k|} benes.c:layer_5: 135| 5.61k|static void layer_5(uint64_t *bs, const uint64_t *cond) { 136| 5.61k| int x, s; 137| 5.61k| uint64_t diff; 138| | 139| 11.2k| for (x = 0; x < (1 << 6); x += 64) { ------------------ | Branch (139:17): [True: 5.61k, False: 5.61k] ------------------ 140| 50.5k| for (s = x; s < x + 32; s += 4) { ------------------ | Branch (140:21): [True: 44.9k, False: 5.61k] ------------------ 141| 44.9k| diff = bs[ s + 0 ] ^ bs[ s + 32 ]; 142| 44.9k| diff &= cond[0]; 143| 44.9k| bs[ s + 0 ] ^= diff; 144| 44.9k| bs[ s + 32 ] ^= diff; 145| | 146| 44.9k| diff = bs[ s + 1 ] ^ bs[ s + 33 ]; 147| 44.9k| diff &= cond[1]; 148| 44.9k| bs[ s + 1 ] ^= diff; 149| 44.9k| bs[ s + 33 ] ^= diff; 150| | 151| 44.9k| diff = bs[ s + 2 ] ^ bs[ s + 34 ]; 152| 44.9k| diff &= cond[2]; 153| 44.9k| bs[ s + 2 ] ^= diff; 154| 44.9k| bs[ s + 34 ] ^= diff; 155| | 156| 44.9k| diff = bs[ s + 3 ] ^ bs[ s + 35 ]; 157| 44.9k| diff &= cond[3]; 158| 44.9k| bs[ s + 3 ] ^= diff; 159| 44.9k| bs[ s + 35 ] ^= diff; 160| | 161| 44.9k| cond += 4; 162| 44.9k| } 163| 5.61k| } 164| 5.61k|} PQCLEAN_MCELIECE348864_AVX2_bm: 140| 102|void bm(uint64_t out[ GFBITS ], vec128 in[ GFBITS ]) { 141| 102| uint16_t i; 142| 102| uint16_t N, L; 143| | 144| 102| uint64_t prod[ GFBITS ]; 145| 102| uint64_t in_tmp[ GFBITS ]; 146| | 147| 102| uint64_t db[ GFBITS ][ 2 ]; 148| 102| uint64_t BC_tmp[ GFBITS ][ 2 ]; 149| 102| uint64_t BC[ GFBITS ][ 2 ]; 150| | 151| 102| uint64_t mask, t; 152| | 153| 102| gf d, b, c0 = 1; 154| | 155| 102| gf coefs[SYS_T * 2]; 156| | 157| | // init 158| | 159| 102| BC[0][1] = 0; 160| 102| BC[0][0] = 1; 161| 102| BC[0][0] <<= 63; 162| | 163| 1.22k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.22k|#define GFBITS 12 ------------------ | Branch (163:17): [True: 1.12k, False: 102] ------------------ 164| 1.12k| BC[i][0] = BC[i][1] = 0; 165| 1.12k| } 166| | 167| 102| b = 1; 168| 102| L = 0; 169| | 170| | // 171| | 172| 102| get_coefs(coefs, in); 173| | 174| 1.32k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.32k|#define GFBITS 12 ------------------ | Branch (174:17): [True: 1.22k, False: 102] ------------------ 175| 1.22k| in_tmp[i] = 0; 176| 1.22k| } 177| | 178| 13.1k| for (N = 0; N < SYS_T * 2; N++) { ------------------ | | 8| 13.1k|#define SYS_T 64 ------------------ | Branch (178:17): [True: 13.0k, False: 102] ------------------ 179| | // computing d 180| | 181| 13.0k| vec_mul_sp(prod, in_tmp, &BC[0][0]); 182| | 183| 13.0k| update_asm(in_tmp, coefs[N], 8); ------------------ | | 1| 13.0k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 13.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 184| | 185| 13.0k| d = vec_reduce_asm(prod); ------------------ | | 3| 13.0k|#define vec_reduce_asm CRYPTO_NAMESPACE(vec_reduce_asm) | | ------------------ | | | | 4| 13.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 186| | 187| 13.0k| t = gf_mul2(c0, coefs[N], b); ------------------ | | 13| 13.0k|#define gf_mul2 CRYPTO_NAMESPACE(gf_mul2) | | ------------------ | | | | 4| 13.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 188| | 189| 13.0k| d ^= t & 0xFFFFFFFF; 190| | 191| | // 3 cases 192| | 193| 13.0k| mask = mask_nonzero(d) & mask_leq(L * 2, N); 194| | 195| 169k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 169k|#define GFBITS 12 ------------------ | Branch (195:21): [True: 156k, False: 13.0k] ------------------ 196| 156k| db[i][0] = (d >> i) & 1; 197| 156k| db[i][0] = -db[i][0]; 198| 156k| db[i][1] = (b >> i) & 1; 199| 156k| db[i][1] = -db[i][1]; 200| 156k| } 201| | 202| 13.0k| vec128_mul((vec128 *) BC_tmp, (vec128 *) db, (vec128 *) BC); 203| | 204| 13.0k| vec_cmov(BC, mask); 205| | 206| 13.0k| update_asm(BC, mask & c0, 16); ------------------ | | 1| 13.0k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 13.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 207| | 208| 169k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 169k|#define GFBITS 12 ------------------ | Branch (208:21): [True: 156k, False: 13.0k] ------------------ 209| 156k| BC[i][1] = BC_tmp[i][0] ^ BC_tmp[i][1]; 210| 156k| } 211| | 212| 13.0k| c0 = t >> 32; 213| 13.0k| b = (d & mask) | (b & ~mask); 214| 13.0k| L = ((N + 1 - L) & mask) | (L & ~mask); 215| | 216| 13.0k| } 217| | 218| 102| c0 = gf_inv(c0); ------------------ | | 11| 102|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 219| | 220| 1.32k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.32k|#define GFBITS 12 ------------------ | Branch (220:17): [True: 1.22k, False: 102] ------------------ 221| 1.22k| out[i] = (c0 >> i) & 1; 222| 1.22k| out[i] = -out[i]; 223| 1.22k| } 224| | 225| 102| vec_mul_sp(out, out, &BC[0][0]); 226| 102|} bm.c:get_coefs: 72| 936|static inline void get_coefs(gf *out, vec128 *in) { 73| 936| int i, k; 74| | 75| 936| vec128 mask[4][2]; 76| 936| vec128 buf[16]; 77| | 78| 12.9k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 12.9k|#define GFBITS 12 ------------------ | Branch (78:18): [True: 11.9k, False: 936] ------------------ 79| 11.9k| buf[i] = in[i]; 80| 11.9k| } 81| 3.92k| for (i = GFBITS; i < 16; i++) { ------------------ | | 6| 936|#define GFBITS 12 ------------------ | Branch (81:22): [True: 2.98k, False: 936] ------------------ 82| 2.98k| buf[i] = vec128_setzero(); 83| 2.98k| } 84| | 85| 936| mask[0][0] = vec128_set1_16b(0x5555); 86| 936| mask[0][1] = vec128_set1_16b(0xAAAA); 87| 936| mask[1][0] = vec128_set1_16b(0x3333); 88| 936| mask[1][1] = vec128_set1_16b(0xCCCC); 89| 936| mask[2][0] = vec128_set1_16b(0x0F0F); 90| 936| mask[2][1] = vec128_set1_16b(0xF0F0); 91| 936| mask[3][0] = vec128_set1_16b(0x00FF); 92| 936| mask[3][1] = vec128_set1_16b(0xFF00); 93| | 94| 936| interleave(buf, 0, 8, mask[3], 3); 95| 936| interleave(buf, 1, 9, mask[3], 3); 96| 936| interleave(buf, 2, 10, mask[3], 3); 97| 936| interleave(buf, 3, 11, mask[3], 3); 98| 936| interleave(buf, 4, 12, mask[3], 3); 99| 936| interleave(buf, 5, 13, mask[3], 3); 100| 936| interleave(buf, 6, 14, mask[3], 3); 101| 936| interleave(buf, 7, 15, mask[3], 3); 102| | 103| 936| interleave(buf, 0, 4, mask[2], 2); 104| 936| interleave(buf, 1, 5, mask[2], 2); 105| 936| interleave(buf, 2, 6, mask[2], 2); 106| 936| interleave(buf, 3, 7, mask[2], 2); 107| 936| interleave(buf, 8, 12, mask[2], 2); 108| 936| interleave(buf, 9, 13, mask[2], 2); 109| 936| interleave(buf, 10, 14, mask[2], 2); 110| 936| interleave(buf, 11, 15, mask[2], 2); 111| | 112| 936| interleave(buf, 0, 2, mask[1], 1); 113| 936| interleave(buf, 1, 3, mask[1], 1); 114| 936| interleave(buf, 4, 6, mask[1], 1); 115| 936| interleave(buf, 5, 7, mask[1], 1); 116| 936| interleave(buf, 8, 10, mask[1], 1); 117| 936| interleave(buf, 9, 11, mask[1], 1); 118| 936| interleave(buf, 12, 14, mask[1], 1); 119| 936| interleave(buf, 13, 15, mask[1], 1); 120| | 121| 936| interleave(buf, 0, 1, mask[0], 0); 122| 936| interleave(buf, 2, 3, mask[0], 0); 123| 936| interleave(buf, 4, 5, mask[0], 0); 124| 936| interleave(buf, 6, 7, mask[0], 0); 125| 936| interleave(buf, 8, 9, mask[0], 0); 126| 936| interleave(buf, 10, 11, mask[0], 0); 127| 936| interleave(buf, 12, 13, mask[0], 0); 128| 936| interleave(buf, 14, 15, mask[0], 0); 129| | 130| 15.9k| for (i = 0; i < 16; i++) { ------------------ | Branch (130:17): [True: 14.9k, False: 936] ------------------ 131| 74.8k| for (k = 0; k < 4; k++) { ------------------ | Branch (131:21): [True: 59.9k, False: 14.9k] ------------------ 132| 59.9k| out[ (4 * 0 + k) * 16 + i ] = (vec128_extract(buf[i], 0) >> (k * 16)) & GFMASK; ------------------ | | 28| 59.9k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ out[ (4 * 0 + k) * 16 + i ] = (vec128_extract(buf[i], 0) >> (k * 16)) & GFMASK; ------------------ | | 19| 59.9k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 59.9k|#define GFBITS 12 | | ------------------ ------------------ 133| 59.9k| out[ (4 * 1 + k) * 16 + i ] = (vec128_extract(buf[i], 1) >> (k * 16)) & GFMASK; ------------------ | | 28| 59.9k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ out[ (4 * 1 + k) * 16 + i ] = (vec128_extract(buf[i], 1) >> (k * 16)) & GFMASK; ------------------ | | 19| 59.9k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 59.9k|#define GFBITS 12 | | ------------------ ------------------ 134| 59.9k| } 135| 14.9k| } 136| 936|} bm.c:interleave: 55| 29.9k|static inline void interleave(vec128 *in, int idx0, int idx1, vec128 *mask, int b) { 56| 29.9k| int s = 1 << b; 57| | 58| 29.9k| vec128 x, y; 59| | 60| 29.9k| x = vec128_or(vec128_and(in[idx0], mask[0]), 61| 29.9k| vec128_sll_2x(vec128_and(in[idx1], mask[0]), s)); ------------------ | | 46| 29.9k|#define vec128_sll_2x(a, s) ((vec128) _mm_slli_epi64((vec128) (a), (s))) ------------------ 62| | 63| 29.9k| y = vec128_or(vec128_srl_2x(vec128_and(in[idx0], mask[1]), s), ------------------ | | 47| 29.9k|#define vec128_srl_2x(a, s) ((vec128) _mm_srli_epi64((vec128) (a), (s))) ------------------ 64| 29.9k| vec128_and(in[idx1], mask[1])); 65| | 66| 29.9k| in[idx0] = x; 67| 29.9k| in[idx1] = y; 68| 29.9k|} bm.c:mask_nonzero: 26| 199k|static inline uint64_t mask_nonzero(gf a) { 27| 199k| uint64_t ret = a; 28| | 29| 199k| ret -= 1; 30| 199k| ret >>= 63; 31| 199k| ret -= 1; 32| | 33| 199k| return ret; 34| 199k|} bm.c:mask_leq: 36| 199k|static inline uint64_t mask_leq(uint16_t a, uint16_t b) { 37| 199k| uint64_t a_tmp = a; 38| 199k| uint64_t b_tmp = b; 39| 199k| uint64_t ret = b_tmp - a_tmp; 40| | 41| 199k| ret >>= 63; 42| 199k| ret -= 1; 43| | 44| 199k| return ret; 45| 199k|} bm.c:vec_cmov: 47| 23.0k|static inline void vec_cmov(uint64_t out[][2], uint64_t mask) { 48| 23.0k| int i; 49| | 50| 299k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 299k|#define GFBITS 12 ------------------ | Branch (50:17): [True: 276k, False: 23.0k] ------------------ 51| 276k| out[i][0] = (out[i][0] & ~mask) | (out[i][1] & mask); 52| 276k| } 53| 23.0k|} PQCLEAN_MCELIECE348864_AVX2_controlbitsfrompermutation: 205| 102|void controlbitsfrompermutation(unsigned char *out, const int16 *pi, long long w, long long n) { 206| 102| PQCLEAN_VLA(int32, temp, (size_t)(2 * n)); ------------------ | | 57| 102|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 207| 102| PQCLEAN_VLA(int16, pi_test, (size_t)n); ------------------ | | 57| 102|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 208| 102| int16 diff; 209| 102| int i; 210| 102| unsigned char *ptr; 211| | 212| 102| OQS_MEM_cleanse(temp, (size_t)n * 2); 213| 102| OQS_MEM_cleanse(pi_test, (size_t)n); 214| | 215| 102| while (1) { ------------------ | Branch (215:12): [True: 102, Folded] ------------------ 216| 102| OQS_MEM_cleanse(out, (size_t)((((2 * w - 1)*n / 2) + 7) / 8)); 217| 102| cbrecursion(out, 0, 1, pi, w, n, temp); 218| | 219| | // check for correctness 220| | 221| 417k| for (i = 0; i < n; i++) { ------------------ | Branch (221:21): [True: 417k, False: 102] ------------------ 222| 417k| pi_test[i] = (int16)i; 223| 417k| } 224| | 225| 102| ptr = out; 226| 1.32k| for (i = 0; i < w; i++) { ------------------ | Branch (226:21): [True: 1.22k, False: 102] ------------------ 227| 1.22k| layer(pi_test, ptr, i, (int32)n); 228| 1.22k| ptr += n >> 4; 229| 1.22k| } 230| | 231| 1.22k| for (i = (int)(w - 2); i >= 0; i--) { ------------------ | Branch (231:32): [True: 1.12k, False: 102] ------------------ 232| 1.12k| layer(pi_test, ptr, i, (int32)n); 233| 1.12k| ptr += n >> 4; 234| 1.12k| } 235| | 236| 102| diff = 0; 237| 417k| for (i = 0; i < n; i++) { ------------------ | Branch (237:21): [True: 417k, False: 102] ------------------ 238| 417k| diff |= pi[i] ^ pi_test[i]; 239| 417k| } 240| | 241| 102| diff = crypto_int16_nonzero_mask(diff); ------------------ | | 12| 102|#define crypto_int16_nonzero_mask CRYPTO_NAMESPACE(crypto_int16_nonzero_mask) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 242| 102| crypto_declassify(&diff, sizeof diff); 243| 102| if (diff == 0) { ------------------ | Branch (243:13): [True: 102, False: 0] ------------------ 244| 102| break; 245| 102| } 246| 102| } 247| 102|} PQCLEAN_MCELIECE348864_AVX2_crypto_int16_negative_mask: 3| 204|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 4| 204| return crypto_int16_x >> 15; 5| 204|} PQCLEAN_MCELIECE348864_AVX2_crypto_int16_nonzero_mask: 7| 102|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 8| 102| return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 102|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 102|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 9| 102|} PQCLEAN_MCELIECE348864_AVX2_crypto_int32_negative_mask: 3| 27.5M|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 4| 27.5M| return crypto_int32_x >> 31; 5| 27.5M|} PQCLEAN_MCELIECE348864_AVX2_crypto_int32_min: 37| 27.5M|crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x, crypto_int32 crypto_int32_y) { 38| 27.5M| crypto_int32 crypto_int32_xy = crypto_int32_y ^ crypto_int32_x; 39| 27.5M| crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x; 40| 27.5M| crypto_int32_z ^= crypto_int32_xy & (crypto_int32_z ^ crypto_int32_y); 41| 27.5M| crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); ------------------ | | 9| 27.5M|#define crypto_int32_negative_mask CRYPTO_NAMESPACE(crypto_int32_negative_mask) | | ------------------ | | | | 4| 27.5M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 42| 27.5M| crypto_int32_z &= crypto_int32_xy; 43| 27.5M| return crypto_int32_x ^ crypto_int32_z; 44| 27.5M|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint16_signed_negative_mask: 3| 157k|crypto_uint16_signed crypto_uint16_signed_negative_mask(crypto_uint16_signed crypto_uint16_signed_x) { 4| 157k| return crypto_uint16_signed_x >> 15; 5| 157k|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint16_nonzero_mask: 7| 66.5k|crypto_uint16 crypto_uint16_nonzero_mask(crypto_uint16 crypto_uint16_x) { 8| 66.5k| return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 66.5k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 66.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 66.5k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 66.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 9| 66.5k|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint16_zero_mask: 11| 66.5k|crypto_uint16 crypto_uint16_zero_mask(crypto_uint16 crypto_uint16_x) { 12| 66.5k| return ~crypto_uint16_nonzero_mask(crypto_uint16_x); ------------------ | | 13| 66.5k|#define crypto_uint16_nonzero_mask CRYPTO_NAMESPACE(crypto_uint16_nonzero_mask) | | ------------------ | | | | 4| 66.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 13| 66.5k|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint16_smaller_mask: 24| 23.8k|crypto_uint16 crypto_uint16_smaller_mask(crypto_uint16 crypto_uint16_x, crypto_uint16 crypto_uint16_y) { 25| 23.8k| crypto_uint16 crypto_uint16_xy = crypto_uint16_x ^ crypto_uint16_y; 26| 23.8k| crypto_uint16 crypto_uint16_z = crypto_uint16_x - crypto_uint16_y; 27| 23.8k| crypto_uint16_z ^= crypto_uint16_xy & (crypto_uint16_z ^ crypto_uint16_x ^ (((crypto_uint16) 1) << 15)); 28| 23.8k| return crypto_uint16_signed_negative_mask(crypto_uint16_z); ------------------ | | 11| 23.8k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 23.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 29| 23.8k|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint32_signed_negative_mask: 3| 40.1k|crypto_uint32_signed crypto_uint32_signed_negative_mask(crypto_uint32_signed crypto_uint32_signed_x) { 4| 40.1k| return crypto_uint32_signed_x >> 31; 5| 40.1k|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint32_nonzero_mask: 7| 20.0k|crypto_uint32 crypto_uint32_nonzero_mask(crypto_uint32 crypto_uint32_x) { 8| 20.0k| return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 20.0k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 20.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 20.0k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 20.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 9| 20.0k|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint32_unequal_mask: 15| 20.0k|crypto_uint32 crypto_uint32_unequal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 16| 20.0k| crypto_uint32 crypto_uint32_xy = crypto_uint32_x ^ crypto_uint32_y; 17| 20.0k| return crypto_uint32_nonzero_mask(crypto_uint32_xy); ------------------ | | 13| 20.0k|#define crypto_uint32_nonzero_mask CRYPTO_NAMESPACE(crypto_uint32_nonzero_mask) | | ------------------ | | | | 4| 20.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 18| 20.0k|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint32_equal_mask: 20| 20.0k|crypto_uint32 crypto_uint32_equal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 21| 20.0k| return ~crypto_uint32_unequal_mask(crypto_uint32_x, crypto_uint32_y); ------------------ | | 17| 20.0k|#define crypto_uint32_unequal_mask CRYPTO_NAMESPACE(crypto_uint32_unequal_mask) | | ------------------ | | | | 4| 20.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 22| 20.0k|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint64_signed_negative_mask: 3| 9.94M|crypto_uint64_signed crypto_uint64_signed_negative_mask(crypto_uint64_signed crypto_uint64_signed_x) { 4| 9.94M| return crypto_uint64_signed_x >> 63; 5| 9.94M|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint64_nonzero_mask: 7| 4.97M|crypto_uint64 crypto_uint64_nonzero_mask(crypto_uint64 crypto_uint64_x) { 8| 4.97M| return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 4.97M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 4.97M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 4.97M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 4.97M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 9| 4.97M|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint64_zero_mask: 11| 776k|crypto_uint64 crypto_uint64_zero_mask(crypto_uint64 crypto_uint64_x) { 12| 776k| return ~crypto_uint64_nonzero_mask(crypto_uint64_x); ------------------ | | 13| 776k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 776k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 13| 776k|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint64_unequal_mask: 15| 4.19M|crypto_uint64 crypto_uint64_unequal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 16| 4.19M| crypto_uint64 crypto_uint64_xy = crypto_uint64_x ^ crypto_uint64_y; 17| 4.19M| return crypto_uint64_nonzero_mask(crypto_uint64_xy); ------------------ | | 13| 4.19M|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 4.19M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 18| 4.19M|} PQCLEAN_MCELIECE348864_AVX2_crypto_uint64_equal_mask: 20| 4.19M|crypto_uint64 crypto_uint64_equal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 21| 4.19M| return ~crypto_uint64_unequal_mask(crypto_uint64_x, crypto_uint64_y); ------------------ | | 17| 4.19M|#define crypto_uint64_unequal_mask CRYPTO_NAMESPACE(crypto_uint64_unequal_mask) | | ------------------ | | | | 4| 4.19M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 22| 4.19M|} PQCLEAN_MCELIECE348864_AVX2_decrypt: 171| 102|int decrypt(unsigned char *e, const unsigned char *sk, const unsigned char *s) { 172| 102| int i; 173| | 174| 102| uint16_t check_synd; 175| 102| uint16_t check_weight; 176| | 177| 102| vec256 inv[ 16 ][ GFBITS ]; 178| 102| vec256 scaled[ 16 ][ GFBITS ]; 179| 102| vec256 eval[16][ GFBITS ]; 180| | 181| 102| vec128 error128[ 32 ]; 182| 102| vec256 error256[ 16 ]; 183| | 184| 102| vec128 s_priv[ GFBITS ]; 185| 102| vec128 s_priv_cmp[ GFBITS ]; 186| 102| uint64_t locator[ GFBITS ]; 187| | 188| 102| vec128 recv128[ 32 ]; 189| 102| vec256 recv256[ 16 ]; 190| 102| vec256 allone; 191| | 192| 102| uint64_t bits_int[23][32]; 193| | 194| | // Berlekamp decoder 195| | 196| 102| preprocess(recv128, s); 197| | 198| 102| load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 10| 102|#define load_bits CRYPTO_NAMESPACE(load_bits) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 11| 102|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 102|#define SYS_T 64 | | ------------------ ------------------ 199| 102| benes((uint64_t *) recv128, bits_int, 1); ------------------ | | 9| 102|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 200| | 201| 102| reformat_128to256(recv256, recv128); 202| | 203| 102| scaling(scaled, inv, sk, recv256); 204| 102| fft_tr(s_priv, scaled); ------------------ | | 9| 102|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 205| 102| bm(locator, s_priv); ------------------ | | 10| 102|#define bm CRYPTO_NAMESPACE(bm) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 102| fft(eval, locator); ------------------ | | 10| 102|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| | // reencryption and weight check 210| | 211| 102| allone = vec256_set1_16b(0xFFFF); 212| | 213| 1.73k| for (i = 0; i < 16; i++) { ------------------ | Branch (213:17): [True: 1.63k, False: 102] ------------------ 214| 1.63k| error256[i] = vec256_or_reduce(eval[i]); 215| 1.63k| error256[i] = vec256_xor(error256[i], allone); 216| 1.63k| } 217| | 218| 102| scaling_inv(scaled, inv, error256); 219| 102| fft_tr(s_priv_cmp, scaled); ------------------ | | 9| 102|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 220| | 221| 102| check_synd = synd_cmp(s_priv, s_priv_cmp); 222| | 223| | // 224| | 225| 102| reformat_256to128(error128, error256); 226| 102| benes((uint64_t *) error128, bits_int, 0); ------------------ | | 9| 102|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 227| | 228| 102| postprocess(e, error128); 229| | 230| 102| check_weight = weight_check(e, error128); 231| | 232| 102| return 1 - (check_synd & check_weight); 233| 102|} decrypt.c:preprocess: 57| 782|static void preprocess(vec128 *recv, const unsigned char *s) { 58| 782| int i; 59| 782| unsigned char r[ 512 ]; 60| | 61| 129k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 129k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 129k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 129k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 129k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (61:17): [True: 128k, False: 782] ------------------ 62| 128k| r[i] = s[i]; 63| 128k| } 64| | 65| 580k| for (i = SYND_BYTES; i < 512; i++) { ------------------ | | 17| 782|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 782|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 782|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 782|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (65:26): [True: 579k, False: 782] ------------------ 66| 579k| r[i] = 0; 67| 579k| } 68| | 69| 45.0k| for (i = 0; i < 32; i++) { ------------------ | Branch (69:17): [True: 44.2k, False: 782] ------------------ 70| 44.2k| recv[i] = load16(r + i * 16); 71| 44.2k| } 72| 782|} decrypt.c:reformat_128to256: 137| 936|static void reformat_128to256(vec256 *out, vec128 *in) { 138| 936| int i; 139| 936| uint64_t v[4]; 140| | 141| 28.0k| for (i = 0; i < 16; i++) { ------------------ | Branch (141:17): [True: 27.0k, False: 936] ------------------ 142| 27.0k| v[0] = vec128_extract(in[2 * i + 0], 0); ------------------ | | 28| 27.0k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 143| 27.0k| v[1] = vec128_extract(in[2 * i + 0], 1); ------------------ | | 28| 27.0k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 144| 27.0k| v[2] = vec128_extract(in[2 * i + 1], 0); ------------------ | | 28| 27.0k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 145| 27.0k| v[3] = vec128_extract(in[2 * i + 1], 1); ------------------ | | 28| 27.0k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 146| | 147| 27.0k| out[i] = vec256_set4x(v[0], v[1], v[2], v[3]); 148| 27.0k| } 149| 936|} decrypt.c:scaling: 16| 936|static void scaling(vec256 out[][GFBITS], vec256 inv[][GFBITS], const unsigned char *sk, vec256 *recv) { 17| 936| int i, j; 18| | 19| 936| uint64_t sk_int[ GFBITS ]; 20| 936| vec256 eval[16][ GFBITS ]; 21| 936| vec256 tmp[ GFBITS ]; 22| | 23| | // computing inverses 24| | 25| 936| irr_load(sk_int, sk); 26| | 27| 936| fft(eval, sk_int); ------------------ | | 10| 936|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 936|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 28| | 29| 28.0k| for (i = 0; i < 16; i++) { ------------------ | Branch (29:17): [True: 27.0k, False: 936] ------------------ 30| 27.0k| vec256_sq(eval[i], eval[i]); ------------------ | | 14| 27.0k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 27.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 31| 27.0k| } 32| | 33| 936| vec256_copy(inv[0], eval[0]); 34| | 35| 27.0k| for (i = 1; i < 16; i++) { ------------------ | Branch (35:17): [True: 26.1k, False: 936] ------------------ 36| 26.1k| vec256_mul(inv[i], inv[i - 1], eval[i]); 37| 26.1k| } 38| | 39| 936| vec256_inv(tmp, inv[15]); ------------------ | | 11| 936|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 936|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 40| | 41| 27.0k| for (i = 14; i >= 0; i--) { ------------------ | Branch (41:18): [True: 26.1k, False: 936] ------------------ 42| 26.1k| vec256_mul(inv[i + 1], tmp, inv[i]); 43| 26.1k| vec256_mul(tmp, tmp, eval[i + 1]); 44| 26.1k| } 45| | 46| 936| vec256_copy(inv[0], tmp); 47| | 48| | // 49| | 50| 28.0k| for (i = 0; i < 16; i++) { ------------------ | Branch (50:17): [True: 27.0k, False: 936] ------------------ 51| 376k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 376k|#define GFBITS 12 ------------------ | Branch (51:21): [True: 349k, False: 27.0k] ------------------ 52| 349k| out[i][j] = vec256_and(inv[i][j], recv[i]); 53| 349k| } 54| 27.0k| } 55| 936|} decrypt.c:scaling_inv: 92| 936|static void scaling_inv(vec256 out[][GFBITS], vec256 inv[][GFBITS], vec256 *recv) { 93| 936| int i, j; 94| | 95| 28.0k| for (i = 0; i < 16; i++) { ------------------ | Branch (95:17): [True: 27.0k, False: 936] ------------------ 96| 376k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 376k|#define GFBITS 12 ------------------ | Branch (96:21): [True: 349k, False: 27.0k] ------------------ 97| 349k| out[i][j] = vec256_and(inv[i][j], recv[i]); 98| 349k| } 99| 27.0k| } 100| 936|} decrypt.c:synd_cmp: 124| 936|static uint64_t synd_cmp(vec128 *s0, vec128 *s1) { 125| 936| int i; 126| 936| vec128 diff; 127| | 128| 936| diff = vec128_xor(s0[0], s1[0]); 129| | 130| 11.9k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 11.9k|#define GFBITS 12 ------------------ | Branch (130:17): [True: 11.0k, False: 936] ------------------ 131| 11.0k| diff = vec128_or(diff, vec128_xor(s0[i], s1[i])); 132| 11.0k| } 133| | 134| 936| return vec128_testz(diff); 135| 936|} decrypt.c:reformat_256to128: 151| 936|static void reformat_256to128(vec128 *out, vec256 *in) { 152| 936| int i; 153| 936| uint64_t v[4]; 154| | 155| 28.0k| for (i = 0; i < 16; i++) { ------------------ | Branch (155:17): [True: 27.0k, False: 936] ------------------ 156| 27.0k| v[0] = vec256_extract(in[i], 0); ------------------ | | 39| 27.0k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 157| 27.0k| v[1] = vec256_extract(in[i], 1); ------------------ | | 39| 27.0k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 158| 27.0k| v[2] = vec256_extract(in[i], 2); ------------------ | | 39| 27.0k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 159| 27.0k| v[3] = vec256_extract(in[i], 3); ------------------ | | 39| 27.0k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 160| | 161| 27.0k| out[2 * i + 0] = vec128_set2x(v[0], v[1]); 162| 27.0k| out[2 * i + 1] = vec128_set2x(v[2], v[3]); 163| 27.0k| } 164| 936|} decrypt.c:postprocess: 74| 782|static void postprocess(unsigned char *e, vec128 *err) { 75| 782| int i; 76| 782| unsigned char error8[ (1 << GFBITS) / 8 ]; 77| 782| uint64_t v[2]; 78| | 79| 45.0k| for (i = 0; i < 32; i++) { ------------------ | Branch (79:17): [True: 44.2k, False: 782] ------------------ 80| 44.2k| v[0] = vec128_extract(err[i], 0); ------------------ | | 28| 44.2k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 81| 44.2k| v[1] = vec128_extract(err[i], 1); ------------------ | | 28| 44.2k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 82| | 83| 44.2k| store8(error8 + i * 16 + 0, v[0]); 84| 44.2k| store8(error8 + i * 16 + 8, v[1]); 85| 44.2k| } 86| | 87| 535k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 535k|#define SYS_N 3488 ------------------ | Branch (87:17): [True: 534k, False: 782] ------------------ 88| 534k| e[i] = error8[i]; 89| 534k| } 90| 782|} decrypt.c:weight_check: 102| 782|static int weight_check(unsigned char *e, vec128 *error) { 103| 782| int i; 104| 782| uint16_t w0 = 0; 105| 782| uint16_t w1 = 0; 106| 782| uint16_t check; 107| | 108| 45.0k| for (i = 0; i < 32; i++) { ------------------ | Branch (108:17): [True: 44.2k, False: 782] ------------------ 109| 44.2k| w0 += __builtin_popcountll( vec128_extract(error[i], 0) ); ------------------ | | 28| 44.2k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 110| 44.2k| w0 += __builtin_popcountll( vec128_extract(error[i], 1) ); ------------------ | | 28| 44.2k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 111| 44.2k| } 112| | 113| 535k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 535k|#define SYS_N 3488 ------------------ | Branch (113:17): [True: 534k, False: 782] ------------------ 114| 534k| w1 += __builtin_popcountll( e[i] ); 115| 534k| } 116| | 117| 782| check = (w0 ^ SYS_T) | (w1 ^ SYS_T); ------------------ | | 8| 782|#define SYS_T 64 ------------------ check = (w0 ^ SYS_T) | (w1 ^ SYS_T); ------------------ | | 8| 782|#define SYS_T 64 ------------------ 118| 782| check -= 1; 119| 782| check >>= 15; 120| | 121| 782| return check; 122| 782|} PQCLEAN_MCELIECE348864_AVX2_encrypt: 114| 102|void encrypt(unsigned char *s, const unsigned char *pk, unsigned char *e) { 115| 102| gen_e(e); 116| | 117| 102| syndrome_asm(s, pk, e); ------------------ | | 1| 102|#define syndrome_asm CRYPTO_NAMESPACE(syndrome_asm) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 118| 102|} PQCLEAN_MCELIECE348864_AVX2_fft: 171| 1.24k|void fft(vec256 out[][ GFBITS ], uint64_t *in) { 172| 1.24k| radix_conversions(in); 173| 1.24k| butterflies(out, in); 174| 1.24k|} fft.c:radix_conversions: 15| 1.49k|static void radix_conversions(uint64_t *in) { 16| 1.49k| int i, j, k; 17| | 18| 1.49k| const uint64_t mask[5][2] = { 19| 1.49k| {0x8888888888888888, 0x4444444444444444}, 20| 1.49k| {0xC0C0C0C0C0C0C0C0, 0x3030303030303030}, 21| 1.49k| {0xF000F000F000F000, 0x0F000F000F000F00}, 22| 1.49k| {0xFF000000FF000000, 0x00FF000000FF0000}, 23| 1.49k| {0xFFFF000000000000, 0x0000FFFF00000000} 24| 1.49k| }; 25| | 26| 1.49k| const uint64_t s[5][GFBITS] = { 27| 1.49k|#include "scalars.data" ------------------ | | 1| 1.49k|{ | | 2| 1.49k| 0XF3CFC030FC30F003, | | 3| 1.49k| 0X3FCF0F003C00C00C, | | 4| 1.49k| 0X30033CC300C0C03C, | | 5| 1.49k| 0XCCFF0F3C0F30F0C0, | | 6| 1.49k| 0X0300C03FF303C3F0, | | 7| 1.49k| 0X3FFF3C0FF0CCCCC0, | | 8| 1.49k| 0XF3FFF0C00F3C3CC0, | | 9| 1.49k| 0X3003333FFFC3C000, | | 10| 1.49k| 0X0FF30FFFC3FFF300, | | 11| 1.49k| 0XFFC0F300F0F0CC00, | | 12| 1.49k| 0XC0CFF3FCCC3CFC00, | | 13| 1.49k| 0XFC3C03F0F330C000, | | 14| 1.49k|}, { | | 15| 1.49k| 0X000F00000000F00F, | | 16| 1.49k| 0X00000F00F00000F0, | | 17| 1.49k| 0X0F00000F00000F00, | | 18| 1.49k| 0XF00F00F00F000000, | | 19| 1.49k| 0X00F00000000000F0, | | 20| 1.49k| 0X0000000F00000000, | | 21| 1.49k| 0XF00000000F00F000, | | 22| 1.49k| 0X00F00F00000F0000, | | 23| 1.49k| 0X0000F00000F00F00, | | 24| 1.49k| 0X000F00F00F00F000, | | 25| 1.49k| 0X00F00F0000000000, | | 26| 1.49k| 0X0000000000F00000, | | 27| 1.49k|}, { | | 28| 1.49k| 0X0000FF00FF0000FF, | | 29| 1.49k| 0X0000FF000000FF00, | | 30| 1.49k| 0XFF0000FF00FF0000, | | 31| 1.49k| 0XFFFF0000FF000000, | | 32| 1.49k| 0X00FF00FF00FF0000, | | 33| 1.49k| 0X0000FFFFFF000000, | | 34| 1.49k| 0X00FFFF00FF000000, | | 35| 1.49k| 0XFFFFFF0000FF0000, | | 36| 1.49k| 0XFFFF00FFFF00FF00, | | 37| 1.49k| 0X0000FF0000000000, | | 38| 1.49k| 0XFFFFFF00FF000000, | | 39| 1.49k| 0X00FF000000000000, | | 40| 1.49k|}, { | | 41| 1.49k| 0X000000000000FFFF, | | 42| 1.49k| 0X00000000FFFF0000, | | 43| 1.49k| 0X0000000000000000, | | 44| 1.49k| 0XFFFF000000000000, | | 45| 1.49k| 0X00000000FFFF0000, | | 46| 1.49k| 0X0000FFFF00000000, | | 47| 1.49k| 0X0000000000000000, | | 48| 1.49k| 0X00000000FFFF0000, | | 49| 1.49k| 0X0000FFFF00000000, | | 50| 1.49k| 0X0000000000000000, | | 51| 1.49k| 0X0000000000000000, | | 52| 1.49k| 0X0000000000000000, | | 53| 1.49k|}, { | | 54| 1.49k| 0X00000000FFFFFFFF, | | 55| 1.49k| 0XFFFFFFFF00000000, | | 56| 1.49k| 0XFFFFFFFF00000000, | | 57| 1.49k| 0X0000000000000000, | | 58| 1.49k| 0X0000000000000000, | | 59| 1.49k| 0XFFFFFFFF00000000, | | 60| 1.49k| 0X0000000000000000, | | 61| 1.49k| 0X0000000000000000, | | 62| 1.49k| 0XFFFFFFFF00000000, | | 63| 1.49k| 0X0000000000000000, | | 64| 1.49k| 0X0000000000000000, | | 65| 1.49k| 0X0000000000000000, | | 66| 1.49k|} ------------------ 28| 1.49k| }; 29| | 30| | // 31| | 32| 8.99k| for (j = 0; j <= 4; j++) { ------------------ | Branch (32:17): [True: 7.49k, False: 1.49k] ------------------ 33| 97.4k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 97.4k|#define GFBITS 12 ------------------ | Branch (33:21): [True: 89.9k, False: 7.49k] ------------------ 34| 359k| for (k = 4; k >= j; k--) { ------------------ | Branch (34:25): [True: 269k, False: 89.9k] ------------------ 35| 269k| in[i] ^= (in[i] & mask[k][0]) >> (1 << k); 36| 269k| in[i] ^= (in[i] & mask[k][1]) >> (1 << k); 37| 269k| } 38| 89.9k| } 39| | 40| 7.49k| vec_mul(in, in, s[j]); // scaling 41| 7.49k| } 42| 1.49k|} fft.c:butterflies: 46| 1.49k|static void butterflies(vec256 out[][ GFBITS ], const uint64_t *in) { 47| 1.49k| int i, j, k, s, b; 48| | 49| 1.49k| uint64_t t0, t1, t2, t3; 50| | 51| 1.49k| const vec256 consts[ 17 ][ GFBITS ] = { 52| 1.49k|#include "consts.data" ------------------ | | 1| 1.49k|{ | | 2| 1.49k| vec256_set4x(0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0), | | 3| 1.49k| vec256_set4x(0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0), | | 4| 1.49k| vec256_set4x(0x0FF00FF00FF00FF0, 0x0FF00FF00FF00FF0, 0x0FF00FF00FF00FF0, 0x0FF00FF00FF00FF0), | | 5| 1.49k| vec256_set4x(0xAA5555AAAA5555AA, 0xAA5555AAAA5555AA, 0xAA5555AAAA5555AA, 0xAA5555AAAA5555AA), | | 6| 1.49k| vec256_set4x(0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0), | | 7| 1.49k| vec256_set4x(0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC), | | 8| 1.49k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 9| 1.49k| vec256_set4x(0xCC33CC3333CC33CC, 0xCC33CC3333CC33CC, 0xCC33CC3333CC33CC, 0xCC33CC3333CC33CC), | | 10| 1.49k| vec256_set4x(0x33CC33CC33CC33CC, 0x33CC33CC33CC33CC, 0x33CC33CC33CC33CC, 0x33CC33CC33CC33CC), | | 11| 1.49k| vec256_set4x(0x5A5A5A5A5A5A5A5A, 0x5A5A5A5A5A5A5A5A, 0x5A5A5A5A5A5A5A5A, 0x5A5A5A5A5A5A5A5A), | | 12| 1.49k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 13| 1.49k| vec256_set4x(0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0), | | 14| 1.49k|}, { | | 15| 1.49k| vec256_set4x(0x3C3C3C3C3C3C3C3C, 0x3C3C3C3C3C3C3C3C, 0x3C3C3C3C3C3C3C3C, 0x3C3C3C3C3C3C3C3C), | | 16| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F), | | 17| 1.49k| vec256_set4x(0x5555AAAA5555AAAA, 0xAAAA5555AAAA5555, 0x5555AAAA5555AAAA, 0xAAAA5555AAAA5555), | | 18| 1.49k| vec256_set4x(0xCC3333CCCC3333CC, 0xCC3333CCCC3333CC, 0xCC3333CCCC3333CC, 0xCC3333CCCC3333CC), | | 19| 1.49k| vec256_set4x(0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C), | | 20| 1.49k| vec256_set4x(0x55555555AAAAAAAA, 0x55555555AAAAAAAA, 0x55555555AAAAAAAA, 0x55555555AAAAAAAA), | | 21| 1.49k| vec256_set4x(0x33333333CCCCCCCC, 0x33333333CCCCCCCC, 0x33333333CCCCCCCC, 0x33333333CCCCCCCC), | | 22| 1.49k| vec256_set4x(0x00FF00FFFF00FF00, 0xFF00FF0000FF00FF, 0x00FF00FFFF00FF00, 0xFF00FF0000FF00FF), | | 23| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F), | | 24| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 25| 1.49k| vec256_set4x(0x0000FFFFFFFF0000, 0x0000FFFFFFFF0000, 0x0000FFFFFFFF0000, 0x0000FFFFFFFF0000), | | 26| 1.49k| vec256_set4x(0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0), | | 27| 1.49k|}, { | | 28| 1.49k| vec256_set4x(0xAA55AA5555AA55AA, 0x55AA55AAAA55AA55, 0xAA55AA5555AA55AA, 0x55AA55AAAA55AA55), | | 29| 1.49k| vec256_set4x(0xCC33CC3333CC33CC, 0xCC33CC3333CC33CC, 0x33CC33CCCC33CC33, 0x33CC33CCCC33CC33), | | 30| 1.49k| vec256_set4x(0x33CCCC33CC3333CC, 0xCC3333CC33CCCC33, 0xCC3333CC33CCCC33, 0x33CCCC33CC3333CC), | | 31| 1.49k| vec256_set4x(0x55555555AAAAAAAA, 0x55555555AAAAAAAA, 0x55555555AAAAAAAA, 0x55555555AAAAAAAA), | | 32| 1.49k| vec256_set4x(0xFF0000FF00FFFF00, 0xFF0000FF00FFFF00, 0x00FFFF00FF0000FF, 0x00FFFF00FF0000FF), | | 33| 1.49k| vec256_set4x(0x3CC33CC3C33CC33C, 0xC33CC33C3CC33CC3, 0x3CC33CC3C33CC33C, 0xC33CC33C3CC33CC3), | | 34| 1.49k| vec256_set4x(0x5555AAAA5555AAAA, 0xAAAA5555AAAA5555, 0x5555AAAA5555AAAA, 0xAAAA5555AAAA5555), | | 35| 1.49k| vec256_set4x(0x0FF00FF00FF00FF0, 0xF00FF00FF00FF00F, 0x0FF00FF00FF00FF0, 0xF00FF00FF00FF00F), | | 36| 1.49k| vec256_set4x(0xCCCC33333333CCCC, 0x3333CCCCCCCC3333, 0x3333CCCCCCCC3333, 0xCCCC33333333CCCC), | | 37| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F), | | 38| 1.49k| vec256_set4x(0x00FFFF0000FFFF00, 0xFF0000FFFF0000FF, 0x00FFFF0000FFFF00, 0xFF0000FFFF0000FF), | | 39| 1.49k| vec256_set4x(0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C), | | 40| 1.49k|}, { | | 41| 1.49k| vec256_set4x(0x6699669999669966, 0x9966996666996699, 0x6699669999669966, 0x9966996666996699), | | 42| 1.49k| vec256_set4x(0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC), | | 43| 1.49k| vec256_set4x(0xA5A5A5A55A5A5A5A, 0xA5A5A5A55A5A5A5A, 0x5A5A5A5AA5A5A5A5, 0x5A5A5A5AA5A5A5A5), | | 44| 1.49k| vec256_set4x(0x3C3CC3C3C3C33C3C, 0x3C3CC3C3C3C33C3C, 0xC3C33C3C3C3CC3C3, 0xC3C33C3C3C3CC3C3), | | 45| 1.49k| vec256_set4x(0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F, 0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0), | | 46| 1.49k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 47| 1.49k| vec256_set4x(0x3C3CC3C3C3C33C3C, 0x3C3CC3C3C3C33C3C, 0xC3C33C3C3C3CC3C3, 0xC3C33C3C3C3CC3C3), | | 48| 1.49k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0xF0F0F0F00F0F0F0F, 0x0F0F0F0FF0F0F0F0, 0xF0F0F0F00F0F0F0F), | | 49| 1.49k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 50| 1.49k| vec256_set4x(0x33CCCC33CC3333CC, 0xCC3333CC33CCCC33, 0x33CCCC33CC3333CC, 0xCC3333CC33CCCC33), | | 51| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F), | | 52| 1.49k| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 53| 1.49k|}, { | | 54| 1.49k| vec256_set4x(0x6699669999669966, 0x9966996666996699, 0x6699669999669966, 0x9966996666996699), | | 55| 1.49k| vec256_set4x(0xCC3333CC33CCCC33, 0xCC3333CC33CCCC33, 0xCC3333CC33CCCC33, 0xCC3333CC33CCCC33), | | 56| 1.49k| vec256_set4x(0x5A5A5A5AA5A5A5A5, 0x5A5A5A5AA5A5A5A5, 0xA5A5A5A55A5A5A5A, 0xA5A5A5A55A5A5A5A), | | 57| 1.49k| vec256_set4x(0x3C3CC3C3C3C33C3C, 0x3C3CC3C3C3C33C3C, 0xC3C33C3C3C3CC3C3, 0xC3C33C3C3C3CC3C3), | | 58| 1.49k| vec256_set4x(0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0, 0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F), | | 59| 1.49k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 60| 1.49k| vec256_set4x(0x3C3CC3C3C3C33C3C, 0x3C3CC3C3C3C33C3C, 0xC3C33C3C3C3CC3C3, 0xC3C33C3C3C3CC3C3), | | 61| 1.49k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0xF0F0F0F00F0F0F0F, 0x0F0F0F0FF0F0F0F0, 0xF0F0F0F00F0F0F0F), | | 62| 1.49k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 63| 1.49k| vec256_set4x(0x33CCCC33CC3333CC, 0xCC3333CC33CCCC33, 0x33CCCC33CC3333CC, 0xCC3333CC33CCCC33), | | 64| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F), | | 65| 1.49k| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 66| 1.49k|}, { | | 67| 1.49k| vec256_set4x(0x9669699696696996, 0x9669699696696996, 0x9669699696696996, 0x9669699696696996), | | 68| 1.49k| vec256_set4x(0x6996699669966996, 0x6996699669966996, 0x6996699669966996, 0x6996699669966996), | | 69| 1.49k| vec256_set4x(0x6996699669966996, 0x6996699669966996, 0x6996699669966996, 0x6996699669966996), | | 70| 1.49k| vec256_set4x(0x00FFFF0000FFFF00, 0x00FFFF0000FFFF00, 0xFF0000FFFF0000FF, 0xFF0000FFFF0000FF), | | 71| 1.49k| vec256_set4x(0xFF00FF00FF00FF00, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0xFF00FF00FF00FF00), | | 72| 1.49k| vec256_set4x(0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F, 0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0), | | 73| 1.49k| vec256_set4x(0xF0F00F0F0F0FF0F0, 0x0F0FF0F0F0F00F0F, 0x0F0FF0F0F0F00F0F, 0xF0F00F0F0F0FF0F0), | | 74| 1.49k| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 75| 1.49k| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 76| 1.49k| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 77| 1.49k| vec256_set4x(0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C), | | 78| 1.49k| vec256_set4x(0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C), | | 79| 1.49k|}, { | | 80| 1.49k| vec256_set4x(0x9669699696696996, 0x9669699696696996, 0x9669699696696996, 0x9669699696696996), | | 81| 1.49k| vec256_set4x(0x6996699669966996, 0x6996699669966996, 0x6996699669966996, 0x6996699669966996), | | 82| 1.49k| vec256_set4x(0x9669966996699669, 0x9669966996699669, 0x9669966996699669, 0x9669966996699669), | | 83| 1.49k| vec256_set4x(0xFF0000FFFF0000FF, 0xFF0000FFFF0000FF, 0x00FFFF0000FFFF00, 0x00FFFF0000FFFF00), | | 84| 1.49k| vec256_set4x(0x00FF00FF00FF00FF, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0x00FF00FF00FF00FF), | | 85| 1.49k| vec256_set4x(0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F, 0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0), | | 86| 1.49k| vec256_set4x(0xF0F00F0F0F0FF0F0, 0x0F0FF0F0F0F00F0F, 0x0F0FF0F0F0F00F0F, 0xF0F00F0F0F0FF0F0), | | 87| 1.49k| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 88| 1.49k| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 89| 1.49k| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 90| 1.49k| vec256_set4x(0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C), | | 91| 1.49k| vec256_set4x(0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C), | | 92| 1.49k|}, { | | 93| 1.49k| vec256_set4x(0x9669699696696996, 0x9669699696696996, 0x9669699696696996, 0x9669699696696996), | | 94| 1.49k| vec256_set4x(0x9669966996699669, 0x9669966996699669, 0x9669966996699669, 0x9669966996699669), | | 95| 1.49k| vec256_set4x(0x9669966996699669, 0x9669966996699669, 0x9669966996699669, 0x9669966996699669), | | 96| 1.49k| vec256_set4x(0x00FFFF0000FFFF00, 0x00FFFF0000FFFF00, 0xFF0000FFFF0000FF, 0xFF0000FFFF0000FF), | | 97| 1.49k| vec256_set4x(0xFF00FF00FF00FF00, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0xFF00FF00FF00FF00), | | 98| 1.49k| vec256_set4x(0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F, 0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0), | | 99| 1.49k| vec256_set4x(0xF0F00F0F0F0FF0F0, 0x0F0FF0F0F0F00F0F, 0x0F0FF0F0F0F00F0F, 0xF0F00F0F0F0FF0F0), | | 100| 1.49k| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 101| 1.49k| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 102| 1.49k| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 103| 1.49k| vec256_set4x(0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C), | | 104| 1.49k| vec256_set4x(0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C), | | 105| 1.49k|}, { | | 106| 1.49k| vec256_set4x(0x9669699696696996, 0x9669699696696996, 0x9669699696696996, 0x9669699696696996), | | 107| 1.49k| vec256_set4x(0x9669966996699669, 0x9669966996699669, 0x9669966996699669, 0x9669966996699669), | | 108| 1.49k| vec256_set4x(0x6996699669966996, 0x6996699669966996, 0x6996699669966996, 0x6996699669966996), | | 109| 1.49k| vec256_set4x(0xFF0000FFFF0000FF, 0xFF0000FFFF0000FF, 0x00FFFF0000FFFF00, 0x00FFFF0000FFFF00), | | 110| 1.49k| vec256_set4x(0x00FF00FF00FF00FF, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0x00FF00FF00FF00FF), | | 111| 1.49k| vec256_set4x(0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F, 0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0), | | 112| 1.49k| vec256_set4x(0xF0F00F0F0F0FF0F0, 0x0F0FF0F0F0F00F0F, 0x0F0FF0F0F0F00F0F, 0xF0F00F0F0F0FF0F0), | | 113| 1.49k| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 114| 1.49k| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 115| 1.49k| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 116| 1.49k| vec256_set4x(0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C), | | 117| 1.49k| vec256_set4x(0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C), | | 118| 1.49k|}, { | | 119| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 120| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 121| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 122| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 123| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 124| 1.49k| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 125| 1.49k| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 126| 1.49k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 127| 1.49k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 128| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 129| 1.49k| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 130| 1.49k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 131| 1.49k|}, { | | 132| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 133| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 134| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 135| 1.49k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 136| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 137| 1.49k| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 138| 1.49k| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 139| 1.49k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 140| 1.49k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 141| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 142| 1.49k| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 143| 1.49k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 144| 1.49k|}, { | | 145| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 146| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 147| 1.49k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 148| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 149| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 150| 1.49k| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 151| 1.49k| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 152| 1.49k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 153| 1.49k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 154| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 155| 1.49k| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 156| 1.49k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 157| 1.49k|}, { | | 158| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 159| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 160| 1.49k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 161| 1.49k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 162| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 163| 1.49k| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 164| 1.49k| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 165| 1.49k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 166| 1.49k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 167| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 168| 1.49k| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 169| 1.49k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 170| 1.49k|}, { | | 171| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 172| 1.49k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 173| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 174| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 175| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 176| 1.49k| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 177| 1.49k| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 178| 1.49k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 179| 1.49k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 180| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 181| 1.49k| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 182| 1.49k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 183| 1.49k|}, { | | 184| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 185| 1.49k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 186| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 187| 1.49k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 188| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 189| 1.49k| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 190| 1.49k| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 191| 1.49k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 192| 1.49k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 193| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 194| 1.49k| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 195| 1.49k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 196| 1.49k|}, { | | 197| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 198| 1.49k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 199| 1.49k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 200| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 201| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 202| 1.49k| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 203| 1.49k| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 204| 1.49k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 205| 1.49k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 206| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 207| 1.49k| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 208| 1.49k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 209| 1.49k|}, { | | 210| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 211| 1.49k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 212| 1.49k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 213| 1.49k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 214| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 215| 1.49k| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 216| 1.49k| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 217| 1.49k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 218| 1.49k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 219| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 220| 1.49k| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 221| 1.49k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 222| 1.49k|}, ------------------ 53| 1.49k| }; 54| | 55| 1.49k| uint64_t consts_ptr = 0; 56| | 57| 1.49k| const unsigned char reversal[64] = { 58| 1.49k| 0, 32, 16, 48, 8, 40, 24, 56, 59| 1.49k| 4, 36, 20, 52, 12, 44, 28, 60, 60| 1.49k| 2, 34, 18, 50, 10, 42, 26, 58, 61| 1.49k| 6, 38, 22, 54, 14, 46, 30, 62, 62| 1.49k| 1, 33, 17, 49, 9, 41, 25, 57, 63| 1.49k| 5, 37, 21, 53, 13, 45, 29, 61, 64| 1.49k| 3, 35, 19, 51, 11, 43, 27, 59, 65| 1.49k| 7, 39, 23, 55, 15, 47, 31, 63 66| 1.49k| }; 67| | 68| | // boradcast 69| | 70| 1.49k| vec256 tmp256[ GFBITS ]; 71| 1.49k| vec256 x[ GFBITS ], y[ GFBITS ]; 72| | 73| 13.4k| for (j = 0; j < 64; j += 8) { ------------------ | Branch (73:17): [True: 11.9k, False: 1.49k] ------------------ 74| 155k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 155k|#define GFBITS 12 ------------------ | Branch (74:21): [True: 143k, False: 11.9k] ------------------ 75| 143k| t0 = (in[i] >> reversal[j + 0]) & 1; 76| 143k| t0 = -t0; 77| 143k| t1 = (in[i] >> reversal[j + 2]) & 1; 78| 143k| t1 = -t1; 79| 143k| t2 = (in[i] >> reversal[j + 4]) & 1; 80| 143k| t2 = -t2; 81| 143k| t3 = (in[i] >> reversal[j + 6]) & 1; 82| 143k| t3 = -t3; 83| | 84| 143k| out[j / 4 + 0][i] = vec256_set4x(t0, t1, t2, t3); 85| | 86| 143k| t0 = (in[i] >> reversal[j + 1]) & 1; 87| 143k| t0 = -t0; 88| 143k| t1 = (in[i] >> reversal[j + 3]) & 1; 89| 143k| t1 = -t1; 90| 143k| t2 = (in[i] >> reversal[j + 5]) & 1; 91| 143k| t2 = -t2; 92| 143k| t3 = (in[i] >> reversal[j + 7]) & 1; 93| 143k| t3 = -t3; 94| | 95| 143k| out[j / 4 + 1][i] = vec256_set4x(t0, t1, t2, t3); 96| 143k| } 97| 11.9k| } 98| | 99| | // 100| | 101| 13.4k| for (i = 0; i < 16; i += 2) { ------------------ | Branch (101:17): [True: 11.9k, False: 1.49k] ------------------ 102| 11.9k| vec256_mul(tmp256, out[i + 1], consts[ 0 ]); 103| | 104| 155k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 155k|#define GFBITS 12 ------------------ | Branch (104:21): [True: 143k, False: 11.9k] ------------------ 105| 143k| out[i + 0][b] ^= tmp256[b]; 106| 143k| } 107| 155k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 155k|#define GFBITS 12 ------------------ | Branch (107:21): [True: 143k, False: 11.9k] ------------------ 108| 143k| out[i + 1][b] ^= out[i + 0][b]; 109| 143k| } 110| 11.9k| } 111| | 112| 13.4k| for (i = 0; i < 16; i += 2) { ------------------ | Branch (112:17): [True: 11.9k, False: 1.49k] ------------------ 113| 155k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 155k|#define GFBITS 12 ------------------ | Branch (113:21): [True: 143k, False: 11.9k] ------------------ 114| 143k| x[b] = vec256_unpack_low_2x(out[i + 0][b], out[i + 1][b]); 115| 143k| } 116| 155k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 155k|#define GFBITS 12 ------------------ | Branch (116:21): [True: 143k, False: 11.9k] ------------------ 117| 143k| y[b] = vec256_unpack_high_2x(out[i + 0][b], out[i + 1][b]); 118| 143k| } 119| | 120| 11.9k| vec256_mul(tmp256, y, consts[ 1 ]); 121| | 122| 155k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 155k|#define GFBITS 12 ------------------ | Branch (122:21): [True: 143k, False: 11.9k] ------------------ 123| 143k| x[b] ^= tmp256[b]; 124| 143k| } 125| 155k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 155k|#define GFBITS 12 ------------------ | Branch (125:21): [True: 143k, False: 11.9k] ------------------ 126| 143k| y[b] ^= x[b]; 127| 143k| } 128| | 129| 155k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 155k|#define GFBITS 12 ------------------ | Branch (129:21): [True: 143k, False: 11.9k] ------------------ 130| 143k| out[i + 0][b] = vec256_unpack_low(x[b], y[b]); 131| 143k| } 132| 155k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 155k|#define GFBITS 12 ------------------ | Branch (132:21): [True: 143k, False: 11.9k] ------------------ 133| 143k| out[i + 1][b] = vec256_unpack_high(x[b], y[b]); 134| 143k| } 135| 11.9k| } 136| | 137| 1.49k| consts_ptr = 2; 138| | 139| 7.49k| for (i = 0; i <= 3; i++) { ------------------ | Branch (139:17): [True: 5.99k, False: 1.49k] ------------------ 140| 5.99k| s = 1 << i; 141| | 142| 28.4k| for (j = 0; j < 16; j += 2 * s) { ------------------ | Branch (142:21): [True: 22.4k, False: 5.99k] ------------------ 143| 70.4k| for (k = j; k < j + s; k++) { ------------------ | Branch (143:25): [True: 47.9k, False: 22.4k] ------------------ 144| 47.9k| vec256_mul(tmp256, out[k + s], consts[ consts_ptr + (k - j) ]); 145| | 146| 623k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 623k|#define GFBITS 12 ------------------ | Branch (146:29): [True: 575k, False: 47.9k] ------------------ 147| 575k| out[k][b] ^= tmp256[b]; 148| 575k| } 149| 623k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 623k|#define GFBITS 12 ------------------ | Branch (149:29): [True: 575k, False: 47.9k] ------------------ 150| 575k| out[k + s][b] ^= out[k][b]; 151| 575k| } 152| 47.9k| } 153| 22.4k| } 154| | 155| 5.99k| consts_ptr += s; 156| 5.99k| } 157| | 158| | // adding the part contributed by x^64 159| | 160| 1.49k| vec256 powers[16][GFBITS] = { 161| 1.49k|#include "powers.data" ------------------ | | 1| 1.49k|{ | | 2| 1.49k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 3| 1.49k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 4| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 5| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 6| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 7| 1.49k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55), | | 8| 1.49k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 9| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 10| 1.49k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 11| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 12| 1.49k| vec256_set4x(0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC), | | 13| 1.49k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 14| 1.49k|}, { | | 15| 1.49k| vec256_set4x(0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F), | | 16| 1.49k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 17| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 18| 1.49k| vec256_set4x(0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F), | | 19| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 20| 1.49k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55), | | 21| 1.49k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 22| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 23| 1.49k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 24| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 25| 1.49k| vec256_set4x(0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC), | | 26| 1.49k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 27| 1.49k|}, { | | 28| 1.49k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 29| 1.49k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 30| 1.49k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 31| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 32| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 33| 1.49k| vec256_set4x(0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 34| 1.49k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 35| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 36| 1.49k| vec256_set4x(0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF), | | 37| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 38| 1.49k| vec256_set4x(0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC), | | 39| 1.49k| vec256_set4x(0x5555555555555555, 0x5555555555555555, 0x5555555555555555, 0x5555555555555555), | | 40| 1.49k|}, { | | 41| 1.49k| vec256_set4x(0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F), | | 42| 1.49k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 43| 1.49k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 44| 1.49k| vec256_set4x(0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F), | | 45| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 46| 1.49k| vec256_set4x(0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 47| 1.49k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 48| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 49| 1.49k| vec256_set4x(0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF), | | 50| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 51| 1.49k| vec256_set4x(0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC), | | 52| 1.49k| vec256_set4x(0x5555555555555555, 0x5555555555555555, 0x5555555555555555, 0x5555555555555555), | | 53| 1.49k|}, { | | 54| 1.49k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 55| 1.49k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 56| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 57| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 58| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 59| 1.49k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55), | | 60| 1.49k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 61| 1.49k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0x0000000000000000), | | 62| 1.49k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 63| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 64| 1.49k| vec256_set4x(0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333), | | 65| 1.49k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 66| 1.49k|}, { | | 67| 1.49k| vec256_set4x(0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F), | | 68| 1.49k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 69| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 70| 1.49k| vec256_set4x(0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F), | | 71| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 72| 1.49k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55), | | 73| 1.49k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 74| 1.49k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0x0000000000000000), | | 75| 1.49k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 76| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 77| 1.49k| vec256_set4x(0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333), | | 78| 1.49k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 79| 1.49k|}, { | | 80| 1.49k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 81| 1.49k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 82| 1.49k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 83| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 84| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 85| 1.49k| vec256_set4x(0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 86| 1.49k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 87| 1.49k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0x0000000000000000), | | 88| 1.49k| vec256_set4x(0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF), | | 89| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 90| 1.49k| vec256_set4x(0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333), | | 91| 1.49k| vec256_set4x(0x5555555555555555, 0x5555555555555555, 0x5555555555555555, 0x5555555555555555), | | 92| 1.49k|}, { | | 93| 1.49k| vec256_set4x(0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F), | | 94| 1.49k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 95| 1.49k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 96| 1.49k| vec256_set4x(0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F), | | 97| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 98| 1.49k| vec256_set4x(0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 99| 1.49k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 100| 1.49k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0x0000000000000000), | | 101| 1.49k| vec256_set4x(0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF), | | 102| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 103| 1.49k| vec256_set4x(0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333), | | 104| 1.49k| vec256_set4x(0x5555555555555555, 0x5555555555555555, 0x5555555555555555, 0x5555555555555555), | | 105| 1.49k|}, { | | 106| 1.49k| vec256_set4x(0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F), | | 107| 1.49k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 108| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 109| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 110| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 111| 1.49k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55), | | 112| 1.49k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 113| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 114| 1.49k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 115| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 116| 1.49k| vec256_set4x(0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC), | | 117| 1.49k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 118| 1.49k|}, { | | 119| 1.49k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 120| 1.49k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 121| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 122| 1.49k| vec256_set4x(0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F), | | 123| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 124| 1.49k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55), | | 125| 1.49k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 126| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 127| 1.49k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 128| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 129| 1.49k| vec256_set4x(0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC), | | 130| 1.49k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 131| 1.49k|}, { | | 132| 1.49k| vec256_set4x(0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F), | | 133| 1.49k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 134| 1.49k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 135| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 136| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 137| 1.49k| vec256_set4x(0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 138| 1.49k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 139| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 140| 1.49k| vec256_set4x(0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF), | | 141| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 142| 1.49k| vec256_set4x(0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC), | | 143| 1.49k| vec256_set4x(0x5555555555555555, 0x5555555555555555, 0x5555555555555555, 0x5555555555555555), | | 144| 1.49k|}, { | | 145| 1.49k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 146| 1.49k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 147| 1.49k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 148| 1.49k| vec256_set4x(0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F), | | 149| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 150| 1.49k| vec256_set4x(0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 151| 1.49k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 152| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 153| 1.49k| vec256_set4x(0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF), | | 154| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 155| 1.49k| vec256_set4x(0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC, 0x3333CCCC3333CCCC), | | 156| 1.49k| vec256_set4x(0x5555555555555555, 0x5555555555555555, 0x5555555555555555, 0x5555555555555555), | | 157| 1.49k|}, { | | 158| 1.49k| vec256_set4x(0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F), | | 159| 1.49k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 160| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 161| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 162| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 163| 1.49k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55), | | 164| 1.49k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 165| 1.49k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0x0000000000000000), | | 166| 1.49k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 167| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 168| 1.49k| vec256_set4x(0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333), | | 169| 1.49k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 170| 1.49k|}, { | | 171| 1.49k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 172| 1.49k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 173| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 174| 1.49k| vec256_set4x(0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F), | | 175| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 176| 1.49k| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55), | | 177| 1.49k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 178| 1.49k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0x0000000000000000), | | 179| 1.49k| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 180| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 181| 1.49k| vec256_set4x(0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333), | | 182| 1.49k| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 183| 1.49k|}, { | | 184| 1.49k| vec256_set4x(0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F, 0xF0F0F0F00F0F0F0F), | | 185| 1.49k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 186| 1.49k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 187| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 188| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 189| 1.49k| vec256_set4x(0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 190| 1.49k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 191| 1.49k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0x0000000000000000), | | 192| 1.49k| vec256_set4x(0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF), | | 193| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 194| 1.49k| vec256_set4x(0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333), | | 195| 1.49k| vec256_set4x(0x5555555555555555, 0x5555555555555555, 0x5555555555555555, 0x5555555555555555), | | 196| 1.49k|}, { | | 197| 1.49k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 198| 1.49k| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0x0000FFFF0000FFFF, 0x0000FFFF0000FFFF), | | 199| 1.49k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 200| 1.49k| vec256_set4x(0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F, 0x0F0F0F0F0F0F0F0F), | | 201| 1.49k| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 202| 1.49k| vec256_set4x(0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 203| 1.49k| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0, 0x0F0F0F0FF0F0F0F0), | | 204| 1.49k| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0x0000000000000000), | | 205| 1.49k| vec256_set4x(0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF), | | 206| 1.49k| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 207| 1.49k| vec256_set4x(0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333, 0xCCCC3333CCCC3333), | | 208| 1.49k| vec256_set4x(0x5555555555555555, 0x5555555555555555, 0x5555555555555555, 0x5555555555555555), | | 209| 1.49k|}, ------------------ 162| 1.49k| }; 163| | 164| 25.4k| for (i = 0; i < 16; i++) { ------------------ | Branch (164:17): [True: 23.9k, False: 1.49k] ------------------ 165| 311k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 311k|#define GFBITS 12 ------------------ | Branch (165:21): [True: 287k, False: 23.9k] ------------------ 166| 287k| out[i][b] = vec256_xor(out[i][b], powers[i][b]); 167| 287k| } 168| 23.9k| } 169| 1.49k|} PQCLEAN_MCELIECE348864_AVX2_fft_tr: 354| 204|void fft_tr(vec128 out[GFBITS], vec256 in[][ GFBITS ]) { 355| 204| butterflies_tr(out, in); 356| 204| radix_conversions_tr(out); 357| 204|} fft_tr.c:butterflies_tr: 65| 360|static void butterflies_tr(vec128 out[ GFBITS ], vec256 in[][ GFBITS ]) { 66| 360| int i, j, k, s, b; 67| | 68| 360| uint64_t tmp[ GFBITS ]; 69| 360| uint64_t pre[6][ GFBITS ]; 70| 360| uint64_t out64[2][64]; 71| | 72| 360| vec256 p2[ 6 ]; 73| 360| vec256 buf[64]; 74| 360| vec256 x[ GFBITS ], y[ GFBITS ]; 75| 360| vec256 tmp256[ GFBITS ]; 76| | 77| 360| const vec256 consts[ 17 ][ GFBITS ] = { 78| 360|#include "consts.data" ------------------ | | 1| 360|{ | | 2| 360| vec256_set4x(0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0), | | 3| 360| vec256_set4x(0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0), | | 4| 360| vec256_set4x(0x0FF00FF00FF00FF0, 0x0FF00FF00FF00FF0, 0x0FF00FF00FF00FF0, 0x0FF00FF00FF00FF0), | | 5| 360| vec256_set4x(0xAA5555AAAA5555AA, 0xAA5555AAAA5555AA, 0xAA5555AAAA5555AA, 0xAA5555AAAA5555AA), | | 6| 360| vec256_set4x(0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0), | | 7| 360| vec256_set4x(0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC), | | 8| 360| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 9| 360| vec256_set4x(0xCC33CC3333CC33CC, 0xCC33CC3333CC33CC, 0xCC33CC3333CC33CC, 0xCC33CC3333CC33CC), | | 10| 360| vec256_set4x(0x33CC33CC33CC33CC, 0x33CC33CC33CC33CC, 0x33CC33CC33CC33CC, 0x33CC33CC33CC33CC), | | 11| 360| vec256_set4x(0x5A5A5A5A5A5A5A5A, 0x5A5A5A5A5A5A5A5A, 0x5A5A5A5A5A5A5A5A, 0x5A5A5A5A5A5A5A5A), | | 12| 360| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 13| 360| vec256_set4x(0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0, 0xF00F0FF0F00F0FF0), | | 14| 360|}, { | | 15| 360| vec256_set4x(0x3C3C3C3C3C3C3C3C, 0x3C3C3C3C3C3C3C3C, 0x3C3C3C3C3C3C3C3C, 0x3C3C3C3C3C3C3C3C), | | 16| 360| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F), | | 17| 360| vec256_set4x(0x5555AAAA5555AAAA, 0xAAAA5555AAAA5555, 0x5555AAAA5555AAAA, 0xAAAA5555AAAA5555), | | 18| 360| vec256_set4x(0xCC3333CCCC3333CC, 0xCC3333CCCC3333CC, 0xCC3333CCCC3333CC, 0xCC3333CCCC3333CC), | | 19| 360| vec256_set4x(0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C), | | 20| 360| vec256_set4x(0x55555555AAAAAAAA, 0x55555555AAAAAAAA, 0x55555555AAAAAAAA, 0x55555555AAAAAAAA), | | 21| 360| vec256_set4x(0x33333333CCCCCCCC, 0x33333333CCCCCCCC, 0x33333333CCCCCCCC, 0x33333333CCCCCCCC), | | 22| 360| vec256_set4x(0x00FF00FFFF00FF00, 0xFF00FF0000FF00FF, 0x00FF00FFFF00FF00, 0xFF00FF0000FF00FF), | | 23| 360| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F), | | 24| 360| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 25| 360| vec256_set4x(0x0000FFFFFFFF0000, 0x0000FFFFFFFF0000, 0x0000FFFFFFFF0000, 0x0000FFFFFFFF0000), | | 26| 360| vec256_set4x(0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0, 0xF0F00F0F0F0FF0F0), | | 27| 360|}, { | | 28| 360| vec256_set4x(0xAA55AA5555AA55AA, 0x55AA55AAAA55AA55, 0xAA55AA5555AA55AA, 0x55AA55AAAA55AA55), | | 29| 360| vec256_set4x(0xCC33CC3333CC33CC, 0xCC33CC3333CC33CC, 0x33CC33CCCC33CC33, 0x33CC33CCCC33CC33), | | 30| 360| vec256_set4x(0x33CCCC33CC3333CC, 0xCC3333CC33CCCC33, 0xCC3333CC33CCCC33, 0x33CCCC33CC3333CC), | | 31| 360| vec256_set4x(0x55555555AAAAAAAA, 0x55555555AAAAAAAA, 0x55555555AAAAAAAA, 0x55555555AAAAAAAA), | | 32| 360| vec256_set4x(0xFF0000FF00FFFF00, 0xFF0000FF00FFFF00, 0x00FFFF00FF0000FF, 0x00FFFF00FF0000FF), | | 33| 360| vec256_set4x(0x3CC33CC3C33CC33C, 0xC33CC33C3CC33CC3, 0x3CC33CC3C33CC33C, 0xC33CC33C3CC33CC3), | | 34| 360| vec256_set4x(0x5555AAAA5555AAAA, 0xAAAA5555AAAA5555, 0x5555AAAA5555AAAA, 0xAAAA5555AAAA5555), | | 35| 360| vec256_set4x(0x0FF00FF00FF00FF0, 0xF00FF00FF00FF00F, 0x0FF00FF00FF00FF0, 0xF00FF00FF00FF00F), | | 36| 360| vec256_set4x(0xCCCC33333333CCCC, 0x3333CCCCCCCC3333, 0x3333CCCCCCCC3333, 0xCCCC33333333CCCC), | | 37| 360| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F), | | 38| 360| vec256_set4x(0x00FFFF0000FFFF00, 0xFF0000FFFF0000FF, 0x00FFFF0000FFFF00, 0xFF0000FFFF0000FF), | | 39| 360| vec256_set4x(0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C, 0xC33CC33CC33CC33C), | | 40| 360|}, { | | 41| 360| vec256_set4x(0x6699669999669966, 0x9966996666996699, 0x6699669999669966, 0x9966996666996699), | | 42| 360| vec256_set4x(0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC, 0x33CCCC33CC3333CC), | | 43| 360| vec256_set4x(0xA5A5A5A55A5A5A5A, 0xA5A5A5A55A5A5A5A, 0x5A5A5A5AA5A5A5A5, 0x5A5A5A5AA5A5A5A5), | | 44| 360| vec256_set4x(0x3C3CC3C3C3C33C3C, 0x3C3CC3C3C3C33C3C, 0xC3C33C3C3C3CC3C3, 0xC3C33C3C3C3CC3C3), | | 45| 360| vec256_set4x(0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F, 0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0), | | 46| 360| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 47| 360| vec256_set4x(0x3C3CC3C3C3C33C3C, 0x3C3CC3C3C3C33C3C, 0xC3C33C3C3C3CC3C3, 0xC3C33C3C3C3CC3C3), | | 48| 360| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0xF0F0F0F00F0F0F0F, 0x0F0F0F0FF0F0F0F0, 0xF0F0F0F00F0F0F0F), | | 49| 360| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 50| 360| vec256_set4x(0x33CCCC33CC3333CC, 0xCC3333CC33CCCC33, 0x33CCCC33CC3333CC, 0xCC3333CC33CCCC33), | | 51| 360| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F), | | 52| 360| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 53| 360|}, { | | 54| 360| vec256_set4x(0x6699669999669966, 0x9966996666996699, 0x6699669999669966, 0x9966996666996699), | | 55| 360| vec256_set4x(0xCC3333CC33CCCC33, 0xCC3333CC33CCCC33, 0xCC3333CC33CCCC33, 0xCC3333CC33CCCC33), | | 56| 360| vec256_set4x(0x5A5A5A5AA5A5A5A5, 0x5A5A5A5AA5A5A5A5, 0xA5A5A5A55A5A5A5A, 0xA5A5A5A55A5A5A5A), | | 57| 360| vec256_set4x(0x3C3CC3C3C3C33C3C, 0x3C3CC3C3C3C33C3C, 0xC3C33C3C3C3CC3C3, 0xC3C33C3C3C3CC3C3), | | 58| 360| vec256_set4x(0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0, 0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F), | | 59| 360| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 60| 360| vec256_set4x(0x3C3CC3C3C3C33C3C, 0x3C3CC3C3C3C33C3C, 0xC3C33C3C3C3CC3C3, 0xC3C33C3C3C3CC3C3), | | 61| 360| vec256_set4x(0x0F0F0F0FF0F0F0F0, 0xF0F0F0F00F0F0F0F, 0x0F0F0F0FF0F0F0F0, 0xF0F0F0F00F0F0F0F), | | 62| 360| vec256_set4x(0x55AA55AA55AA55AA, 0xAA55AA55AA55AA55, 0xAA55AA55AA55AA55, 0x55AA55AA55AA55AA), | | 63| 360| vec256_set4x(0x33CCCC33CC3333CC, 0xCC3333CC33CCCC33, 0x33CCCC33CC3333CC, 0xCC3333CC33CCCC33), | | 64| 360| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F, 0xF0F0F0F0F0F0F0F0, 0x0F0F0F0F0F0F0F0F), | | 65| 360| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 66| 360|}, { | | 67| 360| vec256_set4x(0x9669699696696996, 0x9669699696696996, 0x9669699696696996, 0x9669699696696996), | | 68| 360| vec256_set4x(0x6996699669966996, 0x6996699669966996, 0x6996699669966996, 0x6996699669966996), | | 69| 360| vec256_set4x(0x6996699669966996, 0x6996699669966996, 0x6996699669966996, 0x6996699669966996), | | 70| 360| vec256_set4x(0x00FFFF0000FFFF00, 0x00FFFF0000FFFF00, 0xFF0000FFFF0000FF, 0xFF0000FFFF0000FF), | | 71| 360| vec256_set4x(0xFF00FF00FF00FF00, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0xFF00FF00FF00FF00), | | 72| 360| vec256_set4x(0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F, 0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0), | | 73| 360| vec256_set4x(0xF0F00F0F0F0FF0F0, 0x0F0FF0F0F0F00F0F, 0x0F0FF0F0F0F00F0F, 0xF0F00F0F0F0FF0F0), | | 74| 360| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 75| 360| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 76| 360| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 77| 360| vec256_set4x(0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C), | | 78| 360| vec256_set4x(0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C), | | 79| 360|}, { | | 80| 360| vec256_set4x(0x9669699696696996, 0x9669699696696996, 0x9669699696696996, 0x9669699696696996), | | 81| 360| vec256_set4x(0x6996699669966996, 0x6996699669966996, 0x6996699669966996, 0x6996699669966996), | | 82| 360| vec256_set4x(0x9669966996699669, 0x9669966996699669, 0x9669966996699669, 0x9669966996699669), | | 83| 360| vec256_set4x(0xFF0000FFFF0000FF, 0xFF0000FFFF0000FF, 0x00FFFF0000FFFF00, 0x00FFFF0000FFFF00), | | 84| 360| vec256_set4x(0x00FF00FF00FF00FF, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0x00FF00FF00FF00FF), | | 85| 360| vec256_set4x(0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F, 0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0), | | 86| 360| vec256_set4x(0xF0F00F0F0F0FF0F0, 0x0F0FF0F0F0F00F0F, 0x0F0FF0F0F0F00F0F, 0xF0F00F0F0F0FF0F0), | | 87| 360| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 88| 360| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 89| 360| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 90| 360| vec256_set4x(0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C), | | 91| 360| vec256_set4x(0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C), | | 92| 360|}, { | | 93| 360| vec256_set4x(0x9669699696696996, 0x9669699696696996, 0x9669699696696996, 0x9669699696696996), | | 94| 360| vec256_set4x(0x9669966996699669, 0x9669966996699669, 0x9669966996699669, 0x9669966996699669), | | 95| 360| vec256_set4x(0x9669966996699669, 0x9669966996699669, 0x9669966996699669, 0x9669966996699669), | | 96| 360| vec256_set4x(0x00FFFF0000FFFF00, 0x00FFFF0000FFFF00, 0xFF0000FFFF0000FF, 0xFF0000FFFF0000FF), | | 97| 360| vec256_set4x(0xFF00FF00FF00FF00, 0x00FF00FF00FF00FF, 0x00FF00FF00FF00FF, 0xFF00FF00FF00FF00), | | 98| 360| vec256_set4x(0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F, 0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0), | | 99| 360| vec256_set4x(0xF0F00F0F0F0FF0F0, 0x0F0FF0F0F0F00F0F, 0x0F0FF0F0F0F00F0F, 0xF0F00F0F0F0FF0F0), | | 100| 360| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 101| 360| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 102| 360| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 103| 360| vec256_set4x(0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C), | | 104| 360| vec256_set4x(0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C), | | 105| 360|}, { | | 106| 360| vec256_set4x(0x9669699696696996, 0x9669699696696996, 0x9669699696696996, 0x9669699696696996), | | 107| 360| vec256_set4x(0x9669966996699669, 0x9669966996699669, 0x9669966996699669, 0x9669966996699669), | | 108| 360| vec256_set4x(0x6996699669966996, 0x6996699669966996, 0x6996699669966996, 0x6996699669966996), | | 109| 360| vec256_set4x(0xFF0000FFFF0000FF, 0xFF0000FFFF0000FF, 0x00FFFF0000FFFF00, 0x00FFFF0000FFFF00), | | 110| 360| vec256_set4x(0x00FF00FF00FF00FF, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0x00FF00FF00FF00FF), | | 111| 360| vec256_set4x(0xF00FF00F0FF00FF0, 0x0FF00FF0F00FF00F, 0x0FF00FF0F00FF00F, 0xF00FF00F0FF00FF0), | | 112| 360| vec256_set4x(0xF0F00F0F0F0FF0F0, 0x0F0FF0F0F0F00F0F, 0x0F0FF0F0F0F00F0F, 0xF0F00F0F0F0FF0F0), | | 113| 360| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 114| 360| vec256_set4x(0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3, 0xC33C3CC33CC3C33C, 0x3CC3C33CC33C3CC3), | | 115| 360| vec256_set4x(0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A, 0xA55A5AA55AA5A55A), | | 116| 360| vec256_set4x(0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C, 0xC33C3CC33CC3C33C), | | 117| 360| vec256_set4x(0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C, 0x3CC3C33C3CC3C33C), | | 118| 360|}, { | | 119| 360| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 120| 360| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 121| 360| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 122| 360| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 123| 360| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 124| 360| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 125| 360| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 126| 360| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 127| 360| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 128| 360| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 129| 360| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 130| 360| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 131| 360|}, { | | 132| 360| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 133| 360| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 134| 360| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 135| 360| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 136| 360| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 137| 360| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 138| 360| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 139| 360| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 140| 360| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 141| 360| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 142| 360| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 143| 360| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 144| 360|}, { | | 145| 360| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 146| 360| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 147| 360| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 148| 360| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 149| 360| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 150| 360| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 151| 360| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 152| 360| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 153| 360| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 154| 360| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 155| 360| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 156| 360| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 157| 360|}, { | | 158| 360| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 159| 360| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 160| 360| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 161| 360| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 162| 360| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 163| 360| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 164| 360| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 165| 360| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 166| 360| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 167| 360| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 168| 360| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 169| 360| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 170| 360|}, { | | 171| 360| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 172| 360| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 173| 360| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 174| 360| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 175| 360| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 176| 360| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 177| 360| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 178| 360| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 179| 360| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 180| 360| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 181| 360| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 182| 360| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 183| 360|}, { | | 184| 360| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 185| 360| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 186| 360| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 187| 360| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 188| 360| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 189| 360| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 190| 360| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 191| 360| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 192| 360| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 193| 360| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 194| 360| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 195| 360| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 196| 360|}, { | | 197| 360| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 198| 360| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 199| 360| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 200| 360| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 201| 360| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 202| 360| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 203| 360| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 204| 360| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 205| 360| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 206| 360| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 207| 360| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 208| 360| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 209| 360|}, { | | 210| 360| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0x0000000000000000, 0x0000000000000000), | | 211| 360| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 212| 360| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 213| 360| vec256_set4x(0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 214| 360| vec256_set4x(0x0000000000000000, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF), | | 215| 360| vec256_set4x(0x0000000000000000, 0xFFFFFFFFFFFFFFFF, 0x0000000000000000, 0xFFFFFFFFFFFFFFFF), | | 216| 360| vec256_set4x(0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000, 0xFFFFFFFF00000000), | | 217| 360| vec256_set4x(0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000, 0xFFFF0000FFFF0000), | | 218| 360| vec256_set4x(0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00, 0xFF00FF00FF00FF00), | | 219| 360| vec256_set4x(0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0, 0xF0F0F0F0F0F0F0F0), | | 220| 360| vec256_set4x(0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC, 0xCCCCCCCCCCCCCCCC), | | 221| 360| vec256_set4x(0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA, 0xAAAAAAAAAAAAAAAA), | | 222| 360|}, ------------------ 79| 360| }; 80| | 81| 360| uint64_t consts_ptr = 17; 82| | 83| 360| const unsigned char reversal[64] = { 84| 360| 0, 32, 16, 48, 8, 40, 24, 56, 85| 360| 4, 36, 20, 52, 12, 44, 28, 60, 86| 360| 2, 34, 18, 50, 10, 42, 26, 58, 87| 360| 6, 38, 22, 54, 14, 46, 30, 62, 88| 360| 1, 33, 17, 49, 9, 41, 25, 57, 89| 360| 5, 37, 21, 53, 13, 45, 29, 61, 90| 360| 3, 35, 19, 51, 11, 43, 27, 59, 91| 360| 7, 39, 23, 55, 15, 47, 31, 63 92| 360| }; 93| | 94| 360| const uint16_t beta[6] = {8, 1300, 3408, 1354, 2341, 1154}; 95| | 96| | // butterflies 97| | 98| 1.80k| for (i = 3; i >= 0; i--) { ------------------ | Branch (98:17): [True: 1.44k, False: 360] ------------------ 99| 1.44k| s = 1 << i; 100| 1.44k| consts_ptr -= s; 101| | 102| 6.84k| for (j = 0; j < 16; j += 2 * s) { ------------------ | Branch (102:21): [True: 5.40k, False: 1.44k] ------------------ 103| 16.9k| for (k = j; k < j + s; k++) { ------------------ | Branch (103:25): [True: 11.5k, False: 5.40k] ------------------ 104| 149k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 149k|#define GFBITS 12 ------------------ | Branch (104:29): [True: 138k, False: 11.5k] ------------------ 105| 138k| in[k][b] ^= in[k + s][b]; 106| 138k| } 107| 11.5k| vec256_mul(tmp256, in[k], consts[ consts_ptr + (k - j) ]); 108| 149k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 149k|#define GFBITS 12 ------------------ | Branch (108:29): [True: 138k, False: 11.5k] ------------------ 109| 138k| in[k + s][b] ^= tmp256[b]; 110| 138k| } 111| 11.5k| } 112| 5.40k| } 113| 1.44k| } 114| | 115| 3.24k| for (i = 0; i < 16; i += 2) { ------------------ | Branch (115:17): [True: 2.88k, False: 360] ------------------ 116| 37.4k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 37.4k|#define GFBITS 12 ------------------ | Branch (116:21): [True: 34.5k, False: 2.88k] ------------------ 117| 34.5k| x[b] = vec256_unpack_low(in[i + 0][b], in[i + 1][b]); 118| 34.5k| } 119| 37.4k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 37.4k|#define GFBITS 12 ------------------ | Branch (119:21): [True: 34.5k, False: 2.88k] ------------------ 120| 34.5k| y[b] = vec256_unpack_high(in[i + 0][b], in[i + 1][b]); 121| 34.5k| } 122| | 123| 37.4k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 37.4k|#define GFBITS 12 ------------------ | Branch (123:21): [True: 34.5k, False: 2.88k] ------------------ 124| 34.5k| x[b] ^= y[b]; 125| 34.5k| } 126| 2.88k| vec256_mul(tmp256, x, consts[ 1 ]); 127| 37.4k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 37.4k|#define GFBITS 12 ------------------ | Branch (127:21): [True: 34.5k, False: 2.88k] ------------------ 128| 34.5k| y[b] ^= tmp256[b]; 129| 34.5k| } 130| | 131| 37.4k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 37.4k|#define GFBITS 12 ------------------ | Branch (131:21): [True: 34.5k, False: 2.88k] ------------------ 132| 34.5k| in[i + 0][b] = vec256_unpack_low_2x(x[b], y[b]); 133| 34.5k| } 134| 37.4k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 37.4k|#define GFBITS 12 ------------------ | Branch (134:21): [True: 34.5k, False: 2.88k] ------------------ 135| 34.5k| in[i + 1][b] = vec256_unpack_high_2x(x[b], y[b]); 136| 34.5k| } 137| 2.88k| } 138| | 139| 3.24k| for (i = 0; i < 16; i += 2) { ------------------ | Branch (139:17): [True: 2.88k, False: 360] ------------------ 140| 37.4k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 37.4k|#define GFBITS 12 ------------------ | Branch (140:21): [True: 34.5k, False: 2.88k] ------------------ 141| 34.5k| in[i + 0][b] ^= in[i + 1][b]; 142| 34.5k| } 143| 2.88k| vec256_mul(tmp256, in[i + 0], consts[ 0 ]); 144| 37.4k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 37.4k|#define GFBITS 12 ------------------ | Branch (144:21): [True: 34.5k, False: 2.88k] ------------------ 145| 34.5k| in[i + 1][b] ^= tmp256[b]; 146| 34.5k| } 147| 2.88k| } 148| | 149| | // transpose 150| | 151| 1.44k| for (i = 0; i < GFBITS; i += 4) { ------------------ | | 6| 1.44k|#define GFBITS 12 ------------------ | Branch (151:17): [True: 1.08k, False: 360] ------------------ 152| 9.72k| for (j = 0; j < 64; j += 8) { ------------------ | Branch (152:21): [True: 8.64k, False: 1.08k] ------------------ 153| 8.64k| buf[ reversal[j + 0] ] = vec256_set4x(vec256_extract(in[j / 4 + 0][i + 0], 0), ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 154| 8.64k| vec256_extract(in[j / 4 + 0][i + 1], 0), ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 155| 8.64k| vec256_extract(in[j / 4 + 0][i + 2], 0), ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 156| 8.64k| vec256_extract(in[j / 4 + 0][i + 3], 0)); ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 157| 8.64k| buf[ reversal[j + 1] ] = vec256_set4x(vec256_extract(in[j / 4 + 1][i + 0], 0), ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 158| 8.64k| vec256_extract(in[j / 4 + 1][i + 1], 0), ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 159| 8.64k| vec256_extract(in[j / 4 + 1][i + 2], 0), ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 160| 8.64k| vec256_extract(in[j / 4 + 1][i + 3], 0)); ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 161| 8.64k| buf[ reversal[j + 2] ] = vec256_set4x(vec256_extract(in[j / 4 + 0][i + 0], 1), ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 162| 8.64k| vec256_extract(in[j / 4 + 0][i + 1], 1), ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 163| 8.64k| vec256_extract(in[j / 4 + 0][i + 2], 1), ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 164| 8.64k| vec256_extract(in[j / 4 + 0][i + 3], 1)); ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 165| 8.64k| buf[ reversal[j + 3] ] = vec256_set4x(vec256_extract(in[j / 4 + 1][i + 0], 1), ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 166| 8.64k| vec256_extract(in[j / 4 + 1][i + 1], 1), ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 167| 8.64k| vec256_extract(in[j / 4 + 1][i + 2], 1), ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 168| 8.64k| vec256_extract(in[j / 4 + 1][i + 3], 1)); ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 169| 8.64k| buf[ reversal[j + 4] ] = vec256_set4x(vec256_extract(in[j / 4 + 0][i + 0], 2), ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 170| 8.64k| vec256_extract(in[j / 4 + 0][i + 1], 2), ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 171| 8.64k| vec256_extract(in[j / 4 + 0][i + 2], 2), ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 172| 8.64k| vec256_extract(in[j / 4 + 0][i + 3], 2)); ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 173| 8.64k| buf[ reversal[j + 5] ] = vec256_set4x(vec256_extract(in[j / 4 + 1][i + 0], 2), ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 174| 8.64k| vec256_extract(in[j / 4 + 1][i + 1], 2), ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 175| 8.64k| vec256_extract(in[j / 4 + 1][i + 2], 2), ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 176| 8.64k| vec256_extract(in[j / 4 + 1][i + 3], 2)); ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 177| 8.64k| buf[ reversal[j + 6] ] = vec256_set4x(vec256_extract(in[j / 4 + 0][i + 0], 3), ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 178| 8.64k| vec256_extract(in[j / 4 + 0][i + 1], 3), ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 179| 8.64k| vec256_extract(in[j / 4 + 0][i + 2], 3), ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 180| 8.64k| vec256_extract(in[j / 4 + 0][i + 3], 3)); ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 181| 8.64k| buf[ reversal[j + 7] ] = vec256_set4x(vec256_extract(in[j / 4 + 1][i + 0], 3), ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 182| 8.64k| vec256_extract(in[j / 4 + 1][i + 1], 3), ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 183| 8.64k| vec256_extract(in[j / 4 + 1][i + 2], 3), ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 184| 8.64k| vec256_extract(in[j / 4 + 1][i + 3], 3)); ------------------ | | 39| 8.64k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 185| 8.64k| } 186| | 187| 1.08k| transpose_64x256_sp(buf); 188| | 189| 1.08k| p2[0] = buf[32]; 190| 1.08k| buf[33] = vec256_xor(buf[33], buf[32]); 191| 1.08k| p2[1] = buf[33]; 192| 1.08k| buf[35] = vec256_xor(buf[35], buf[33]); 193| 1.08k| p2[0] = vec256_xor(p2[0], buf[35]); 194| 1.08k| buf[34] = vec256_xor(buf[34], buf[35]); 195| 1.08k| p2[2] = buf[34]; 196| 1.08k| buf[38] = vec256_xor(buf[38], buf[34]); 197| 1.08k| p2[0] = vec256_xor(p2[0], buf[38]); 198| 1.08k| buf[39] = vec256_xor(buf[39], buf[38]); 199| 1.08k| p2[1] = vec256_xor(p2[1], buf[39]); 200| 1.08k| buf[37] = vec256_xor(buf[37], buf[39]); 201| 1.08k| p2[0] = vec256_xor(p2[0], buf[37]); 202| 1.08k| buf[36] = vec256_xor(buf[36], buf[37]); 203| 1.08k| p2[3] = buf[36]; 204| 1.08k| buf[44] = vec256_xor(buf[44], buf[36]); 205| 1.08k| p2[0] = vec256_xor(p2[0], buf[44]); 206| 1.08k| buf[45] = vec256_xor(buf[45], buf[44]); 207| 1.08k| p2[1] = vec256_xor(p2[1], buf[45]); 208| 1.08k| buf[47] = vec256_xor(buf[47], buf[45]); 209| 1.08k| p2[0] = vec256_xor(p2[0], buf[47]); 210| 1.08k| buf[46] = vec256_xor(buf[46], buf[47]); 211| 1.08k| p2[2] = vec256_xor(p2[2], buf[46]); 212| 1.08k| buf[42] = vec256_xor(buf[42], buf[46]); 213| 1.08k| p2[0] = vec256_xor(p2[0], buf[42]); 214| 1.08k| buf[43] = vec256_xor(buf[43], buf[42]); 215| 1.08k| p2[1] = vec256_xor(p2[1], buf[43]); 216| 1.08k| buf[41] = vec256_xor(buf[41], buf[43]); 217| 1.08k| p2[0] = vec256_xor(p2[0], buf[41]); 218| 1.08k| buf[40] = vec256_xor(buf[40], buf[41]); 219| 1.08k| p2[4] = buf[40]; 220| 1.08k| buf[56] = vec256_xor(buf[56], buf[40]); 221| 1.08k| p2[0] = vec256_xor(p2[0], buf[56]); 222| 1.08k| buf[57] = vec256_xor(buf[57], buf[56]); 223| 1.08k| p2[1] = vec256_xor(p2[1], buf[57]); 224| 1.08k| buf[59] = vec256_xor(buf[59], buf[57]); 225| 1.08k| p2[0] = vec256_xor(p2[0], buf[59]); 226| 1.08k| buf[58] = vec256_xor(buf[58], buf[59]); 227| 1.08k| p2[2] = vec256_xor(p2[2], buf[58]); 228| 1.08k| buf[62] = vec256_xor(buf[62], buf[58]); 229| 1.08k| p2[0] = vec256_xor(p2[0], buf[62]); 230| 1.08k| buf[63] = vec256_xor(buf[63], buf[62]); 231| 1.08k| p2[1] = vec256_xor(p2[1], buf[63]); 232| 1.08k| buf[61] = vec256_xor(buf[61], buf[63]); 233| 1.08k| p2[0] = vec256_xor(p2[0], buf[61]); 234| 1.08k| buf[60] = vec256_xor(buf[60], buf[61]); 235| 1.08k| p2[3] = vec256_xor(p2[3], buf[60]); 236| 1.08k| buf[52] = vec256_xor(buf[52], buf[60]); 237| 1.08k| p2[0] = vec256_xor(p2[0], buf[52]); 238| 1.08k| buf[53] = vec256_xor(buf[53], buf[52]); 239| 1.08k| p2[1] = vec256_xor(p2[1], buf[53]); 240| 1.08k| buf[55] = vec256_xor(buf[55], buf[53]); 241| 1.08k| p2[0] = vec256_xor(p2[0], buf[55]); 242| 1.08k| buf[54] = vec256_xor(buf[54], buf[55]); 243| 1.08k| p2[2] = vec256_xor(p2[2], buf[54]); 244| 1.08k| buf[50] = vec256_xor(buf[50], buf[54]); 245| 1.08k| p2[0] = vec256_xor(p2[0], buf[50]); 246| 1.08k| buf[51] = vec256_xor(buf[51], buf[50]); 247| 1.08k| p2[1] = vec256_xor(p2[1], buf[51]); 248| 1.08k| buf[49] = vec256_xor(buf[49], buf[51]); 249| 1.08k| p2[0] = vec256_xor(p2[0], buf[49]); 250| 1.08k| buf[48] = vec256_xor(buf[48], buf[49]); 251| 1.08k| p2[5] = buf[48]; 252| 1.08k| buf[16] = vec256_xor(buf[16], buf[48]); 253| 1.08k| p2[0] = vec256_xor(p2[0], buf[16]); 254| 1.08k| buf[17] = vec256_xor(buf[17], buf[16]); 255| 1.08k| p2[1] = vec256_xor(p2[1], buf[17]); 256| 1.08k| buf[19] = vec256_xor(buf[19], buf[17]); 257| 1.08k| p2[0] = vec256_xor(p2[0], buf[19]); 258| 1.08k| buf[18] = vec256_xor(buf[18], buf[19]); 259| 1.08k| p2[2] = vec256_xor(p2[2], buf[18]); 260| 1.08k| buf[22] = vec256_xor(buf[22], buf[18]); 261| 1.08k| p2[0] = vec256_xor(p2[0], buf[22]); 262| 1.08k| buf[23] = vec256_xor(buf[23], buf[22]); 263| 1.08k| p2[1] = vec256_xor(p2[1], buf[23]); 264| 1.08k| buf[21] = vec256_xor(buf[21], buf[23]); 265| 1.08k| p2[0] = vec256_xor(p2[0], buf[21]); 266| 1.08k| buf[20] = vec256_xor(buf[20], buf[21]); 267| 1.08k| p2[3] = vec256_xor(p2[3], buf[20]); 268| 1.08k| buf[28] = vec256_xor(buf[28], buf[20]); 269| 1.08k| p2[0] = vec256_xor(p2[0], buf[28]); 270| 1.08k| buf[29] = vec256_xor(buf[29], buf[28]); 271| 1.08k| p2[1] = vec256_xor(p2[1], buf[29]); 272| 1.08k| buf[31] = vec256_xor(buf[31], buf[29]); 273| 1.08k| p2[0] = vec256_xor(p2[0], buf[31]); 274| 1.08k| buf[30] = vec256_xor(buf[30], buf[31]); 275| 1.08k| p2[2] = vec256_xor(p2[2], buf[30]); 276| 1.08k| buf[26] = vec256_xor(buf[26], buf[30]); 277| 1.08k| p2[0] = vec256_xor(p2[0], buf[26]); 278| 1.08k| buf[27] = vec256_xor(buf[27], buf[26]); 279| 1.08k| p2[1] = vec256_xor(p2[1], buf[27]); 280| 1.08k| buf[25] = vec256_xor(buf[25], buf[27]); 281| 1.08k| p2[0] = vec256_xor(p2[0], buf[25]); 282| 1.08k| buf[24] = vec256_xor(buf[24], buf[25]); 283| 1.08k| p2[4] = vec256_xor(p2[4], buf[24]); 284| 1.08k| buf[8] = vec256_xor(buf[8], buf[24]); 285| 1.08k| p2[0] = vec256_xor(p2[0], buf[8]); 286| 1.08k| buf[9] = vec256_xor(buf[9], buf[8]); 287| 1.08k| p2[1] = vec256_xor(p2[1], buf[9]); 288| 1.08k| buf[11] = vec256_xor(buf[11], buf[9]); 289| 1.08k| p2[0] = vec256_xor(p2[0], buf[11]); 290| 1.08k| buf[10] = vec256_xor(buf[10], buf[11]); 291| 1.08k| p2[2] = vec256_xor(p2[2], buf[10]); 292| 1.08k| buf[14] = vec256_xor(buf[14], buf[10]); 293| 1.08k| p2[0] = vec256_xor(p2[0], buf[14]); 294| 1.08k| buf[15] = vec256_xor(buf[15], buf[14]); 295| 1.08k| p2[1] = vec256_xor(p2[1], buf[15]); 296| 1.08k| buf[13] = vec256_xor(buf[13], buf[15]); 297| 1.08k| p2[0] = vec256_xor(p2[0], buf[13]); 298| 1.08k| buf[12] = vec256_xor(buf[12], buf[13]); 299| 1.08k| p2[3] = vec256_xor(p2[3], buf[12]); 300| 1.08k| buf[4] = vec256_xor(buf[4], buf[12]); 301| 1.08k| p2[0] = vec256_xor(p2[0], buf[4]); 302| 1.08k| buf[5] = vec256_xor(buf[5], buf[4]); 303| 1.08k| p2[1] = vec256_xor(p2[1], buf[5]); 304| 1.08k| buf[7] = vec256_xor(buf[7], buf[5]); 305| 1.08k| p2[0] = vec256_xor(p2[0], buf[7]); 306| 1.08k| buf[6] = vec256_xor(buf[6], buf[7]); 307| 1.08k| p2[2] = vec256_xor(p2[2], buf[6]); 308| 1.08k| buf[2] = vec256_xor(buf[2], buf[6]); 309| 1.08k| p2[0] = vec256_xor(p2[0], buf[2]); 310| 1.08k| buf[3] = vec256_xor(buf[3], buf[2]); 311| 1.08k| p2[1] = vec256_xor(p2[1], buf[3]); 312| 1.08k| buf[1] = vec256_xor(buf[1], buf[3]); 313| | 314| 1.08k| p2[0] = vec256_xor(p2[0], buf[1]); 315| 1.08k| buf[0] = vec256_xor(buf[0], buf[1]); 316| | 317| 7.56k| for (j = 0; j < 6; j++) { ------------------ | Branch (317:21): [True: 6.48k, False: 1.08k] ------------------ 318| 6.48k| pre[j][i + 0] = vec256_extract(p2[j], 0); ------------------ | | 39| 6.48k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 319| 6.48k| pre[j][i + 1] = vec256_extract(p2[j], 1); ------------------ | | 39| 6.48k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 320| 6.48k| pre[j][i + 2] = vec256_extract(p2[j], 2); ------------------ | | 39| 6.48k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 321| 6.48k| pre[j][i + 3] = vec256_extract(p2[j], 3); ------------------ | | 39| 6.48k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 322| 6.48k| } 323| | 324| 1.08k| out64[0][i + 0] = vec256_extract(buf[0], 0); ------------------ | | 39| 1.08k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 325| 1.08k| out64[0][i + 1] = vec256_extract(buf[0], 1); ------------------ | | 39| 1.08k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 326| 1.08k| out64[0][i + 2] = vec256_extract(buf[0], 2); ------------------ | | 39| 1.08k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 327| 1.08k| out64[0][i + 3] = vec256_extract(buf[0], 3); ------------------ | | 39| 1.08k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 328| 1.08k| } 329| | 330| | // 331| | 332| 4.68k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 4.68k|#define GFBITS 12 ------------------ | Branch (332:17): [True: 4.32k, False: 360] ------------------ 333| 4.32k| tmp[j] = (beta[0] >> j) & 1; 334| 4.32k| tmp[j] = -tmp[j]; 335| 4.32k| } 336| | 337| 360| vec_mul(out64[1], pre[0], tmp); 338| | 339| 2.16k| for (i = 1; i < 6; i++) { ------------------ | Branch (339:17): [True: 1.80k, False: 360] ------------------ 340| 23.4k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 23.4k|#define GFBITS 12 ------------------ | Branch (340:21): [True: 21.6k, False: 1.80k] ------------------ 341| 21.6k| tmp[j] = (beta[i] >> j) & 1; 342| 21.6k| tmp[j] = -tmp[j]; 343| 21.6k| } 344| | 345| 1.80k| vec_mul(tmp, pre[i], tmp); 346| 1.80k| vec_add(out64[1], out64[1], tmp); 347| 1.80k| } 348| | 349| 4.68k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 4.68k|#define GFBITS 12 ------------------ | Branch (349:17): [True: 4.32k, False: 360] ------------------ 350| 4.32k| out[i] = vec128_set2x(out64[0][i], out64[1][i]); 351| 4.32k| } 352| 360|} fft_tr.c:radix_conversions_tr: 16| 360|static void radix_conversions_tr(vec128 in[ GFBITS ]) { 17| 360| int i, j, k; 18| | 19| 360| const vec128 mask[10] = { 20| 360| vec128_set2x(0x2222222222222222, 0x2222222222222222), 21| 360| vec128_set2x(0x4444444444444444, 0x4444444444444444), 22| 360| vec128_set2x(0x0C0C0C0C0C0C0C0C, 0x0C0C0C0C0C0C0C0C), 23| 360| vec128_set2x(0x3030303030303030, 0x3030303030303030), 24| 360| vec128_set2x(0x00F000F000F000F0, 0x00F000F000F000F0), 25| 360| vec128_set2x(0x0F000F000F000F00, 0x0F000F000F000F00), 26| 360| vec128_set2x(0x0000FF000000FF00, 0x0000FF000000FF00), 27| 360| vec128_set2x(0x00FF000000FF0000, 0x00FF000000FF0000), 28| 360| vec128_set2x(0x00000000FFFF0000, 0x00000000FFFF0000), 29| 360| vec128_set2x(0x0000FFFF00000000, 0x0000FFFF00000000) 30| 360| }; 31| | 32| 360| const vec128 s[5][GFBITS] = { 33| 360|#include "scalars_2x.data" ------------------ | | 1| 360|{ | | 2| 360| vec128_set2x(0xf3cfc030fc30f003, 0x000c03c0c3c0330c), | | 3| 360| vec128_set2x(0x3fcf0f003c00c00c, 0xf330cffcc00f33c0), | | 4| 360| vec128_set2x(0x30033cc300c0c03c, 0xccf330f00f3c0333), | | 5| 360| vec128_set2x(0xccff0f3c0f30f0c0, 0xff03fff3ff0cf0c0), | | 6| 360| vec128_set2x(0x0300c03ff303c3f0, 0x3cc3fcf00fcc303c), | | 7| 360| vec128_set2x(0x3fff3c0ff0ccccc0, 0x0f000c0fc30303f3), | | 8| 360| vec128_set2x(0xf3fff0c00f3c3cc0, 0xcf0fc3ff333ccf3c), | | 9| 360| vec128_set2x(0x3003333fffc3c000, 0x003f3fc3c0ff333f), | | 10| 360| vec128_set2x(0x0ff30fffc3fff300, 0x3cc3f0f3cf0ff00f), | | 11| 360| vec128_set2x(0xffc0f300f0f0cc00, 0xf3f33cc03fc30cc0), | | 12| 360| vec128_set2x(0xc0cff3fccc3cfc00, 0x3cc330cfc333f33f), | | 13| 360| vec128_set2x(0xfc3c03f0f330c000, 0x3cc0303ff3c3fffc), | | 14| 360|}, { | | 15| 360| vec128_set2x(0x000f00000000f00f, 0x0f00f00f00000000), | | 16| 360| vec128_set2x(0x00000f00f00000f0, 0xf00000000000f000), | | 17| 360| vec128_set2x(0x0f00000f00000f00, 0x00000f00000000f0), | | 18| 360| vec128_set2x(0xf00f00f00f000000, 0x0f00f00000f00000), | | 19| 360| vec128_set2x(0x00f00000000000f0, 0x000f00000f00f00f), | | 20| 360| vec128_set2x(0x0000000f00000000, 0x00f00f00f00f0000), | | 21| 360| vec128_set2x(0xf00000000f00f000, 0x0f00f00000000000), | | 22| 360| vec128_set2x(0x00f00f00000f0000, 0x000000000f000000), | | 23| 360| vec128_set2x(0x0000f00000f00f00, 0x00f00000000f00f0), | | 24| 360| vec128_set2x(0x000f00f00f00f000, 0x0000f00f00000f00), | | 25| 360| vec128_set2x(0x00f00f0000000000, 0xf00000f00000f00f), | | 26| 360| vec128_set2x(0x0000000000f00000, 0x00000f00f00f00f0), | | 27| 360|}, { | | 28| 360| vec128_set2x(0x0000ff00ff0000ff, 0xff00ffffff000000), | | 29| 360| vec128_set2x(0x0000ff000000ff00, 0xff0000ffff000000), | | 30| 360| vec128_set2x(0xff0000ff00ff0000, 0xffff00ffff000000), | | 31| 360| vec128_set2x(0xffff0000ff000000, 0xff00ffffffffff00), | | 32| 360| vec128_set2x(0x00ff00ff00ff0000, 0x00000000ff00ff00), | | 33| 360| vec128_set2x(0x0000ffffff000000, 0xffffffff00ff0000), | | 34| 360| vec128_set2x(0x00ffff00ff000000, 0x00ffffff00ff0000), | | 35| 360| vec128_set2x(0xffffff0000ff0000, 0xffff00ffff00ffff), | | 36| 360| vec128_set2x(0xffff00ffff00ff00, 0xffff0000ffffffff), | | 37| 360| vec128_set2x(0x0000ff0000000000, 0xff00000000ff0000), | | 38| 360| vec128_set2x(0xffffff00ff000000, 0x000000ff00ff00ff), | | 39| 360| vec128_set2x(0x00ff000000000000, 0x00ff00ff00ffff00), | | 40| 360|}, { | | 41| 360| vec128_set2x(0x000000000000ffff, 0x0000000000000000), | | 42| 360| vec128_set2x(0x00000000ffff0000, 0xffff000000000000), | | 43| 360| vec128_set2x(0x0000000000000000, 0x0000000000000000), | | 44| 360| vec128_set2x(0xffff000000000000, 0x0000000000000000), | | 45| 360| vec128_set2x(0x00000000ffff0000, 0xffff00000000ffff), | | 46| 360| vec128_set2x(0x0000ffff00000000, 0x0000000000000000), | | 47| 360| vec128_set2x(0x0000000000000000, 0x0000ffff00000000), | | 48| 360| vec128_set2x(0x00000000ffff0000, 0xffff00000000ffff), | | 49| 360| vec128_set2x(0x0000ffff00000000, 0x00000000ffff0000), | | 50| 360| vec128_set2x(0x0000000000000000, 0x0000000000000000), | | 51| 360| vec128_set2x(0x0000000000000000, 0xffff00000000ffff), | | 52| 360| vec128_set2x(0x0000000000000000, 0x00000000ffff0000), | | 53| 360|}, { | | 54| 360| vec128_set2x(0x00000000ffffffff, 0x0000000000000000), | | 55| 360| vec128_set2x(0xffffffff00000000, 0x0000000000000000), | | 56| 360| vec128_set2x(0xffffffff00000000, 0x00000000ffffffff), | | 57| 360| vec128_set2x(0x0000000000000000, 0xffffffff00000000), | | 58| 360| vec128_set2x(0x0000000000000000, 0xffffffff00000000), | | 59| 360| vec128_set2x(0xffffffff00000000, 0x0000000000000000), | | 60| 360| vec128_set2x(0x0000000000000000, 0xffffffff00000000), | | 61| 360| vec128_set2x(0x0000000000000000, 0xffffffffffffffff), | | 62| 360| vec128_set2x(0xffffffff00000000, 0xffffffff00000000), | | 63| 360| vec128_set2x(0x0000000000000000, 0x0000000000000000), | | 64| 360| vec128_set2x(0x0000000000000000, 0xffffffffffffffff), | | 65| 360| vec128_set2x(0x0000000000000000, 0xffffffff00000000), | | 66| 360|}, ------------------ 34| 360| }; 35| | 36| 360| uint64_t v0, v1; 37| | 38| | // 39| | 40| 2.52k| for (j = 5; j >= 0; j--) { ------------------ | Branch (40:17): [True: 2.16k, False: 360] ------------------ 41| | 42| 2.16k| if (j < 5) { ------------------ | Branch (42:13): [True: 1.80k, False: 360] ------------------ 43| 1.80k| vec128_mul(in, in, s[j]); 44| 1.80k| } 45| | 46| 28.0k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 28.0k|#define GFBITS 12 ------------------ | Branch (46:21): [True: 25.9k, False: 2.16k] ------------------ 47| 90.7k| for (k = j; k <= 4; k++) { ------------------ | Branch (47:25): [True: 64.8k, False: 25.9k] ------------------ 48| 64.8k| in[i] ^= vec128_sll_2x(in[i] & mask[2 * k + 0], 1 << k); ------------------ | | 46| 64.8k|#define vec128_sll_2x(a, s) ((vec128) _mm_slli_epi64((vec128) (a), (s))) ------------------ 49| 64.8k| in[i] ^= vec128_sll_2x(in[i] & mask[2 * k + 1], 1 << k); ------------------ | | 46| 64.8k|#define vec128_sll_2x(a, s) ((vec128) _mm_slli_epi64((vec128) (a), (s))) ------------------ 50| 64.8k| } 51| 25.9k| } 52| | 53| 28.0k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 28.0k|#define GFBITS 12 ------------------ | Branch (53:21): [True: 25.9k, False: 2.16k] ------------------ 54| 25.9k| v0 = vec128_extract(in[i], 0); ------------------ | | 28| 25.9k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 55| 25.9k| v1 = vec128_extract(in[i], 1); ------------------ | | 28| 25.9k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 56| | 57| 25.9k| v1 ^= v0 >> 32; 58| 25.9k| v1 ^= v1 << 32; 59| | 60| 25.9k| in[i] = vec128_set2x(v0, v1); 61| 25.9k| } 62| 2.16k| } 63| 360|} PQCLEAN_MCELIECE348864_AVX2_gf_mul: 22| 4.59M|gf gf_mul(gf in0, gf in1) { 23| 4.59M| int i; 24| | 25| 4.59M| uint32_t tmp; 26| 4.59M| uint32_t t0; 27| 4.59M| uint32_t t1; 28| 4.59M| uint32_t t; 29| | 30| 4.59M| t0 = in0; 31| 4.59M| t1 = in1; 32| | 33| 4.59M| tmp = t0 * (t1 & 1); 34| | 35| 55.1M| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 55.1M|#define GFBITS 12 ------------------ | Branch (35:17): [True: 50.5M, False: 4.59M] ------------------ 36| 50.5M| tmp ^= (t0 * (t1 & (1 << i))); 37| 50.5M| } 38| | 39| 4.59M| t = tmp & 0x7FC000; 40| 4.59M| tmp ^= t >> 9; 41| 4.59M| tmp ^= t >> 12; 42| | 43| 4.59M| t = tmp & 0x3000; 44| 4.59M| tmp ^= t >> 9; 45| 4.59M| tmp ^= t >> 12; 46| | 47| 4.59M| return tmp & ((1 << GFBITS) - 1); ------------------ | | 6| 4.59M|#define GFBITS 12 ------------------ 48| 4.59M|} PQCLEAN_MCELIECE348864_AVX2_gf_inv: 74| 66.6k|gf gf_inv(gf in) { 75| 66.6k| gf tmp_11; 76| 66.6k| gf tmp_1111; 77| | 78| 66.6k| gf out = in; 79| | 80| 66.6k| out = gf_sq(out); 81| 66.6k| tmp_11 = gf_mul(out, in); // 11 ------------------ | | 14| 66.6k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 66.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 82| | 83| 66.6k| out = gf_sq(tmp_11); 84| 66.6k| out = gf_sq(out); 85| 66.6k| tmp_1111 = gf_mul(out, tmp_11); // 1111 ------------------ | | 14| 66.6k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 66.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 86| | 87| 66.6k| out = gf_sq(tmp_1111); 88| 66.6k| out = gf_sq(out); 89| 66.6k| out = gf_sq(out); 90| 66.6k| out = gf_sq(out); 91| 66.6k| out = gf_mul(out, tmp_1111); // 11111111 ------------------ | | 14| 66.6k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 66.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 92| | 93| 66.6k| out = gf_sq(out); 94| 66.6k| out = gf_sq(out); 95| 66.6k| out = gf_mul(out, tmp_11); // 1111111111 ------------------ | | 14| 66.6k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 66.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 96| | 97| 66.6k| out = gf_sq(out); 98| 66.6k| out = gf_mul(out, in); // 11111111111 ------------------ | | 14| 66.6k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 66.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 99| | 100| 66.6k| return gf_sq(out); // 111111111110 101| 66.6k|} bm.c:PQCLEAN_MCELIECE348864_AVX2_gf_mul2: 32| 13.0k|static inline uint64_t gf_mul2(gf a, gf b0, gf b1) { 33| 13.0k| int i; 34| | 35| 13.0k| uint64_t tmp = 0; 36| 13.0k| uint64_t t0; 37| 13.0k| uint64_t t1; 38| 13.0k| uint64_t t; 39| 13.0k| uint64_t mask = 0x0000000100000001; 40| | 41| 13.0k| t0 = a; 42| 13.0k| t1 = b1; 43| 13.0k| t1 = (t1 << 32) | b0; 44| | 45| 169k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 169k|#define GFBITS 12 ------------------ | Branch (45:17): [True: 156k, False: 13.0k] ------------------ 46| 156k| tmp ^= t0 * (t1 & mask); 47| 156k| mask += mask; 48| 156k| } 49| | 50| | // 51| | 52| 13.0k| t = tmp & 0x007FC000007FC000; 53| 13.0k| tmp ^= (t >> 9) ^ (t >> 12); 54| | 55| 13.0k| t = tmp & 0x0000300000003000; 56| 13.0k| tmp ^= (t >> 9) ^ (t >> 12); 57| | 58| 13.0k| return tmp & 0x00000FFF00000FFF; 59| 13.0k|} pk_gen.c:PQCLEAN_MCELIECE348864_AVX2_int32_sort: 21| 102|static void int32_sort(int32_t *x, long long n) { 22| 102| long long top, p, q, r, i; 23| | 24| 102| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 102] ------------------ 25| 0| return; 26| 0| } 27| 102| top = 1; 28| 1.02k| while (top < n - top) { ------------------ | Branch (28:12): [True: 918, False: 102] ------------------ 29| 918| top += top; 30| 918| } 31| | 32| 1.12k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 1.02k, False: 102] ------------------ 33| 680k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 679k, False: 1.02k] ------------------ 34| 679k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 365k, False: 313k] ------------------ 35| 365k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 365k| do { \ | | 12| 365k| int32_t ab = (b) ^ (a); \ | | 13| 365k| int32_t c = (b) - (a); \ | | 14| 365k| c ^= ab & ((c) ^ (b)); \ | | 15| 365k| c >>= 31; \ | | 16| 365k| c &= ab; \ | | 17| 365k| (a) ^= c; \ | | 18| 365k| (b) ^= c; \ | | 19| 365k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 365k] | | ------------------ ------------------ 36| 365k| } 37| 679k| } 38| 1.02k| i = 0; 39| 5.61k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 4.59k, False: 1.02k] ------------------ 40| 605k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 600k, False: 4.59k] ------------------ 41| 600k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 313k, False: 287k] ------------------ 42| 313k| int32_t a = x[i + p]; 43| 1.67M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 1.35M, False: 313k] ------------------ 44| 1.35M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 1.35M| do { \ | | 12| 1.35M| int32_t ab = (b) ^ (a); \ | | 13| 1.35M| int32_t c = (b) - (a); \ | | 14| 1.35M| c ^= ab & ((c) ^ (b)); \ | | 15| 1.35M| c >>= 31; \ | | 16| 1.35M| c &= ab; \ | | 17| 1.35M| (a) ^= c; \ | | 18| 1.35M| (b) ^= c; \ | | 19| 1.35M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.35M] | | ------------------ ------------------ 45| 1.35M| } 46| 313k| x[i + p] = a; 47| 313k| } 48| 600k| } 49| 4.59k| } 50| 1.02k| } 51| 102|} controlbits.c:PQCLEAN_MCELIECE348864_AVX2_int32_sort: 21| 1.67M|static void int32_sort(int32_t *x, long long n) { 22| 1.67M| long long top, p, q, r, i; 23| | 24| 1.67M| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 1.67M] ------------------ 25| 0| return; 26| 0| } 27| 1.67M| top = 1; 28| 5.83M| while (top < n - top) { ------------------ | Branch (28:12): [True: 4.16M, False: 1.67M] ------------------ 29| 4.16M| top += top; 30| 4.16M| } 31| | 32| 7.50M| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 5.83M, False: 1.67M] ------------------ 33| 615M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 609M, False: 5.83M] ------------------ 34| 609M| if (!(i & p)) { ------------------ | Branch (34:17): [True: 344M, False: 265M] ------------------ 35| 344M| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 344M| do { \ | | 12| 344M| int32_t ab = (b) ^ (a); \ | | 13| 344M| int32_t c = (b) - (a); \ | | 14| 344M| c ^= ab & ((c) ^ (b)); \ | | 15| 344M| c >>= 31; \ | | 16| 344M| c &= ab; \ | | 17| 344M| (a) ^= c; \ | | 18| 344M| (b) ^= c; \ | | 19| 344M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 344M] | | ------------------ ------------------ 36| 344M| } 37| 609M| } 38| 5.83M| i = 0; 39| 15.7M| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 9.88M, False: 5.83M] ------------------ 40| 540M| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 530M, False: 9.88M] ------------------ 41| 530M| if (!(i & p)) { ------------------ | Branch (41:21): [True: 265M, False: 265M] ------------------ 42| 265M| int32_t a = x[i + p]; 43| 1.47G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 1.20G, False: 265M] ------------------ 44| 1.20G| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 1.20G| do { \ | | 12| 1.20G| int32_t ab = (b) ^ (a); \ | | 13| 1.20G| int32_t c = (b) - (a); \ | | 14| 1.20G| c ^= ab & ((c) ^ (b)); \ | | 15| 1.20G| c >>= 31; \ | | 16| 1.20G| c &= ab; \ | | 17| 1.20G| (a) ^= c; \ | | 18| 1.20G| (b) ^= c; \ | | 19| 1.20G| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.20G] | | ------------------ ------------------ 45| 1.20G| } 46| 265M| x[i + p] = a; 47| 265M| } 48| 530M| } 49| 9.88M| } 50| 5.83M| } 51| 1.67M|} encrypt.c:PQCLEAN_MCELIECE348864_AVX2_int32_sort: 21| 319|static void int32_sort(int32_t *x, long long n) { 22| 319| long long top, p, q, r, i; 23| | 24| 319| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 319] ------------------ 25| 0| return; 26| 0| } 27| 319| top = 1; 28| 1.91k| while (top < n - top) { ------------------ | Branch (28:12): [True: 1.59k, False: 319] ------------------ 29| 1.59k| top += top; 30| 1.59k| } 31| | 32| 2.23k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 1.91k, False: 319] ------------------ 33| 104k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 102k, False: 1.91k] ------------------ 34| 102k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 61.2k, False: 41.1k] ------------------ 35| 61.2k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 61.2k| do { \ | | 12| 61.2k| int32_t ab = (b) ^ (a); \ | | 13| 61.2k| int32_t c = (b) - (a); \ | | 14| 61.2k| c ^= ab & ((c) ^ (b)); \ | | 15| 61.2k| c >>= 31; \ | | 16| 61.2k| c &= ab; \ | | 17| 61.2k| (a) ^= c; \ | | 18| 61.2k| (b) ^= c; \ | | 19| 61.2k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 61.2k] | | ------------------ ------------------ 36| 61.2k| } 37| 102k| } 38| 1.91k| i = 0; 39| 6.69k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 4.78k, False: 1.91k] ------------------ 40| 87.0k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 82.3k, False: 4.78k] ------------------ 41| 82.3k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 41.1k, False: 41.1k] ------------------ 42| 41.1k| int32_t a = x[i + p]; 43| 153k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 111k, False: 41.1k] ------------------ 44| 111k| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 111k| do { \ | | 12| 111k| int32_t ab = (b) ^ (a); \ | | 13| 111k| int32_t c = (b) - (a); \ | | 14| 111k| c ^= ab & ((c) ^ (b)); \ | | 15| 111k| c >>= 31; \ | | 16| 111k| c &= ab; \ | | 17| 111k| (a) ^= c; \ | | 18| 111k| (b) ^= c; \ | | 19| 111k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 111k] | | ------------------ ------------------ 45| 111k| } 46| 41.1k| x[i + p] = a; 47| 41.1k| } 48| 82.3k| } 49| 4.78k| } 50| 1.91k| } 51| 319|} PQCLEAN_MCELIECE348864_AVX2_crypto_kem_enc: 22| 102|) { 23| 102| unsigned char e[ SYS_N / 8 ]; 24| 102| unsigned char one_ec[ 1 + SYS_N / 8 + SYND_BYTES ] = {1}; 25| | 26| | // 27| | 28| 102| encrypt(c, pk, e); ------------------ | | 9| 102|#define encrypt CRYPTO_NAMESPACE(encrypt) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 29| | 30| 102| memcpy(one_ec + 1, e, SYS_N / 8); ------------------ | | 7| 102|#define SYS_N 3488 ------------------ 31| 102| memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 7| 102|#define SYS_N 3488 ------------------ memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 17| 102|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 102|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 102|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 102|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ 32| | 33| 102| crypto_hash_32b(key, one_ec, sizeof(one_ec)); ------------------ | | 7| 102| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 102|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 34| | 35| 102| return 0; 36| 102|} PQCLEAN_MCELIECE348864_AVX2_crypto_kem_dec: 42| 102|) { 43| 102| int i; 44| | 45| 102| unsigned char ret_decrypt = 0; 46| | 47| 102| uint16_t m; 48| | 49| 102| unsigned char e[ SYS_N / 8 ]; 50| 102| unsigned char preimage[ 1 + SYS_N / 8 + SYND_BYTES ]; 51| 102| unsigned char *x = preimage; 52| 102| const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 11| 102|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 102|#define SYS_T 64 | | ------------------ ------------------ const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 10| 102|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 102|#define GFBITS 12 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 102|#define GFBITS 12 | | ------------------ ------------------ 53| | 54| | // 55| | 56| 102| ret_decrypt = (unsigned char)decrypt(e, sk + 40, c); ------------------ | | 9| 102|#define decrypt CRYPTO_NAMESPACE(decrypt) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 57| | 58| 102| m = ret_decrypt; 59| 102| m -= 1; 60| 102| m >>= 8; 61| | 62| 102| *x++ = m & 1; 63| 44.5k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 44.5k|#define SYS_N 3488 ------------------ | Branch (63:17): [True: 44.4k, False: 102] ------------------ 64| 44.4k| *x++ = (~m & s[i]) | (m & e[i]); 65| 44.4k| } 66| | 67| 9.89k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 9.89k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 9.89k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 9.89k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 9.89k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (67:17): [True: 9.79k, False: 102] ------------------ 68| 9.79k| *x++ = c[i]; 69| 9.79k| } 70| | 71| 102| crypto_hash_32b(key, preimage, sizeof(preimage)); ------------------ | | 7| 102| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 102|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 72| | 73| 102| return 0; 74| 102|} PQCLEAN_MCELIECE348864_AVX2_crypto_kem_keypair: 80| 102|) { 81| 102| int i; 82| 102| unsigned char seed[ 33 ] = {64}; 83| 102| unsigned char r[ SYS_N / 8 + (1 << GFBITS)*sizeof(uint32_t) + SYS_T * 2 + 32 ]; 84| 102| unsigned char *rp, *skp; 85| | 86| 102| gf f[ SYS_T ]; // element in GF(2^mt) 87| 102| gf irr[ SYS_T ]; // Goppa polynomial 88| 102| uint32_t perm[ 1 << GFBITS ]; // random permutation as 32-bit integers 89| 102| int16_t pi[ 1 << GFBITS ]; // random permutation 90| | 91| 102| randombytes(seed + 1, 32); ------------------ | | 8| 102|#define randombytes OQS_randombytes ------------------ 92| | 93| 1.04k| while (1) { ------------------ | Branch (93:12): [True: 1.04k, Folded] ------------------ 94| 1.04k| rp = &r[ sizeof(r) - 32 ]; 95| 1.04k| skp = sk; 96| | 97| | // expanding and updating the seed 98| | 99| 1.04k| shake(r, sizeof(r), seed, 33); ------------------ | | 10| 1.04k| shake256(out, outlen, in, inlen) | | ------------------ | | | | 12| 1.04k|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 100| 1.04k| memcpy(skp, seed + 1, 32); 101| 1.04k| skp += 32 + 8; 102| 1.04k| memcpy(seed + 1, &r[ sizeof(r) - 32 ], 32); 103| | 104| | // generating irreducible polynomial 105| | 106| 1.04k| rp -= sizeof(f); 107| | 108| 67.6k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 67.6k|#define SYS_T 64 ------------------ | Branch (108:21): [True: 66.5k, False: 1.04k] ------------------ 109| 66.5k| f[i] = load_gf(rp + i * 2); 110| 66.5k| } 111| | 112| 1.04k| if (genpoly_gen(irr, f)) { ------------------ | | 9| 1.04k|#define genpoly_gen CRYPTO_NAMESPACE(genpoly_gen) | | ------------------ | | | | 4| 1.04k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ | Branch (112:13): [True: 0, False: 1.04k] ------------------ 113| 0| continue; 114| 0| } 115| | 116| 67.6k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 67.6k|#define SYS_T 64 ------------------ | Branch (116:21): [True: 66.5k, False: 1.04k] ------------------ 117| 66.5k| store_gf(skp + i * 2, irr[i]); 118| 66.5k| } 119| | 120| 1.04k| skp += IRR_BYTES; ------------------ | | 11| 1.04k|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 1.04k|#define SYS_T 64 | | ------------------ ------------------ 121| | 122| | // generating permutation 123| | 124| 1.04k| rp -= sizeof(perm); 125| | 126| 4.26M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 4.26M|#define GFBITS 12 ------------------ | Branch (126:21): [True: 4.25M, False: 1.04k] ------------------ 127| 4.25M| perm[i] = load4(rp + i * 4); 128| 4.25M| } 129| | 130| 1.04k| if (pk_gen(pk, skp - IRR_BYTES, perm, pi)) { ------------------ | | 9| 1.04k|#define pk_gen CRYPTO_NAMESPACE(pk_gen) | | ------------------ | | | | 4| 1.04k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ if (pk_gen(pk, skp - IRR_BYTES, perm, pi)) { ------------------ | | 11| 1.04k|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 1.04k|#define SYS_T 64 | | ------------------ ------------------ | Branch (130:13): [True: 938, False: 102] ------------------ 131| 938| continue; 132| 938| } 133| | 134| 102| controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 10| 102|#define controlbitsfrompermutation CRYPTO_NAMESPACE(controlbitsfrompermutation) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 102|#define GFBITS 12 ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 102|#define GFBITS 12 ------------------ 135| 102| skp += COND_BYTES; ------------------ | | 10| 102|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 102|#define GFBITS 12 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 102|#define GFBITS 12 | | ------------------ ------------------ 136| | 137| | // storing the random string s 138| | 139| 102| rp -= SYS_N / 8; ------------------ | | 7| 102|#define SYS_N 3488 ------------------ 140| 102| memcpy(skp, rp, SYS_N / 8); ------------------ | | 7| 102|#define SYS_N 3488 ------------------ 141| | 142| | // storing positions of the 32 pivots 143| | 144| 102| store8(sk + 32, 0xFFFFFFFF); 145| | 146| 102| break; 147| 1.04k| } 148| | 149| 102| return 0; 150| 102|} PQCLEAN_MCELIECE348864_AVX2_pk_gen: 198| 1.04k|int pk_gen(unsigned char *pk, const unsigned char *irr, const uint32_t *perm, int16_t *pi) { 199| 1.04k|#define nBlocks_I ((PK_NROWS + 255) / 256) 200| | 201| 1.04k| int i, j, k, b; 202| 1.04k| int row, c; 203| | 204| 1.04k| union { 205| 1.04k| uint64_t w[ PK_NROWS ][ nBlocks_I * 4 ]; 206| 1.04k| vec256 v[ PK_NROWS ][ nBlocks_I ]; 207| 1.04k| } mat; 208| | 209| 1.04k| union { 210| 1.04k| uint64_t w[ PK_NROWS ][ par_width * 4 ]; 211| 1.04k| vec256 v[ PK_NROWS ][ par_width ]; 212| 1.04k| } par; 213| | 214| 1.04k| uint16_t m; 215| 1.04k| vec256 mm; 216| | 217| 1.04k| uint64_t sk_int[ GFBITS ]; 218| | 219| 1.04k| vec256 consts[ 16 ][ GFBITS ]; 220| 1.04k| vec256 eval[ 16 ][ GFBITS ]; 221| 1.04k| vec256 prod[ 16 ][ GFBITS ]; 222| 1.04k| vec256 tmp[ GFBITS ]; 223| | 224| 1.04k| uint64_t list[1 << GFBITS]; 225| 1.04k| uint64_t one = 1; 226| 1.04k| uint64_t t; 227| | 228| 1.04k| uint16_t ind[ PK_NROWS ]; 229| 1.04k| uint16_t ind_inv[ PK_NROWS ]; 230| | 231| | // compute the inverses 232| | 233| 1.04k| irr_load(sk_int, irr); 234| | 235| 1.04k| fft(eval, sk_int); ------------------ | | 10| 1.04k|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 1.04k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 236| | 237| 1.04k| vec256_copy(prod[0], eval[0]); 238| | 239| 16.6k| for (i = 1; i < 16; i++) { ------------------ | Branch (239:17): [True: 15.6k, False: 1.04k] ------------------ 240| 15.6k| vec256_mul(prod[i], prod[i - 1], eval[i]); 241| 15.6k| } 242| | 243| 1.04k| vec256_inv(tmp, prod[15]); ------------------ | | 11| 1.04k|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 1.04k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 244| | 245| 16.6k| for (i = 14; i >= 0; i--) { ------------------ | Branch (245:18): [True: 15.6k, False: 1.04k] ------------------ 246| 15.6k| vec256_mul(prod[i + 1], prod[i], tmp); 247| 15.6k| vec256_mul(tmp, tmp, eval[i + 1]); 248| 15.6k| } 249| | 250| 1.04k| vec256_copy(prod[0], tmp); 251| | 252| | // fill matrix 253| | 254| 1.04k| de_bitslicing(list, prod); 255| | 256| 4.26M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 4.26M|#define GFBITS 12 ------------------ | Branch (256:17): [True: 4.25M, False: 1.04k] ------------------ 257| 4.25M| list[i] <<= GFBITS; ------------------ | | 6| 4.25M|#define GFBITS 12 ------------------ 258| 4.25M| list[i] |= i; 259| 4.25M| list[i] |= ((uint64_t) perm[i]) << 31; 260| 4.25M| } 261| | 262| 1.04k| uint64_sort(list, 1 << GFBITS); ------------------ | | 6| 1.04k|#define GFBITS 12 ------------------ 263| | 264| 4.19M| for (i = 1; i < (1 << GFBITS); i++) { ------------------ | | 6| 4.19M|#define GFBITS 12 ------------------ | Branch (264:17): [True: 4.19M, False: 1.01k] ------------------ 265| 4.19M| if (uint64_is_equal_declassify(list[i - 1] >> 31, list[i] >> 31)) { ------------------ | Branch (265:13): [True: 27, False: 4.19M] ------------------ 266| 27| return -1; 267| 27| } 268| 4.19M| } 269| | 270| 1.01k| to_bitslicing_2x(consts, prod, list); 271| | 272| 4.15M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 4.15M|#define GFBITS 12 ------------------ | Branch (272:17): [True: 4.14M, False: 1.01k] ------------------ 273| 4.14M| pi[i] = list[i] & GFMASK; ------------------ | | 19| 4.14M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 4.14M|#define GFBITS 12 | | ------------------ ------------------ 274| 4.14M| } 275| | 276| 4.05k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 199| 4.05k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 4.05k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 4.05k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 4.05k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (276:17): [True: 3.03k, False: 1.01k] ------------------ 277| 39.5k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 39.5k|#define GFBITS 12 ------------------ | Branch (277:21): [True: 36.4k, False: 3.03k] ------------------ 278| 36.4k| mat.v[ k ][ j ] = prod[ j ][ k ]; 279| 36.4k| } 280| 3.03k| } 281| | 282| 64.8k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 64.8k|#define SYS_T 64 ------------------ | Branch (282:17): [True: 63.8k, False: 1.01k] ------------------ 283| 255k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 199| 255k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 255k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 255k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 255k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (283:21): [True: 191k, False: 63.8k] ------------------ 284| 191k| vec256_mul(prod[j], prod[j], consts[j]); 285| | 286| 2.48M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 2.48M|#define GFBITS 12 ------------------ | Branch (286:25): [True: 2.29M, False: 191k] ------------------ 287| 2.29M| mat.v[ i * GFBITS + k ][ j ] = prod[ j ][ k ]; ------------------ | | 6| 2.29M|#define GFBITS 12 ------------------ 288| 2.29M| } 289| 191k| } 290| 63.8k| } 291| | 292| | // gaussian elimination to obtain L, U, and P such that LP M = U 293| | // L and U are stored in the space of M 294| | // P is stored in ind 295| | 296| 778k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 778k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 778k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 778k|#define GFBITS 12 | | ------------------ ------------------ | Branch (296:17): [True: 777k, False: 1.01k] ------------------ 297| 777k| ind_inv[i] = ind[ i ] = i; 298| 777k| } 299| | 300| 776k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 776k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 776k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 776k|#define GFBITS 12 | | ------------------ ------------------ | Branch (300:19): [True: 776k, False: 102] ------------------ 301| 776k| i = row >> 6; 302| 776k| j = row & 63; 303| | 304| 299M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 299M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 299M|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 299M|#define GFBITS 12 | | ------------------ ------------------ | Branch (304:27): [True: 298M, False: 776k] ------------------ 305| 298M| extract_01_masks(&m, mat.w[ row ], mat.w[ k ], row); 306| 298M| uint16_cswap(&ind[row], &ind[k], m); 307| | 308| 298M| mm = vec256_set1_16b(m); 309| 1.19G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 199| 1.19G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 1.19G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 1.19G|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 1.19G|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (309:25): [True: 895M, False: 298M] ------------------ 310| 895M| vec256_cswap(&mat.v[ row ][ c ], &mat.v[ k ][ c ], mm); 311| 895M| } 312| 298M| } 313| | 314| 776k| if ( uint64_is_zero_declassify((mat.w[ row ][ i ] >> j) & 1) ) { // return if not systematic ------------------ | Branch (314:14): [True: 911, False: 775k] ------------------ 315| 911| return -1; 316| 911| } 317| | 318| 299M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 299M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 299M|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 299M|#define GFBITS 12 | | ------------------ ------------------ | Branch (318:27): [True: 298M, False: 775k] ------------------ 319| 298M| t = mat.w[ k ][ i ] & (one << j); 320| 298M| mm = extract_mask256(mat.w[k], row); 321| | 322| 1.19G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 199| 1.19G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 1.19G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 1.19G|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 1.19G|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (322:25): [True: 895M, False: 298M] ------------------ 323| 895M| mat.v[ k ][ c ] ^= mat.v[ row ][ c ] & mm; 324| 895M| } 325| | 326| 298M| mat.w[ k ][ i ] |= t; 327| 298M| } 328| 775k| } 329| | 330| | // apply M^-1 to the remaining columns 331| | 332| 102| composeinv(PK_NROWS, ind_inv, ind_inv, ind); ------------------ | | 13| 102|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 102|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 102|#define GFBITS 12 | | ------------------ ------------------ 333| | 334| 1.32k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 1.32k|#define GFBITS 12 ------------------ | Branch (334:17): [True: 1.22k, False: 102] ------------------ 335| 14.6k| for (b = 0; b < par_width; b++) { ------------------ | | 29| 14.6k|#define par_width 11 ------------------ | Branch (335:21): [True: 13.4k, False: 1.22k] ------------------ 336| 13.4k| par.v[ k ][ b ] = prod[nBlocks_I + b][ k ]; ------------------ | | 199| 13.4k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 13.4k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 13.4k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 13.4k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ 337| 13.4k| } 338| 1.22k| } 339| | 340| 6.52k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 6.52k|#define SYS_T 64 ------------------ | Branch (340:17): [True: 6.42k, False: 102] ------------------ 341| 77.1k| for (b = 0; b < par_width; b++) { ------------------ | | 29| 77.1k|#define par_width 11 ------------------ | Branch (341:21): [True: 70.6k, False: 6.42k] ------------------ 342| 70.6k| vec256_mul(prod[nBlocks_I + b], prod[nBlocks_I + b], consts[nBlocks_I + b]); ------------------ | | 199| 70.6k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 70.6k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 70.6k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 70.6k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ vec256_mul(prod[nBlocks_I + b], prod[nBlocks_I + b], consts[nBlocks_I + b]); ------------------ | | 199| 70.6k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 70.6k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 70.6k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 70.6k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ vec256_mul(prod[nBlocks_I + b], prod[nBlocks_I + b], consts[nBlocks_I + b]); ------------------ | | 199| 70.6k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 70.6k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 70.6k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 70.6k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ 343| 70.6k| } 344| | 345| 83.5k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 83.5k|#define GFBITS 12 ------------------ | Branch (345:21): [True: 77.1k, False: 6.42k] ------------------ 346| 925k| for (b = 0; b < par_width; b++) { ------------------ | | 29| 925k|#define par_width 11 ------------------ | Branch (346:25): [True: 848k, False: 77.1k] ------------------ 347| 848k| par.v[ i * GFBITS + k ][ b ] = prod[nBlocks_I + b][ k ]; ------------------ | | 6| 848k|#define GFBITS 12 ------------------ par.v[ i * GFBITS + k ][ b ] = prod[nBlocks_I + b][ k ]; ------------------ | | 199| 848k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 848k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 848k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 848k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ 348| 848k| } 349| 77.1k| } 350| 6.42k| } 351| | 352| | // apply P 353| | 354| 78.4k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 78.4k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 78.4k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 78.4k|#define GFBITS 12 | | ------------------ ------------------ | Branch (354:17): [True: 78.3k, False: 102] ------------------ 355| 78.3k| ind[i] = ind_inv[i]; 356| 78.3k| } 357| | 358| 102| sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 6| 102|#define GFBITS 12 ------------------ sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 13| 102|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 102|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 102|#define GFBITS 12 | | ------------------ ------------------ 359| | 360| | // apply L 361| | 362| 78.4k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 102|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 102|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 102|#define GFBITS 12 | | ------------------ ------------------ | Branch (362:30): [True: 78.3k, False: 102] ------------------ 363| 30.1M| for (i = row - 1; i >= 0; i--) { ------------------ | Branch (363:27): [True: 30.0M, False: 78.3k] ------------------ 364| 30.0M| mm = extract_mask256(mat.w[row], i); 365| | 366| 360M| for (k = 0; k < par_width; k++) { ------------------ | | 29| 360M|#define par_width 11 ------------------ | Branch (366:25): [True: 330M, False: 30.0M] ------------------ 367| 330M| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 368| 330M| } 369| 30.0M| } 370| 78.3k| } 371| | 372| | // apply U^-1 373| | 374| 78.4k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 102|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 102|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 102|#define GFBITS 12 | | ------------------ ------------------ | Branch (374:30): [True: 78.3k, False: 102] ------------------ 375| 30.1M| for (i = PK_NROWS - 1; i > row; i--) { ------------------ | | 13| 78.3k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 78.3k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 78.3k|#define GFBITS 12 | | ------------------ ------------------ | Branch (375:32): [True: 30.0M, False: 78.3k] ------------------ 376| 30.0M| mm = extract_mask256(mat.w[row], i); 377| | 378| 360M| for (k = 0; k < par_width; k++) { ------------------ | | 29| 360M|#define par_width 11 ------------------ | Branch (378:25): [True: 330M, False: 30.0M] ------------------ 379| 330M| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 380| 330M| } 381| 30.0M| } 382| 78.3k| } 383| | 384| 78.4k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 78.4k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 78.4k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 78.4k|#define GFBITS 12 | | ------------------ ------------------ | Branch (384:19): [True: 78.3k, False: 102] ------------------ 385| 3.36M| for (k = 0; k < 42; k++) { ------------------ | Branch (385:21): [True: 3.29M, False: 78.3k] ------------------ 386| 3.29M| store8(pk + PK_ROW_BYTES * row + k * 8, par.w[row][k]); ------------------ | | 15| 3.29M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 3.29M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 3.29M|#define SYS_N 3488 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 3.29M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 3.29M|#define SYS_T 64 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 3.29M|#define GFBITS 12 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 387| 3.29M| } 388| | 389| 78.3k| store_i(pk + PK_ROW_BYTES * row + k * 8, par.w[row][k], 4); ------------------ | | 15| 78.3k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 78.3k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 78.3k|#define SYS_N 3488 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 78.3k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 78.3k|#define SYS_T 64 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 78.3k|#define GFBITS 12 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 390| 78.3k| } 391| | 392| | // 393| | 394| 102| return 0; 395| 1.01k|} pk_gen.c:de_bitslicing: 117| 5.50k|static void de_bitslicing(uint64_t *out, vec256 in[][GFBITS]) { 118| 5.50k| int i, j, r; 119| 5.50k| uint64_t u = 0; 120| | 121| 40.4M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 40.4M|#define GFBITS 12 ------------------ | Branch (121:17): [True: 40.4M, False: 5.50k] ------------------ 122| 40.4M| out[i] = 0 ; 123| 40.4M| } 124| | 125| 163k| for (i = 0; i < 16; i++) { ------------------ | Branch (125:17): [True: 157k, False: 5.50k] ------------------ 126| 2.19M| for (j = GFBITS - 1; j >= 0; j--) { ------------------ | | 6| 157k|#define GFBITS 12 ------------------ | Branch (126:30): [True: 2.03M, False: 157k] ------------------ 127| 2.03M| u = vec256_extract(in[i][j], 0); ------------------ | | 39| 2.03M|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 128| 132M| for (r = 0; r < 64; r++) { ------------------ | Branch (128:25): [True: 130M, False: 2.03M] ------------------ 129| 130M| out[i * 256 + 0 * 64 + r] <<= 1; 130| 130M| out[i * 256 + 0 * 64 + r] |= (u >> r) & 1; 131| 130M| } 132| 2.03M| u = vec256_extract(in[i][j], 1); ------------------ | | 39| 2.03M|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 133| 132M| for (r = 0; r < 64; r++) { ------------------ | Branch (133:25): [True: 130M, False: 2.03M] ------------------ 134| 130M| out[i * 256 + 1 * 64 + r] <<= 1; 135| 130M| out[i * 256 + 1 * 64 + r] |= (u >> r) & 1; 136| 130M| } 137| 2.03M| u = vec256_extract(in[i][j], 2); ------------------ | | 39| 2.03M|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 138| 132M| for (r = 0; r < 64; r++) { ------------------ | Branch (138:25): [True: 130M, False: 2.03M] ------------------ 139| 130M| out[i * 256 + 2 * 64 + r] <<= 1; 140| 130M| out[i * 256 + 2 * 64 + r] |= (u >> r) & 1; 141| 130M| } 142| 2.03M| u = vec256_extract(in[i][j], 3); ------------------ | | 39| 2.03M|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 143| 132M| for (r = 0; r < 64; r++) { ------------------ | Branch (143:25): [True: 130M, False: 2.03M] ------------------ 144| 130M| out[i * 256 + 3 * 64 + r] <<= 1; 145| 130M| out[i * 256 + 3 * 64 + r] |= (u >> r) & 1; 146| 130M| } 147| 2.03M| } 148| 157k| } 149| 5.50k|} pk_gen.c:to_bitslicing_2x: 152| 5.21k|static void to_bitslicing_2x(vec256 out0[][GFBITS], vec256 out1[][GFBITS], const uint64_t *in) { 153| 5.21k| int i, j, k, r; 154| 5.21k| uint64_t u[2][4] = {{0}}; 155| | 156| 154k| for (i = 0; i < 16; i++) { ------------------ | Branch (156:17): [True: 149k, False: 5.21k] ------------------ 157| 2.07M| for (j = GFBITS - 1; j >= 0; j--) { ------------------ | | 6| 149k|#define GFBITS 12 ------------------ | Branch (157:30): [True: 1.92M, False: 149k] ------------------ 158| 9.63M| for (k = 0; k < 4; k++) { ------------------ | Branch (158:25): [True: 7.70M, False: 1.92M] ------------------ 159| 500M| for (r = 63; r >= 0; r--) { ------------------ | Branch (159:30): [True: 493M, False: 7.70M] ------------------ 160| 493M| u[0][k] <<= 1; 161| 493M| u[0][k] |= (in[i * 256 + k * 64 + r] >> (GFBITS - 1 - j)) & 1; ------------------ | | 6| 493M|#define GFBITS 12 ------------------ 162| | 163| 493M| u[1][k] <<= 1; 164| 493M| u[1][k] |= (in[i * 256 + k * 64 + r] >> (j + GFBITS)) & 1; ------------------ | | 6| 493M|#define GFBITS 12 ------------------ 165| 493M| } 166| 7.70M| } 167| | 168| 1.92M| out0[i][j] = vec256_set4x(u[0][0], u[0][1], u[0][2], u[0][3]); 169| 1.92M| out1[i][j] = vec256_set4x(u[1][0], u[1][1], u[1][2], u[1][3]); 170| 1.92M| } 171| 149k| } 172| 5.21k|} pk_gen.c:extract_01_masks: 33| 5.07G|static inline void extract_01_masks(uint16_t *m, const uint64_t *x, const uint64_t *y, int i) { 34| 5.07G| *m = (((~x[ i >> 6 ]) & y[ i >> 6 ]) >> (i & 63)) & 1; 35| 5.07G| *m = -(*m); 36| 5.07G|} pk_gen.c:uint16_cswap: 49| 5.15G|static inline void uint16_cswap(uint16_t *x, uint16_t *y, uint16_t m) { 50| 5.15G| uint16_t d; 51| | 52| 5.15G| d = *x ^ *y; 53| 5.15G| d &= m; 54| 5.15G| *x ^= d; 55| 5.15G| *y ^= d; 56| 5.15G|} pk_gen.c:vec256_cswap: 59| 33.0G|static inline void vec256_cswap(vec256 *x, vec256 *y, vec256 m) { 60| 33.0G| vec256 d; 61| | 62| 33.0G| d = *x ^ *y; 63| 33.0G| d &= m; 64| 33.0G| *x ^= d; 65| 33.0G| *y ^= d; 66| 33.0G|} pk_gen.c:extract_mask256: 39| 9.24G|static inline vec256 extract_mask256(const uint64_t v[], int i) { 40| 9.24G| uint32_t mask; 41| | 42| 9.24G| mask = (v[ i >> 6 ] >> (i & 63)) & 1; 43| 9.24G| mask = -mask; 44| | 45| 9.24G| return vec256_set1_32b(mask); 46| 9.24G|} pk_gen.c:composeinv: 176| 936|static void composeinv(int n, uint16_t y[n], const uint16_t x[n], const uint16_t pi[n]) { 177| 936| int i; 178| 936| int32_t t[n]; 179| | 180| 1.28M| for (i = 0; i < n; ++i) { ------------------ | Branch (180:17): [True: 1.28M, False: 936] ------------------ 181| 1.28M| t[i] = pi[i]; 182| 1.28M| t[i] <<= 16; 183| 1.28M| t[i] |= x[i]; 184| 1.28M| } 185| | 186| 936| int32_sort(t, n); ------------------ | | 6| 936|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 936|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 187| | 188| 1.28M| for (i = 0; i < n; ++i) { ------------------ | Branch (188:17): [True: 1.28M, False: 936] ------------------ 189| 1.28M| y[i] = t[i] & 0xFFFF; 190| 1.28M| } 191| 936|} pk_gen.c:sort_rows: 107| 7.34M|static void sort_rows(int n, int bound, uint16_t *x, vec256 (*mat)[par_width], int off) { 108| 7.34M| if (n <= 1) { ------------------ | Branch (108:9): [True: 3.67M, False: 3.67M] ------------------ 109| 3.67M| return; 110| 3.67M| } 111| 3.67M| sort_rows(n / 2, bound, x, mat, off); 112| 3.67M| sort_rows(n / 2, bound, x, mat, off + n / 2); 113| 3.67M| merge_rows(n / 2, bound, x, mat, off, 1); 114| 3.67M|} pk_gen.c:merge_rows: 89| 36.5M|static void merge_rows(int n, int bound, uint16_t *x, vec256 (*mat)[par_width], int off, int step) { 90| 36.5M| int i; 91| | 92| 36.5M| if (n == 1) { ------------------ | Branch (92:9): [True: 20.1M, False: 16.4M] ------------------ 93| 20.1M| if (off + step < bound) { ------------------ | Branch (93:13): [True: 14.0M, False: 6.03M] ------------------ 94| 14.0M| minmax_rows(x, mat, off, off + step); 95| 14.0M| } 96| 20.1M| } else { 97| 16.4M| merge_rows(n / 2, bound, x, mat, off, step * 2); 98| 16.4M| merge_rows(n / 2, bound, x, mat, off + step, step * 2); 99| | 100| 78.7M| for (i = 1; i < 2 * n - 1 && off + (i + 1) * step < bound; i += 2) { ------------------ | Branch (100:21): [True: 67.3M, False: 11.3M] | Branch (100:38): [True: 62.2M, False: 5.10M] ------------------ 101| 62.2M| minmax_rows(x, mat, off + i * step, off + (i + 1)*step); 102| 62.2M| } 103| 16.4M| } 104| 36.5M|} pk_gen.c:minmax_rows: 70| 76.3M|static inline void minmax_rows(uint16_t *x, vec256 (*mat)[par_width], int i0, int i1) { 71| 76.3M| int i; 72| 76.3M| uint16_t m; 73| 76.3M| vec256 mm; 74| | 75| 76.3M| m = x[i1] - x[i0]; 76| 76.3M| m >>= 15; 77| 76.3M| m = -m; 78| 76.3M| mm = vec256_set1_16b(m); 79| | 80| 76.3M| uint16_cswap(&x[i0], &x[i1], m); 81| | 82| 780M| for (i = 0; i < par_width; i++) { ------------------ | | 29| 780M|#define par_width 11 ------------------ | Branch (82:17): [True: 703M, False: 76.3M] ------------------ 83| 703M| vec256_cswap(&mat[i0][i], &mat[i1][i], mm); 84| 703M| } 85| 76.3M|} PQCLEAN_MCELIECE348864_AVX2_genpoly_gen: 55| 1.04k|int genpoly_gen(gf *out, gf *f) { 56| 1.04k| int i, j, k; 57| | 58| 1.04k| gf t, inv; 59| | 60| 1.04k| vec v[ GFBITS ], buf[ GFBITS ][ 64 ], mat[ 64 ][ GFBITS ], mask; 61| | 62| | // fill matrix 63| | 64| 1.04k| buf[0][0] = 1; 65| 12.4k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 12.4k|#define GFBITS 12 ------------------ | Branch (65:17): [True: 11.4k, False: 1.04k] ------------------ 66| 11.4k| buf[i][0] = 0; 67| 11.4k| } 68| | 69| 13.5k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 13.5k|#define GFBITS 12 ------------------ | Branch (69:17): [True: 12.4k, False: 1.04k] ------------------ 70| 811k| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 12.4k|#define SYS_T 64 ------------------ | Branch (70:29): [True: 798k, False: 12.4k] ------------------ 71| 798k| v[j] <<= 1; 72| 798k| v[j] |= (f[i] >> j) & 1; 73| 798k| } 74| 12.4k| } 75| | 76| 13.5k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 13.5k|#define GFBITS 12 ------------------ | Branch (76:17): [True: 12.4k, False: 1.04k] ------------------ 77| 12.4k| buf[i][1] = v[i]; 78| 12.4k| } 79| | 80| 66.5k| for (k = 2; k <= SYS_T; k++) { ------------------ | | 8| 66.5k|#define SYS_T 64 ------------------ | Branch (80:17): [True: 65.5k, False: 1.04k] ------------------ 81| 65.5k| vec_GF_mul(v, v, f); ------------------ | | 6| 65.5k|#define vec_GF_mul CRYPTO_NAMESPACE(vec_GF_mul) | | ------------------ | | | | 4| 65.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 82| | 83| 65.5k| if (k < SYS_T) { ------------------ | | 8| 65.5k|#define SYS_T 64 ------------------ | Branch (83:13): [True: 64.4k, False: 1.04k] ------------------ 84| 838k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 838k|#define GFBITS 12 ------------------ | Branch (84:25): [True: 773k, False: 64.4k] ------------------ 85| 773k| buf[i][k] = v[i]; 86| 773k| } 87| 64.4k| } else { 88| 67.6k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 67.6k|#define SYS_T 64 ------------------ | Branch (88:25): [True: 66.5k, False: 1.04k] ------------------ 89| 66.5k| out[i] = extract_gf(v, i); 90| 66.5k| } 91| 1.04k| } 92| 65.5k| } 93| | 94| 13.5k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 13.5k|#define GFBITS 12 ------------------ | Branch (94:17): [True: 12.4k, False: 1.04k] ------------------ 95| 12.4k| transpose_64x64(buf[i]); 96| 12.4k| } 97| | 98| 67.6k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 67.6k|#define SYS_T 64 ------------------ | Branch (98:17): [True: 66.5k, False: 1.04k] ------------------ 99| 865k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 865k|#define GFBITS 12 ------------------ | Branch (99:21): [True: 798k, False: 66.5k] ------------------ 100| 798k| mat[j][i] = buf[i][j]; 101| 798k| } 102| 66.5k| } 103| | 104| | // gaussian 105| | 106| 67.6k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 67.6k|#define SYS_T 64 ------------------ | Branch (106:17): [True: 66.5k, False: 1.04k] ------------------ 107| 2.16M| for (j = i + 1; j < SYS_T; j++) { ------------------ | | 8| 2.16M|#define SYS_T 64 ------------------ | Branch (107:25): [True: 2.09M, False: 66.5k] ------------------ 108| 2.09M| mask = extract_bit(mat[i], i); 109| 2.09M| mask -= 1; 110| | 111| 27.2M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 27.2M|#define GFBITS 12 ------------------ | Branch (111:25): [True: 25.1M, False: 2.09M] ------------------ 112| 25.1M| mat[i][k] ^= mat[j][k] & mask; 113| 25.1M| } 114| | 115| 2.09M| out[i] ^= out[j] & mask; 116| 2.09M| } 117| | 118| | // 119| | 120| 66.5k| t = extract_gf(mat[i], i); 121| | 122| 66.5k| if (gf_is_zero_declassify(t)) { ------------------ | Branch (122:13): [True: 0, False: 66.5k] ------------------ 123| 0| return -1; // return if not systematic 124| 0| } 125| | 126| | // 127| | 128| 66.5k| inv = gf_inv(t); ------------------ | | 11| 66.5k|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 66.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 129| 66.5k| vec_mul_gf(mat[i], mat[i], inv); 130| | 131| 66.5k| out[i] = gf_mul(out[i], inv); ------------------ | | 14| 66.5k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 66.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 132| | 133| 4.32M| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 4.32M|#define SYS_T 64 ------------------ | Branch (133:21): [True: 4.25M, False: 66.5k] ------------------ 134| 4.25M| if (j != i) { ------------------ | Branch (134:17): [True: 4.19M, False: 66.5k] ------------------ 135| 4.19M| t = extract_gf(mat[j], i); 136| | 137| 4.19M| vec_mul_gf(v, mat[i], t); 138| 4.19M| vec_add(mat[j], mat[j], v); 139| | 140| 4.19M| out[j] ^= gf_mul(out[i], t); ------------------ | | 14| 4.19M|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 4.19M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 141| 4.19M| } 142| 4.25M| } 143| 66.5k| } 144| | 145| 1.04k| return 0; 146| 1.04k|} sk_gen.c:extract_gf: 26| 64.8M|static inline gf extract_gf(const vec v[GFBITS], int idx) { 27| 64.8M| int i; 28| 64.8M| gf ret; 29| | 30| 64.8M| ret = 0; 31| 903M| for (i = GFBITS - 1; i >= 0; i--) { ------------------ | | 6| 64.8M|#define GFBITS 12 ------------------ | Branch (31:26): [True: 838M, False: 64.8M] ------------------ 32| 838M| ret <<= 1; 33| 838M| ret |= (v[i] >> idx) & 1; 34| 838M| } 35| | 36| 64.8M| return ret; 37| 64.8M|} sk_gen.c:extract_bit: 40| 31.8M|static inline vec extract_bit(const vec v[GFBITS], int idx) { 41| 31.8M| int i; 42| 31.8M| vec ret; 43| | 44| 31.8M| ret = 0; 45| 443M| for (i = GFBITS - 1; i >= 0; i--) { ------------------ | | 6| 31.8M|#define GFBITS 12 ------------------ | Branch (45:26): [True: 411M, False: 31.8M] ------------------ 46| 411M| ret |= v[i]; 47| 411M| } 48| | 49| 31.8M| return (ret >> idx) & 1; 50| 31.8M|} sk_gen.c:transpose_64x64: 19| 240k|static inline void transpose_64x64(uint64_t *in) { 20| 240k| transpose_64x64_asm(in); ------------------ | | 11| 240k|#define transpose_64x64_asm CRYPTO_NAMESPACE(transpose_64x64_asm) | | ------------------ | | | | 4| 240k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 21| 240k|} fft_tr.c:transpose_64x256_sp: 25| 11.6k|static inline void transpose_64x256_sp(vec256 *in) { 26| 11.6k| transpose_64x256_sp_asm(in); ------------------ | | 10| 11.6k|#define transpose_64x256_sp_asm CRYPTO_NAMESPACE(transpose_64x256_sp_asm) | | ------------------ | | | | 4| 11.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 27| 11.6k|} benes.c:transpose_64x64: 19| 3.60k|static inline void transpose_64x64(uint64_t *in) { 20| 3.60k| transpose_64x64_asm(in); ------------------ | | 11| 3.60k|#define transpose_64x64_asm CRYPTO_NAMESPACE(transpose_64x64_asm) | | ------------------ | | | | 4| 3.60k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 21| 3.60k|} operations.c:load_gf: 27| 579k|static inline uint16_t load_gf(const unsigned char *src) { 28| 579k| uint16_t a; 29| | 30| 579k| a = src[1]; 31| 579k| a <<= 8; 32| 579k| a |= src[0]; 33| | 34| 579k| return a & GFMASK; ------------------ | | 19| 579k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 579k|#define GFBITS 12 | | ------------------ ------------------ 35| 579k|} operations.c:store_gf: 22| 579k|static inline void store_gf(unsigned char *dest, gf a) { 23| 579k| dest[0] = a & 0xFF; 24| 579k| dest[1] = a >> 8; 25| 579k|} operations.c:load4: 37| 40.4M|static inline uint32_t load4(const unsigned char *src) { 38| 40.4M| uint32_t a; 39| | 40| 40.4M| a = src[3]; 41| 40.4M| a <<= 8; 42| 40.4M| a |= src[2]; 43| 40.4M| a <<= 8; 44| 40.4M| a |= src[1]; 45| 40.4M| a <<= 8; 46| 40.4M| a |= src[0]; 47| | 48| 40.4M| return a; 49| 40.4M|} operations.c:store8: 73| 936|static inline void store8(unsigned char *out, uint64_t in) { 74| 936| out[0] = (in >> 0x00) & 0xFF; 75| 936| out[1] = (in >> 0x08) & 0xFF; 76| 936| out[2] = (in >> 0x10) & 0xFF; 77| 936| out[3] = (in >> 0x18) & 0xFF; 78| 936| out[4] = (in >> 0x20) & 0xFF; 79| 936| out[5] = (in >> 0x28) & 0xFF; 80| 936| out[6] = (in >> 0x30) & 0xFF; 81| 936| out[7] = (in >> 0x38) & 0xFF; 82| 936|} pk_gen.c:irr_load: 51| 1.13k|static inline void irr_load(uint64_t *out, const unsigned char *in) { 52| 1.13k| int i, j; 53| 1.13k| uint16_t irr[ SYS_T + 1 ]; 54| | 55| 74.0k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 74.0k|#define SYS_T 64 ------------------ | Branch (55:17): [True: 72.8k, False: 1.13k] ------------------ 56| 72.8k| irr[i] = load_gf(in + i * 2); 57| 72.8k| } 58| | 59| 1.13k| irr[ SYS_T ] = 1; ------------------ | | 8| 1.13k|#define SYS_T 64 ------------------ 60| | 61| 14.8k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 14.8k|#define GFBITS 12 ------------------ | Branch (61:17): [True: 13.6k, False: 1.13k] ------------------ 62| 13.6k| out[i] = 0; 63| 13.6k| } 64| | 65| 75.1k| for (i = SYS_T; i >= 0; i--) { ------------------ | | 8| 1.13k|#define SYS_T 64 ------------------ | Branch (65:21): [True: 74.0k, False: 1.13k] ------------------ 66| 962k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 962k|#define GFBITS 12 ------------------ | Branch (66:21): [True: 888k, False: 74.0k] ------------------ 67| 888k| out[j] <<= 1; 68| 888k| out[j] |= (irr[i] >> j) & 1; 69| 888k| } 70| 74.0k| } 71| 1.13k|} pk_gen.c:load_gf: 27| 579k|static inline uint16_t load_gf(const unsigned char *src) { 28| 579k| uint16_t a; 29| | 30| 579k| a = src[1]; 31| 579k| a <<= 8; 32| 579k| a |= src[0]; 33| | 34| 579k| return a & GFMASK; ------------------ | | 19| 579k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 579k|#define GFBITS 12 | | ------------------ ------------------ 35| 579k|} pk_gen.c:store8: 73| 96.6M|static inline void store8(unsigned char *out, uint64_t in) { 74| 96.6M| out[0] = (in >> 0x00) & 0xFF; 75| 96.6M| out[1] = (in >> 0x08) & 0xFF; 76| 96.6M| out[2] = (in >> 0x10) & 0xFF; 77| 96.6M| out[3] = (in >> 0x18) & 0xFF; 78| 96.6M| out[4] = (in >> 0x20) & 0xFF; 79| 96.6M| out[5] = (in >> 0x28) & 0xFF; 80| 96.6M| out[6] = (in >> 0x30) & 0xFF; 81| 96.6M| out[7] = (in >> 0x38) & 0xFF; 82| 96.6M|} pk_gen.c:store_i: 14| 1.02M|static inline void store_i(unsigned char *out, uint64_t in, int i) { 15| 1.02M| int j; 16| | 17| 5.46M| for (j = 0; j < i; j++) { ------------------ | Branch (17:17): [True: 4.43M, False: 1.02M] ------------------ 18| 4.43M| out[j] = (in >> (j * 8)) & 0xFF; 19| 4.43M| } 20| 1.02M|} decrypt.c:load16: 105| 46.2k|static inline vec128 load16(const unsigned char *in) { 106| 46.2k| return vec128_set2x( load8(in), load8(in + 8) ); 107| 46.2k|} decrypt.c:load8: 84| 92.5k|static inline uint64_t load8(const unsigned char *in) { 85| 92.5k| int i; 86| 92.5k| uint64_t ret = in[7]; 87| | 88| 740k| for (i = 6; i >= 0; i--) { ------------------ | Branch (88:17): [True: 648k, False: 92.5k] ------------------ 89| 648k| ret <<= 8; 90| 648k| ret |= in[i]; 91| 648k| } 92| | 93| 92.5k| return ret; 94| 92.5k|} decrypt.c:irr_load: 51| 180|static inline void irr_load(uint64_t *out, const unsigned char *in) { 52| 180| int i, j; 53| 180| uint16_t irr[ SYS_T + 1 ]; 54| | 55| 11.7k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 11.7k|#define SYS_T 64 ------------------ | Branch (55:17): [True: 11.5k, False: 180] ------------------ 56| 11.5k| irr[i] = load_gf(in + i * 2); 57| 11.5k| } 58| | 59| 180| irr[ SYS_T ] = 1; ------------------ | | 8| 180|#define SYS_T 64 ------------------ 60| | 61| 2.34k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 2.34k|#define GFBITS 12 ------------------ | Branch (61:17): [True: 2.16k, False: 180] ------------------ 62| 2.16k| out[i] = 0; 63| 2.16k| } 64| | 65| 11.8k| for (i = SYS_T; i >= 0; i--) { ------------------ | | 8| 180|#define SYS_T 64 ------------------ | Branch (65:21): [True: 11.7k, False: 180] ------------------ 66| 152k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 152k|#define GFBITS 12 ------------------ | Branch (66:21): [True: 140k, False: 11.7k] ------------------ 67| 140k| out[j] <<= 1; 68| 140k| out[j] |= (irr[i] >> j) & 1; 69| 140k| } 70| 11.7k| } 71| 180|} decrypt.c:load_gf: 27| 99.8k|static inline uint16_t load_gf(const unsigned char *src) { 28| 99.8k| uint16_t a; 29| | 30| 99.8k| a = src[1]; 31| 99.8k| a <<= 8; 32| 99.8k| a |= src[0]; 33| | 34| 99.8k| return a & GFMASK; ------------------ | | 19| 99.8k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 99.8k|#define GFBITS 12 | | ------------------ ------------------ 35| 99.8k|} decrypt.c:store8: 73| 108k|static inline void store8(unsigned char *out, uint64_t in) { 74| 108k| out[0] = (in >> 0x00) & 0xFF; 75| 108k| out[1] = (in >> 0x08) & 0xFF; 76| 108k| out[2] = (in >> 0x10) & 0xFF; 77| 108k| out[3] = (in >> 0x18) & 0xFF; 78| 108k| out[4] = (in >> 0x20) & 0xFF; 79| 108k| out[5] = (in >> 0x28) & 0xFF; 80| 108k| out[6] = (in >> 0x30) & 0xFF; 81| 108k| out[7] = (in >> 0x38) & 0xFF; 82| 108k|} encrypt.c:load_gf: 27| 1.01M|static inline uint16_t load_gf(const unsigned char *src) { 28| 1.01M| uint16_t a; 29| | 30| 1.01M| a = src[1]; 31| 1.01M| a <<= 8; 32| 1.01M| a |= src[0]; 33| | 34| 1.01M| return a & GFMASK; ------------------ | | 19| 1.01M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 1.01M|#define GFBITS 12 | | ------------------ ------------------ 35| 1.01M|} encrypt.c:store8: 73| 86.1k|static inline void store8(unsigned char *out, uint64_t in) { 74| 86.1k| out[0] = (in >> 0x00) & 0xFF; 75| 86.1k| out[1] = (in >> 0x08) & 0xFF; 76| 86.1k| out[2] = (in >> 0x10) & 0xFF; 77| 86.1k| out[3] = (in >> 0x18) & 0xFF; 78| 86.1k| out[4] = (in >> 0x20) & 0xFF; 79| 86.1k| out[5] = (in >> 0x28) & 0xFF; 80| 86.1k| out[6] = (in >> 0x30) & 0xFF; 81| 86.1k| out[7] = (in >> 0x38) & 0xFF; 82| 86.1k|} benes.c:load4: 37| 138k|static inline uint32_t load4(const unsigned char *src) { 38| 138k| uint32_t a; 39| | 40| 138k| a = src[3]; 41| 138k| a <<= 8; 42| 138k| a |= src[2]; 43| 138k| a <<= 8; 44| 138k| a |= src[1]; 45| 138k| a <<= 8; 46| 138k| a |= src[0]; 47| | 48| 138k| return a; 49| 138k|} benes.c:load8: 84| 1.27M|static inline uint64_t load8(const unsigned char *in) { 85| 1.27M| int i; 86| 1.27M| uint64_t ret = in[7]; 87| | 88| 10.1M| for (i = 6; i >= 0; i--) { ------------------ | Branch (88:17): [True: 8.91M, False: 1.27M] ------------------ 89| 8.91M| ret <<= 8; 90| 8.91M| ret |= in[i]; 91| 8.91M| } 92| | 93| 1.27M| return ret; 94| 1.27M|} PQCLEAN_MCELIECE348864_AVX2_vec_GF_mul: 6| 65.5k|void vec_GF_mul(vec out[ GFBITS ], vec v[ GFBITS ], gf a[ SYS_T ]) { 7| 65.5k| int i, j; 8| 65.5k| vec buf[GFBITS][2], prod[GFBITS], tmp[GFBITS]; 9| | 10| 65.5k| const vec allone = -1; 11| | 12| | // polynomial multiplication 13| | 14| 851k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 851k|#define GFBITS 12 ------------------ | Branch (14:17): [True: 786k, False: 65.5k] ------------------ 15| 786k| buf[i][0] = 0; 16| 786k| buf[i][1] = 0; 17| 786k| } 18| | 19| 4.25M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 65.5k|#define SYS_T 64 ------------------ | Branch (19:25): [True: 4.19M, False: 65.5k] ------------------ 20| 54.5M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 54.5M|#define GFBITS 12 ------------------ | Branch (20:21): [True: 50.3M, False: 4.19M] ------------------ 21| 50.3M| buf[j][1] <<= 1; 22| 50.3M| buf[j][1] |= buf[j][0] >> 63; 23| 50.3M| buf[j][0] <<= 1; 24| 50.3M| } 25| | 26| 4.19M| vec_mul_gf(prod, v, a[i]); 27| | 28| 54.5M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 54.5M|#define GFBITS 12 ------------------ | Branch (28:21): [True: 50.3M, False: 4.19M] ------------------ 29| 50.3M| buf[j][0] ^= prod[j]; 30| 50.3M| } 31| 4.19M| } 32| | 33| | // reduction modulo y^64 + y^3 + y + z 34| | 35| 851k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 851k|#define GFBITS 12 ------------------ | Branch (35:17): [True: 786k, False: 65.5k] ------------------ 36| 786k| prod[i] = buf[i][1] & (allone << 3); 37| 786k| } 38| | 39| 65.5k| vec_mul_gf(tmp, prod, 2); 40| | 41| 851k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 851k|#define GFBITS 12 ------------------ | Branch (41:17): [True: 786k, False: 65.5k] ------------------ 42| 786k| buf[i][1] ^= prod[i] >> (SYS_T - 3); ------------------ | | 8| 786k|#define SYS_T 64 ------------------ 43| 786k| buf[i][0] ^= prod[i] << (64 - (SYS_T - 3)); ------------------ | | 8| 786k|#define SYS_T 64 ------------------ 44| 786k| buf[i][1] ^= prod[i] >> (SYS_T - 1); ------------------ | | 8| 786k|#define SYS_T 64 ------------------ 45| 786k| buf[i][0] ^= prod[i] << (64 - (SYS_T - 1)); ------------------ | | 8| 786k|#define SYS_T 64 ------------------ 46| 786k| buf[i][0] ^= tmp[i]; 47| 786k| } 48| | 49| | // 50| | 51| 851k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 851k|#define GFBITS 12 ------------------ | Branch (51:17): [True: 786k, False: 65.5k] ------------------ 52| 786k| prod[i] = buf[i][1] & 0x7; 53| 786k| } 54| | 55| 65.5k| vec_mul_gf(tmp, prod, 2); 56| | 57| 851k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 851k|#define GFBITS 12 ------------------ | Branch (57:17): [True: 786k, False: 65.5k] ------------------ 58| 786k| buf[i][0] ^= prod[i] << (64 - (SYS_T - 3)); ------------------ | | 8| 786k|#define SYS_T 64 ------------------ 59| 786k| buf[i][0] ^= prod[i] << (64 - (SYS_T - 1)); ------------------ | | 8| 786k|#define SYS_T 64 ------------------ 60| 786k| buf[i][0] ^= tmp[i]; 61| 786k| } 62| | 63| | // 64| | 65| 851k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 851k|#define GFBITS 12 ------------------ | Branch (65:17): [True: 786k, False: 65.5k] ------------------ 66| 786k| out[i] = buf[i][0]; 67| 786k| } 68| 65.5k|} sk_gen.c:vec_mul_gf: 37| 4.66M|static inline void vec_mul_gf(vec out[ GFBITS ], vec v[ GFBITS ], gf a) { 38| 4.66M| int i; 39| | 40| 4.66M| vec bits[GFBITS]; 41| | 42| 60.6M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 60.6M|#define GFBITS 12 ------------------ | Branch (42:17): [True: 55.9M, False: 4.66M] ------------------ 43| 55.9M| bits[i] = -((a >> i) & 1); 44| 55.9M| } 45| | 46| 4.66M| vec_mul_asm(out, v, bits); ------------------ | | 7| 4.66M|#define vec_mul_asm CRYPTO_NAMESPACE(vec_mul_asm) | | ------------------ | | | | 4| 4.66M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 47| 4.66M|} sk_gen.c:vec_add: 29| 4.59M|static inline void vec_add(vec *h, const vec *f, const vec *g) { 30| 4.59M| int b; 31| | 32| 59.7M| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 59.7M|#define GFBITS 12 ------------------ | Branch (32:17): [True: 55.1M, False: 4.59M] ------------------ 33| 55.1M| h[b] = f[b] ^ g[b]; 34| 55.1M| } 35| 4.59M|} vec.c:vec_mul_gf: 37| 4.73M|static inline void vec_mul_gf(vec out[ GFBITS ], vec v[ GFBITS ], gf a) { 38| 4.73M| int i; 39| | 40| 4.73M| vec bits[GFBITS]; 41| | 42| 61.5M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 61.5M|#define GFBITS 12 ------------------ | Branch (42:17): [True: 56.8M, False: 4.73M] ------------------ 43| 56.8M| bits[i] = -((a >> i) & 1); 44| 56.8M| } 45| | 46| 4.73M| vec_mul_asm(out, v, bits); ------------------ | | 7| 4.73M|#define vec_mul_asm CRYPTO_NAMESPACE(vec_mul_asm) | | ------------------ | | | | 4| 4.73M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 47| 4.73M|} fft.c:vec_mul: 19| 7.49k|static inline void vec_mul(vec *h, const vec *f, const vec *g) { 20| 7.49k| vec_mul_asm(h, f, g); ------------------ | | 7| 7.49k|#define vec_mul_asm CRYPTO_NAMESPACE(vec_mul_asm) | | ------------------ | | | | 4| 7.49k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 21| 7.49k|} fft_tr.c:vec_mul: 19| 2.16k|static inline void vec_mul(vec *h, const vec *f, const vec *g) { 20| 2.16k| vec_mul_asm(h, f, g); ------------------ | | 7| 2.16k|#define vec_mul_asm CRYPTO_NAMESPACE(vec_mul_asm) | | ------------------ | | | | 4| 2.16k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 21| 2.16k|} fft_tr.c:vec_add: 29| 1.80k|static inline void vec_add(vec *h, const vec *f, const vec *g) { 30| 1.80k| int b; 31| | 32| 23.4k| for (b = 0; b < GFBITS; b++) { ------------------ | | 6| 23.4k|#define GFBITS 12 ------------------ | Branch (32:17): [True: 21.6k, False: 1.80k] ------------------ 33| 21.6k| h[b] = f[b] ^ g[b]; 34| 21.6k| } 35| 1.80k|} bm.c:vec_mul_sp: 25| 23.2k|static inline void vec_mul_sp(vec *h, const vec *f, const vec *g) { 26| 23.2k| vec_mul_sp_asm(h, f, g); ------------------ | | 8| 23.2k|#define vec_mul_sp_asm CRYPTO_NAMESPACE(vec_mul_sp_asm) | | ------------------ | | | | 4| 23.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 27| 23.2k|} decrypt.c:vec128_set2x: 49| 110k|static inline vec128 vec128_set2x(uint64_t a0, uint64_t a1) { 50| 110k| return _mm_set_epi64x(a1, a0); 51| 110k|} decrypt.c:vec128_xor: 38| 2.16k|static inline vec128 vec128_xor(vec128 a, vec128 b) { 39| 2.16k| return _mm_xor_si128(a, b); 40| 2.16k|} decrypt.c:vec128_or: 42| 1.98k|static inline vec128 vec128_or(vec128 a, vec128 b) { 43| 1.98k| return _mm_or_si128(a, b); 44| 1.98k|} decrypt.c:vec128_testz: 30| 180|static inline int vec128_testz(vec128 a) { 31| 180| return _mm_testz_si128(a, a); 32| 180|} fft_tr.c:vec128_set2x: 49| 55.4k|static inline vec128 vec128_set2x(uint64_t a0, uint64_t a1) { 50| 55.4k| return _mm_set_epi64x(a1, a0); 51| 55.4k|} fft_tr.c:vec128_mul: 96| 10.8k|static inline void vec128_mul(vec128 *h, vec128 *f, const vec128 *g) { 97| 10.8k| vec128_mul_asm(h, f, g, 16); ------------------ | | 10| 10.8k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 10.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 98| 10.8k|} bm.c:vec128_setzero: 24| 19.9k|static inline vec128 vec128_setzero(void) { 25| 19.9k| return _mm_setzero_si128(); 26| 19.9k|} bm.c:vec128_set1_16b: 20| 354k|static inline vec128 vec128_set1_16b(uint16_t a) { 21| 354k| return _mm_set1_epi16(a); 22| 354k|} bm.c:vec128_or: 42| 2.30M|static inline vec128 vec128_or(vec128 a, vec128 b) { 43| 2.30M| return _mm_or_si128(a, b); 44| 2.30M|} bm.c:vec128_and: 34| 4.61M|static inline vec128 vec128_and(vec128 a, vec128 b) { 35| 4.61M| return _mm_and_si128(a, b); 36| 4.61M|} bm.c:vec128_mul: 96| 23.0k|static inline void vec128_mul(vec128 *h, vec128 *f, const vec128 *g) { 97| 23.0k| vec128_mul_asm(h, f, g, 16); ------------------ | | 10| 23.0k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 23.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 98| 23.0k|} PQCLEAN_MCELIECE348864_AVX2_vec256_sq: 9| 14.1k|void vec256_sq(vec256 *out, vec256 *in) { 10| 14.1k| int i; 11| 14.1k| vec256 result[GFBITS]; 12| | 13| 14.1k| result[0] = in[0] ^ in[6]; 14| 14.1k| result[1] = in[11]; 15| 14.1k| result[2] = in[1] ^ in[7]; 16| 14.1k| result[3] = in[6]; 17| 14.1k| result[4] = in[2] ^ in[11] ^ in[8]; 18| 14.1k| result[5] = in[7]; 19| 14.1k| result[6] = in[3] ^ in[9]; 20| 14.1k| result[7] = in[8]; 21| 14.1k| result[8] = in[4] ^ in[10]; 22| 14.1k| result[9] = in[9]; 23| 14.1k| result[10] = in[5] ^ in[11]; 24| 14.1k| result[11] = in[10]; 25| | 26| 184k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 184k|#define GFBITS 12 ------------------ | Branch (26:17): [True: 170k, False: 14.1k] ------------------ 27| 170k| out[i] = result[i]; 28| 170k| } 29| 14.1k|} PQCLEAN_MCELIECE348864_AVX2_vec256_inv: 32| 1.14k|void vec256_inv(vec256 *out, vec256 *in) { 33| 1.14k| vec256 tmp_11[ GFBITS ]; 34| 1.14k| vec256 tmp_1111[ GFBITS ]; 35| | 36| 1.14k| vec256_copy(out, in); 37| | 38| 1.14k| vec256_sq(out, out); ------------------ | | 14| 1.14k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.14k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 39| 1.14k| vec256_mul(tmp_11, out, in); // ^11 40| | 41| 1.14k| vec256_sq(out, tmp_11); ------------------ | | 14| 1.14k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.14k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 42| 1.14k| vec256_sq(out, out); ------------------ | | 14| 1.14k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.14k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 43| 1.14k| vec256_mul(tmp_1111, out, tmp_11); // ^1111 44| | 45| 1.14k| vec256_sq(out, tmp_1111); ------------------ | | 14| 1.14k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.14k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 46| 1.14k| vec256_sq(out, out); ------------------ | | 14| 1.14k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.14k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 47| 1.14k| vec256_sq(out, out); ------------------ | | 14| 1.14k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.14k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 48| 1.14k| vec256_sq(out, out); ------------------ | | 14| 1.14k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.14k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 49| 1.14k| vec256_mul(out, out, tmp_1111); // ^11111111 50| | 51| 1.14k| vec256_sq(out, out); ------------------ | | 14| 1.14k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.14k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 52| 1.14k| vec256_sq(out, out); ------------------ | | 14| 1.14k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.14k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 53| 1.14k| vec256_mul(out, out, tmp_11); // ^1111111111 54| 1.14k| vec256_sq(out, out); ------------------ | | 14| 1.14k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.14k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 55| 1.14k| vec256_mul(out, out, in); // ^11111111111 56| | 57| 1.14k| vec256_sq(out, out); // ^111111111110 ------------------ | | 14| 1.14k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.14k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 58| 1.14k|} pk_gen.c:vec256_copy: 88| 11.0k|static inline void vec256_copy(vec256 *dest, vec256 *src) { 89| 11.0k| int i; 90| | 91| 151k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 151k|#define GFBITS 12 ------------------ | Branch (91:17): [True: 140k, False: 11.0k] ------------------ 92| 140k| dest[i] = src[i]; 93| 140k| } 94| 11.0k|} pk_gen.c:vec256_mul: 99| 5.70M|static inline void vec256_mul(vec256 *h, vec256 *f, const vec256 *g) { 100| 5.70M| vec256_mul_asm(h, f, g); ------------------ | | 13| 5.70M|#define vec256_mul_asm CRYPTO_NAMESPACE(vec256_mul_asm) | | ------------------ | | | | 4| 5.70M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 101| 5.70M|} pk_gen.c:vec256_set4x: 34| 3.85M|static inline vec256 vec256_set4x(uint64_t a0, uint64_t a1, uint64_t a2, uint64_t a3) { 35| 3.85M| return _mm256_set_epi64x(a3, a2, a1, a0); 36| 3.85M|} pk_gen.c:vec256_set1_16b: 22| 5.15G|static inline vec256 vec256_set1_16b(uint16_t a) { 23| 5.15G| return _mm256_set1_epi16(a); 24| 5.15G|} pk_gen.c:vec256_set1_32b: 26| 9.24G|static inline vec256 vec256_set1_32b(uint64_t a) { 27| 9.24G| return _mm256_set1_epi32(a); 28| 9.24G|} vec256.c:vec256_copy: 88| 6.43k|static inline void vec256_copy(vec256 *dest, vec256 *src) { 89| 6.43k| int i; 90| | 91| 88.8k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 88.8k|#define GFBITS 12 ------------------ | Branch (91:17): [True: 82.3k, False: 6.43k] ------------------ 92| 82.3k| dest[i] = src[i]; 93| 82.3k| } 94| 6.43k|} vec256.c:vec256_mul: 99| 27.0k|static inline void vec256_mul(vec256 *h, vec256 *f, const vec256 *g) { 100| 27.0k| vec256_mul_asm(h, f, g); ------------------ | | 13| 27.0k|#define vec256_mul_asm CRYPTO_NAMESPACE(vec256_mul_asm) | | ------------------ | | | | 4| 27.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 101| 27.0k|} decrypt.c:vec256_set4x: 34| 27.0k|static inline vec256 vec256_set4x(uint64_t a0, uint64_t a1, uint64_t a2, uint64_t a3) { 35| 27.0k| return _mm256_set_epi64x(a3, a2, a1, a0); 36| 27.0k|} decrypt.c:vec256_copy: 88| 1.87k|static inline void vec256_copy(vec256 *dest, vec256 *src) { 89| 1.87k| int i; 90| | 91| 25.8k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 25.8k|#define GFBITS 12 ------------------ | Branch (91:17): [True: 23.9k, False: 1.87k] ------------------ 92| 23.9k| dest[i] = src[i]; 93| 23.9k| } 94| 1.87k|} decrypt.c:vec256_mul: 99| 78.4k|static inline void vec256_mul(vec256 *h, vec256 *f, const vec256 *g) { 100| 78.4k| vec256_mul_asm(h, f, g); ------------------ | | 13| 78.4k|#define vec256_mul_asm CRYPTO_NAMESPACE(vec256_mul_asm) | | ------------------ | | | | 4| 78.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 101| 78.4k|} decrypt.c:vec256_and: 45| 698k|static inline vec256 vec256_and(vec256 a, vec256 b) { 46| 698k| return _mm256_and_si256(a, b); 47| 698k|} decrypt.c:vec256_set1_16b: 22| 936|static inline vec256 vec256_set1_16b(uint16_t a) { 23| 936| return _mm256_set1_epi16(a); 24| 936|} decrypt.c:vec256_or_reduce: 76| 27.0k|static inline vec256 vec256_or_reduce(vec256 *a) { 77| 27.0k| int i; 78| 27.0k| vec256 ret; 79| | 80| 27.0k| ret = a[0]; 81| 349k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 349k|#define GFBITS 12 ------------------ | Branch (81:17): [True: 321k, False: 27.0k] ------------------ 82| 321k| ret = vec256_or(ret, a[i]); 83| 321k| } 84| | 85| 27.0k| return ret; 86| 27.0k|} decrypt.c:vec256_or: 53| 331k|static inline vec256 vec256_or(vec256 a, vec256 b) { 54| 331k| return _mm256_or_si256(a, b); 55| 331k|} decrypt.c:vec256_xor: 49| 36.9k|static inline vec256 vec256_xor(vec256 a, vec256 b) { 50| 36.9k| return _mm256_xor_si256(a, b); 51| 36.9k|} fft.c:vec256_set4x: 34| 4.45M|static inline vec256 vec256_set4x(uint64_t a0, uint64_t a1, uint64_t a2, uint64_t a3) { 35| 4.45M| return _mm256_set_epi64x(a3, a2, a1, a0); 36| 4.45M|} fft.c:vec256_mul: 99| 71.9k|static inline void vec256_mul(vec256 *h, vec256 *f, const vec256 *g) { 100| 71.9k| vec256_mul_asm(h, f, g); ------------------ | | 13| 71.9k|#define vec256_mul_asm CRYPTO_NAMESPACE(vec256_mul_asm) | | ------------------ | | | | 4| 71.9k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 101| 71.9k|} fft.c:vec256_unpack_low_2x: 68| 143k|static inline vec256 vec256_unpack_low_2x(vec256 a, vec256 b) { 69| 143k| return _mm256_unpacklo_epi64 (a, b); 70| 143k|} fft.c:vec256_unpack_high_2x: 72| 143k|static inline vec256 vec256_unpack_high_2x(vec256 a, vec256 b) { 73| 143k| return _mm256_unpackhi_epi64 (a, b); 74| 143k|} fft.c:vec256_unpack_low: 60| 3.90M|static inline vec256 vec256_unpack_low(vec256 a, vec256 b) { 61| | return _mm256_permute2x128_si256 (a, b, 0x20); 62| 3.90M|} fft.c:vec256_unpack_high: 64| 3.71M|static inline vec256 vec256_unpack_high(vec256 a, vec256 b) { 65| | return _mm256_permute2x128_si256 (a, b, 0x31); 66| 3.71M|} fft.c:vec256_xor: 49| 3.92M|static inline vec256 vec256_xor(vec256 a, vec256 b) { 50| 3.92M| return _mm256_xor_si256(a, b); 51| 3.92M|} fft_tr.c:vec256_set4x: 34| 1.21M|static inline vec256 vec256_set4x(uint64_t a0, uint64_t a1, uint64_t a2, uint64_t a3) { 35| 1.21M| return _mm256_set_epi64x(a3, a2, a1, a0); 36| 1.21M|} fft_tr.c:vec256_mul: 99| 26.3k|static inline void vec256_mul(vec256 *h, vec256 *f, const vec256 *g) { 100| 26.3k| vec256_mul_asm(h, f, g); ------------------ | | 13| 26.3k|#define vec256_mul_asm CRYPTO_NAMESPACE(vec256_mul_asm) | | ------------------ | | | | 4| 26.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_AVX2_ ## fun | | ------------------ ------------------ 101| 26.3k|} fft_tr.c:vec256_unpack_low: 60| 663k|static inline vec256 vec256_unpack_low(vec256 a, vec256 b) { 61| | return _mm256_permute2x128_si256 (a, b, 0x20); 62| 663k|} fft_tr.c:vec256_unpack_high: 64| 663k|static inline vec256 vec256_unpack_high(vec256 a, vec256 b) { 65| | return _mm256_permute2x128_si256 (a, b, 0x31); 66| 663k|} fft_tr.c:vec256_unpack_low_2x: 68| 663k|static inline vec256 vec256_unpack_low_2x(vec256 a, vec256 b) { 69| 663k| return _mm256_unpacklo_epi64 (a, b); 70| 663k|} fft_tr.c:vec256_unpack_high_2x: 72| 663k|static inline vec256 vec256_unpack_high_2x(vec256 a, vec256 b) { 73| 663k| return _mm256_unpackhi_epi64 (a, b); 74| 663k|} fft_tr.c:vec256_xor: 49| 1.98M|static inline vec256 vec256_xor(vec256 a, vec256 b) { 50| 1.98M| return _mm256_xor_si256(a, b); 51| 1.98M|} controlbits.c:cbrecursion: 22| 6.92M|static void cbrecursion(unsigned char *out, long long pos, long long step, const int16 *pi, long long w, long long n, int32 *temp) { 23| 6.92M|#define A temp 24| 6.92M|#define B (temp+n) 25| 6.92M|#define q ((int16 *) (temp+n+n/4)) 26| | /* q can start anywhere between temp+n and temp+n/2 */ 27| | 28| 6.92M| long long x, y, i, j, k; 29| | 30| 6.92M| if (w == 1) { ------------------ | Branch (30:9): [True: 3.46M, False: 3.46M] ------------------ 31| 3.46M| out[pos >> 3] ^= pi[0] << (pos & 7); 32| 3.46M| return; 33| 3.46M| } 34| | 35| 85.8M| for (x = 0; x < n; ++x) { ------------------ | Branch (35:17): [True: 82.4M, False: 3.46M] ------------------ 36| 82.4M| A[x] = ((pi[x] ^ 1) << 16) | pi[x ^ 1]; ------------------ | | 23| 82.4M|#define A temp ------------------ 37| 82.4M| } 38| 3.46M| int32_sort(A, n); /* A = (id<<16)+pibar */ ------------------ | | 6| 3.46M|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 3.46M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(A, n); /* A = (id<<16)+pibar */ ------------------ | | 23| 3.46M|#define A temp ------------------ 39| | 40| 85.8M| for (x = 0; x < n; ++x) { ------------------ | Branch (40:17): [True: 82.4M, False: 3.46M] ------------------ 41| 82.4M| int32 Ax = A[x]; ------------------ | | 23| 82.4M|#define A temp ------------------ 42| 82.4M| int32 px = Ax & 0xffff; 43| 82.4M| int32 cx = int32_min(px, (int32)x); ------------------ | | 13| 82.4M|#define int32_min crypto_int32_min | | ------------------ | | | | 23| 82.4M|#define crypto_int32_min CRYPTO_NAMESPACE(crypto_int32_min) | | | | ------------------ | | | | | | 4| 82.4M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | | | ------------------ | | ------------------ ------------------ 44| 82.4M| B[x] = ((px) << 16) | cx; ------------------ | | 24| 82.4M|#define B (temp+n) ------------------ 45| 82.4M| } 46| | /* B = (p<<16)+c */ 47| | 48| 85.8M| for (x = 0; x < n; ++x) { ------------------ | Branch (48:17): [True: 82.4M, False: 3.46M] ------------------ 49| 82.4M| A[x] = (int32)((((uint32_t)A[x]) << 16) | x); /* A = (pibar<<16)+id */ ------------------ | | 23| 82.4M|#define A temp ------------------ A[x] = (int32)((((uint32_t)A[x]) << 16) | x); /* A = (pibar<<16)+id */ ------------------ | | 23| 82.4M|#define A temp ------------------ 50| 82.4M| } 51| 3.46M| int32_sort(A, n); /* A = (id<<16)+pibar^-1 */ ------------------ | | 6| 3.46M|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 3.46M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(A, n); /* A = (id<<16)+pibar^-1 */ ------------------ | | 23| 3.46M|#define A temp ------------------ 52| | 53| 85.8M| for (x = 0; x < n; ++x) { ------------------ | Branch (53:17): [True: 82.4M, False: 3.46M] ------------------ 54| 82.4M| A[x] = (((uint32_t)A[x]) << 16) + (B[x] >> 16); /* A = (pibar^(-1)<<16)+pibar */ ------------------ | | 23| 82.4M|#define A temp ------------------ A[x] = (((uint32_t)A[x]) << 16) + (B[x] >> 16); /* A = (pibar^(-1)<<16)+pibar */ ------------------ | | 23| 82.4M|#define A temp ------------------ A[x] = (((uint32_t)A[x]) << 16) + (B[x] >> 16); /* A = (pibar^(-1)<<16)+pibar */ ------------------ | | 24| 82.4M|#define B (temp+n) ------------------ 55| 82.4M| } 56| 3.46M| int32_sort(A, n); /* A = (id<<16)+pibar^2 */ ------------------ | | 6| 3.46M|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 3.46M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(A, n); /* A = (id<<16)+pibar^2 */ ------------------ | | 23| 3.46M|#define A temp ------------------ 57| | 58| 3.46M| if (w <= 10) { ------------------ | Branch (58:9): [True: 3.45M, False: 5.83k] ------------------ 59| 65.8M| for (x = 0; x < n; ++x) { ------------------ | Branch (59:21): [True: 62.3M, False: 3.45M] ------------------ 60| 62.3M| B[x] = ((A[x] & 0xffff) << 10) | (B[x] & 0x3ff); ------------------ | | 24| 62.3M|#define B (temp+n) ------------------ B[x] = ((A[x] & 0xffff) << 10) | (B[x] & 0x3ff); ------------------ | | 23| 62.3M|#define A temp ------------------ B[x] = ((A[x] & 0xffff) << 10) | (B[x] & 0x3ff); ------------------ | | 24| 62.3M|#define B (temp+n) ------------------ 61| 62.3M| } 62| | 63| 6.85M| for (i = 1; i < w - 1; ++i) { ------------------ | Branch (63:21): [True: 3.39M, False: 3.45M] ------------------ 64| | /* B = (p<<10)+c */ 65| | 66| 252M| for (x = 0; x < n; ++x) { ------------------ | Branch (66:25): [True: 249M, False: 3.39M] ------------------ 67| 249M| A[x] = (int32)(((B[x] & ~0x3ff) << 6) | x); /* A = (p<<16)+id */ ------------------ | | 23| 249M|#define A temp ------------------ A[x] = (int32)(((B[x] & ~0x3ff) << 6) | x); /* A = (p<<16)+id */ ------------------ | | 24| 249M|#define B (temp+n) ------------------ 68| 249M| } 69| 3.39M| int32_sort(A, n); /* A = (id<<16)+p^{-1} */ ------------------ | | 6| 3.39M|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 3.39M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(A, n); /* A = (id<<16)+p^{-1} */ ------------------ | | 23| 3.39M|#define A temp ------------------ 70| | 71| 252M| for (x = 0; x < n; ++x) { ------------------ | Branch (71:25): [True: 249M, False: 3.39M] ------------------ 72| 249M| A[x] = ((uint32_t)A[x] << 20) | B[x]; ------------------ | | 23| 249M|#define A temp ------------------ A[x] = ((uint32_t)A[x] << 20) | B[x]; ------------------ | | 23| 249M|#define A temp ------------------ A[x] = ((uint32_t)A[x] << 20) | B[x]; ------------------ | | 24| 249M|#define B (temp+n) ------------------ 73| 249M| } /* A = (p^{-1}<<20)+(p<<10)+c */ 74| 3.39M| int32_sort(A, n); /* A = (id<<20)+(pp<<10)+cp */ ------------------ | | 6| 3.39M|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 3.39M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(A, n); /* A = (id<<20)+(pp<<10)+cp */ ------------------ | | 23| 3.39M|#define A temp ------------------ 75| | 76| 252M| for (x = 0; x < n; ++x) { ------------------ | Branch (76:25): [True: 249M, False: 3.39M] ------------------ 77| 249M| int32 ppcpx = A[x] & 0xfffff; ------------------ | | 23| 249M|#define A temp ------------------ 78| 249M| int32 ppcx = (A[x] & 0xffc00) | (B[x] & 0x3ff); ------------------ | | 23| 249M|#define A temp ------------------ int32 ppcx = (A[x] & 0xffc00) | (B[x] & 0x3ff); ------------------ | | 24| 249M|#define B (temp+n) ------------------ 79| 249M| B[x] = int32_min(ppcx, ppcpx); ------------------ | | 24| 249M|#define B (temp+n) ------------------ B[x] = int32_min(ppcx, ppcpx); ------------------ | | 13| 249M|#define int32_min crypto_int32_min | | ------------------ | | | | 23| 249M|#define crypto_int32_min CRYPTO_NAMESPACE(crypto_int32_min) | | | | ------------------ | | | | | | 4| 249M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | | | ------------------ | | ------------------ ------------------ 80| 249M| } 81| 3.39M| } 82| 65.8M| for (x = 0; x < n; ++x) { ------------------ | Branch (82:21): [True: 62.3M, False: 3.45M] ------------------ 83| 62.3M| B[x] &= 0x3ff; ------------------ | | 24| 62.3M|#define B (temp+n) ------------------ 84| 62.3M| } 85| 3.45M| } else { 86| 20.0M| for (x = 0; x < n; ++x) { ------------------ | Branch (86:21): [True: 20.0M, False: 5.83k] ------------------ 87| 20.0M| B[x] = (((uint32_t)A[x]) << 16) | (B[x] & 0xffff); ------------------ | | 24| 20.0M|#define B (temp+n) ------------------ B[x] = (((uint32_t)A[x]) << 16) | (B[x] & 0xffff); ------------------ | | 23| 20.0M|#define A temp ------------------ B[x] = (((uint32_t)A[x]) << 16) | (B[x] & 0xffff); ------------------ | | 24| 20.0M|#define B (temp+n) ------------------ 88| 20.0M| } 89| | 90| 61.5k| for (i = 1; i < w - 1; ++i) { ------------------ | Branch (90:21): [True: 55.6k, False: 5.83k] ------------------ 91| | /* B = (p<<16)+c */ 92| | 93| 199M| for (x = 0; x < n; ++x) { ------------------ | Branch (93:25): [True: 199M, False: 55.6k] ------------------ 94| 199M| A[x] = (int32)((B[x] & ~0xffff) | x); ------------------ | | 23| 199M|#define A temp ------------------ A[x] = (int32)((B[x] & ~0xffff) | x); ------------------ | | 24| 199M|#define B (temp+n) ------------------ 95| 199M| } 96| 55.6k| int32_sort(A, n); /* A = (id<<16)+p^(-1) */ ------------------ | | 6| 55.6k|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 55.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(A, n); /* A = (id<<16)+p^(-1) */ ------------------ | | 23| 55.6k|#define A temp ------------------ 97| | 98| 199M| for (x = 0; x < n; ++x) { ------------------ | Branch (98:25): [True: 199M, False: 55.6k] ------------------ 99| 199M| A[x] = (((uint32_t)A[x]) << 16) | (B[x] & 0xffff); ------------------ | | 23| 199M|#define A temp ------------------ A[x] = (((uint32_t)A[x]) << 16) | (B[x] & 0xffff); ------------------ | | 23| 199M|#define A temp ------------------ A[x] = (((uint32_t)A[x]) << 16) | (B[x] & 0xffff); ------------------ | | 24| 199M|#define B (temp+n) ------------------ 100| 199M| } 101| | /* A = p^(-1)<<16+c */ 102| | 103| 55.6k| if (i < w - 2) { ------------------ | Branch (103:17): [True: 49.8k, False: 5.83k] ------------------ 104| 179M| for (x = 0; x < n; ++x) { ------------------ | Branch (104:29): [True: 179M, False: 49.8k] ------------------ 105| 179M| B[x] = (A[x] & ~0xffff) | (B[x] >> 16); ------------------ | | 24| 179M|#define B (temp+n) ------------------ B[x] = (A[x] & ~0xffff) | (B[x] >> 16); ------------------ | | 23| 179M|#define A temp ------------------ B[x] = (A[x] & ~0xffff) | (B[x] >> 16); ------------------ | | 24| 179M|#define B (temp+n) ------------------ 106| 179M| } 107| | /* B = (p^(-1)<<16)+p */ 108| 49.8k| int32_sort(B, n); /* B = (id<<16)+p^(-2) */ ------------------ | | 6| 49.8k|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 49.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(B, n); /* B = (id<<16)+p^(-2) */ ------------------ | | 24| 49.8k|#define B (temp+n) ------------------ 109| 179M| for (x = 0; x < n; ++x) { ------------------ | Branch (109:29): [True: 179M, False: 49.8k] ------------------ 110| 179M| B[x] = (((uint32_t)B[x]) << 16) | (A[x] & 0xffff); ------------------ | | 24| 179M|#define B (temp+n) ------------------ B[x] = (((uint32_t)B[x]) << 16) | (A[x] & 0xffff); ------------------ | | 24| 179M|#define B (temp+n) ------------------ B[x] = (((uint32_t)B[x]) << 16) | (A[x] & 0xffff); ------------------ | | 23| 179M|#define A temp ------------------ 111| 179M| } 112| | /* B = (p^(-2)<<16)+c */ 113| 49.8k| } 114| | 115| 55.6k| int32_sort(A, n); ------------------ | | 6| 55.6k|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 55.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(A, n); ------------------ | | 23| 55.6k|#define A temp ------------------ 116| | /* A = id<<16+cp */ 117| 199M| for (x = 0; x < n; ++x) { ------------------ | Branch (117:25): [True: 199M, False: 55.6k] ------------------ 118| 199M| int32 cpx = (B[x] & ~0xffff) | (A[x] & 0xffff); ------------------ | | 24| 199M|#define B (temp+n) ------------------ int32 cpx = (B[x] & ~0xffff) | (A[x] & 0xffff); ------------------ | | 23| 199M|#define A temp ------------------ 119| 199M| B[x] = int32_min(B[x], cpx); ------------------ | | 24| 199M|#define B (temp+n) ------------------ B[x] = int32_min(B[x], cpx); ------------------ | | 13| 199M|#define int32_min crypto_int32_min | | ------------------ | | | | 23| 199M|#define crypto_int32_min CRYPTO_NAMESPACE(crypto_int32_min) | | | | ------------------ | | | | | | 4| 199M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | | | ------------------ | | ------------------ ------------------ B[x] = int32_min(B[x], cpx); ------------------ | | 24| 199M|#define B (temp+n) ------------------ 120| 199M| } 121| 55.6k| } 122| 20.0M| for (x = 0; x < n; ++x) { ------------------ | Branch (122:21): [True: 20.0M, False: 5.83k] ------------------ 123| 20.0M| B[x] &= 0xffff; ------------------ | | 24| 20.0M|#define B (temp+n) ------------------ 124| 20.0M| } 125| 5.83k| } 126| | 127| 85.8M| for (x = 0; x < n; ++x) { ------------------ | Branch (127:17): [True: 82.4M, False: 3.46M] ------------------ 128| 82.4M| A[x] = (int32)((((int32)pi[x]) << 16) + x); ------------------ | | 23| 82.4M|#define A temp ------------------ 129| 82.4M| } 130| 3.46M| int32_sort(A, n); /* A = (id<<16)+pi^(-1) */ ------------------ | | 6| 3.46M|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 3.46M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(A, n); /* A = (id<<16)+pi^(-1) */ ------------------ | | 23| 3.46M|#define A temp ------------------ 131| | 132| 44.6M| for (j = 0; j < n / 2; ++j) { ------------------ | Branch (132:17): [True: 41.2M, False: 3.46M] ------------------ 133| 41.2M| x = 2 * j; 134| 41.2M| int32 fj = B[x] & 1; /* f[j] */ ------------------ | | 24| 41.2M|#define B (temp+n) ------------------ 135| 41.2M| int32 Fx = (int32)(x + fj); /* F[x] */ 136| 41.2M| int32 Fx1 = Fx ^ 1; /* F[x+1] */ 137| | 138| 41.2M| out[pos >> 3] ^= fj << (pos & 7); 139| 41.2M| pos += step; 140| | 141| 41.2M| B[x] = ((uint32_t)A[x] << 16) | Fx; ------------------ | | 24| 41.2M|#define B (temp+n) ------------------ B[x] = ((uint32_t)A[x] << 16) | Fx; ------------------ | | 23| 41.2M|#define A temp ------------------ 142| 41.2M| B[x + 1] = ((uint32_t)A[x + 1] << 16) | Fx1; ------------------ | | 24| 41.2M|#define B (temp+n) ------------------ B[x + 1] = ((uint32_t)A[x + 1] << 16) | Fx1; ------------------ | | 23| 41.2M|#define A temp ------------------ 143| 41.2M| } 144| | /* B = (pi^(-1)<<16)+F */ 145| | 146| 3.46M| int32_sort(B, n); /* B = (id<<16)+F(pi) */ ------------------ | | 6| 3.46M|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 3.46M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(B, n); /* B = (id<<16)+F(pi) */ ------------------ | | 24| 3.46M|#define B (temp+n) ------------------ 147| | 148| 3.46M| pos += (2 * w - 3) * step * (n / 2); 149| | 150| 44.6M| for (k = 0; k < n / 2; ++k) { ------------------ | Branch (150:17): [True: 41.2M, False: 3.46M] ------------------ 151| 41.2M| y = 2 * k; 152| 41.2M| int32 lk = B[y] & 1; /* l[k] */ ------------------ | | 24| 41.2M|#define B (temp+n) ------------------ 153| 41.2M| int32 Ly = (int32)(y + lk); /* L[y] */ 154| 41.2M| int32 Ly1 = Ly ^ 1; /* L[y+1] */ 155| | 156| 41.2M| out[pos >> 3] ^= lk << (pos & 7); 157| 41.2M| pos += step; 158| | 159| 41.2M| A[y] = (Ly << 16) | (B[y] & 0xffff); ------------------ | | 23| 41.2M|#define A temp ------------------ A[y] = (Ly << 16) | (B[y] & 0xffff); ------------------ | | 24| 41.2M|#define B (temp+n) ------------------ 160| 41.2M| A[y + 1] = (Ly1 << 16) | (B[y + 1] & 0xffff); ------------------ | | 23| 41.2M|#define A temp ------------------ A[y + 1] = (Ly1 << 16) | (B[y + 1] & 0xffff); ------------------ | | 24| 41.2M|#define B (temp+n) ------------------ 161| 41.2M| } 162| | /* A = (L<<16)+F(pi) */ 163| | 164| 3.46M| int32_sort(A, n); /* A = (id<<16)+F(pi(L)) = (id<<16)+M */ ------------------ | | 6| 3.46M|#define int32_sort CRYPTO_NAMESPACE(int32_sort) | | ------------------ | | | | 4| 3.46M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ int32_sort(A, n); /* A = (id<<16)+F(pi(L)) = (id<<16)+M */ ------------------ | | 23| 3.46M|#define A temp ------------------ 165| | 166| 3.46M| pos -= (2 * w - 2) * step * (n / 2); 167| | 168| 44.6M| for (j = 0; j < n / 2; ++j) { ------------------ | Branch (168:17): [True: 41.2M, False: 3.46M] ------------------ 169| 41.2M| q[j] = (A[2 * j] & 0xffff) >> 1; ------------------ | | 25| 41.2M|#define q ((int16 *) (temp+n+n/4)) ------------------ q[j] = (A[2 * j] & 0xffff) >> 1; ------------------ | | 23| 41.2M|#define A temp ------------------ 170| 41.2M| q[j + n / 2] = (A[2 * j + 1] & 0xffff) >> 1; ------------------ | | 25| 41.2M|#define q ((int16 *) (temp+n+n/4)) ------------------ q[j + n / 2] = (A[2 * j + 1] & 0xffff) >> 1; ------------------ | | 23| 41.2M|#define A temp ------------------ 171| 41.2M| } 172| | 173| 3.46M| cbrecursion(out, pos, step * 2, q, w - 1, n / 2, temp); ------------------ | | 25| 3.46M|#define q ((int16 *) (temp+n+n/4)) ------------------ 174| 3.46M| cbrecursion(out, pos + step, step * 2, q + n / 2, w - 1, n / 2, temp); ------------------ | | 25| 3.46M|#define q ((int16 *) (temp+n+n/4)) ------------------ 175| 3.46M|} controlbits.c:layer: 182| 23.0k|static void layer(int16_t *p, const unsigned char *cb, int s, int n) { 183| 23.0k| int i, j; 184| 23.0k| int stride = 1 << (uint8_t)(s & 0x1F); 185| 23.0k| int index = 0; 186| 23.0k| int16_t d, m; 187| | 188| 13.8M| for (i = 0; i < n; i += stride * 2) { ------------------ | Branch (188:17): [True: 13.8M, False: 23.0k] ------------------ 189| 99.7M| for (j = 0; j < stride; j++) { ------------------ | Branch (189:21): [True: 85.8M, False: 13.8M] ------------------ 190| 85.8M| d = p[ i + j ] ^ p[ i + j + stride ]; 191| 85.8M| m = (cb[ index >> 3 ] >> (index & 7)) & 1; 192| 85.8M| m = -m; 193| 85.8M| d &= m; 194| 85.8M| p[ i + j ] ^= d; 195| 85.8M| p[ i + j + stride ] ^= d; 196| 85.8M| index++; 197| 85.8M| } 198| 13.8M| } 199| 23.0k|} encrypt.c:uint16_is_smaller_declassify: 22| 615k|static inline crypto_uint16 uint16_is_smaller_declassify(uint16_t t, uint16_t u) { 23| 615k| crypto_uint16 mask = crypto_uint16_smaller_mask(t, u); ------------------ | | 21| 615k|#define crypto_uint16_smaller_mask CRYPTO_NAMESPACE(crypto_uint16_smaller_mask) | | ------------------ | | | | 4| 615k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ 24| 615k| crypto_declassify(&mask, sizeof mask); 25| 615k| return mask; 26| 615k|} encrypt.c:uint32_is_equal_declassify: 28| 545k|static inline crypto_uint32 uint32_is_equal_declassify(uint32_t t, uint32_t u) { 29| 545k| crypto_uint32 mask = crypto_uint32_equal_mask(t, u); ------------------ | | 19| 545k|#define crypto_uint32_equal_mask CRYPTO_NAMESPACE(crypto_uint32_equal_mask) | | ------------------ | | | | 4| 545k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ 30| 545k| crypto_declassify(&mask, sizeof mask); 31| 545k| return mask; 32| 545k|} gf.c:gf_sq: 52| 803k|static inline gf gf_sq(gf in) { 53| 803k| const uint32_t B[] = {0x55555555, 0x33333333, 0x0F0F0F0F, 0x00FF00FF}; 54| | 55| 803k| uint32_t x = in; 56| 803k| uint32_t t; 57| | 58| 803k| x = (x | (x << 8)) & B[3]; 59| 803k| x = (x | (x << 4)) & B[2]; 60| 803k| x = (x | (x << 2)) & B[1]; 61| 803k| x = (x | (x << 1)) & B[0]; 62| | 63| 803k| t = x & 0x7FC000; 64| 803k| x ^= t >> 9; 65| 803k| x ^= t >> 12; 66| | 67| 803k| t = x & 0x3000; 68| 803k| x ^= t >> 9; 69| 803k| x ^= t >> 12; 70| | 71| 803k| return x & ((1 << GFBITS) - 1); ------------------ | | 6| 803k|#define GFBITS 12 ------------------ 72| 803k|} pk_gen.c:uint64_is_equal_declassify: 20| 39.2M|static crypto_uint64 uint64_is_equal_declassify(uint64_t t, uint64_t u) { 21| 39.2M| crypto_uint64 mask = crypto_uint64_equal_mask(t, u); ------------------ | | 19| 39.2M|#define crypto_uint64_equal_mask CRYPTO_NAMESPACE(crypto_uint64_equal_mask) | | ------------------ | | | | 4| 39.2M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ 22| 39.2M| crypto_declassify(&mask, sizeof mask); 23| 39.2M| return mask; 24| 39.2M|} pk_gen.c:uint64_is_zero_declassify: 26| 7.07M|static crypto_uint64 uint64_is_zero_declassify(uint64_t t) { 27| 7.07M| crypto_uint64 mask = crypto_uint64_zero_mask(t); ------------------ | | 15| 7.07M|#define crypto_uint64_zero_mask CRYPTO_NAMESPACE(crypto_uint64_zero_mask) | | ------------------ | | | | 4| 7.07M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ 28| 7.07M| crypto_declassify(&mask, sizeof mask); 29| 7.07M| return mask; 30| 7.07M|} sk_gen.c:gf_is_zero_declassify: 15| 579k|static inline crypto_uint16 gf_is_zero_declassify(gf t) { 16| 579k| crypto_uint16 mask = crypto_uint16_zero_mask(t); ------------------ | | 15| 579k|#define crypto_uint16_zero_mask CRYPTO_NAMESPACE(crypto_uint16_zero_mask) | | ------------------ | | | | 4| 579k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864_CLEAN_ ## fun | | ------------------ ------------------ 17| 579k| crypto_declassify(&mask, sizeof mask); 18| 579k| return mask; 19| 579k|} pk_gen.c:uint64_sort: 20| 5.50k|static void uint64_sort(uint64_t *x, long long n) { 21| 5.50k| long long top, p, q, r, i; 22| | 23| 5.50k| if (n < 2) { ------------------ | Branch (23:9): [True: 0, False: 5.50k] ------------------ 24| 0| return; 25| 0| } 26| 5.50k| top = 1; 27| 70.3k| while (top < n - top) { ------------------ | Branch (27:12): [True: 64.8k, False: 5.50k] ------------------ 28| 64.8k| top += top; 29| 64.8k| } 30| | 31| 75.8k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (31:19): [True: 70.3k, False: 5.50k] ------------------ 32| 480M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (32:21): [True: 480M, False: 70.3k] ------------------ 33| 480M| if (!(i & p)) { ------------------ | Branch (33:17): [True: 260M, False: 219M] ------------------ 34| 260M| uint64_MINMAX(x[i], x[i + p]); ------------------ | | 11| 260M| do { \ | | 12| 260M| uint64_t c = (b) - (a); \ | | 13| 260M| c >>= 63; \ | | 14| 260M| c = -c; \ | | 15| 260M| c &= (a) ^ (b); \ | | 16| 260M| (a) ^= c; \ | | 17| 260M| (b) ^= c; \ | | 18| 260M| } while(0) | | ------------------ | | | Branch (18:13): [Folded, False: 260M] | | ------------------ ------------------ 35| 260M| } 36| 480M| } 37| 70.3k| i = 0; 38| 485k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (38:23): [True: 415k, False: 70.3k] ------------------ 39| 440M| for (; i < n - q; ++i) { ------------------ | Branch (39:20): [True: 439M, False: 415k] ------------------ 40| 439M| if (!(i & p)) { ------------------ | Branch (40:21): [True: 219M, False: 219M] ------------------ 41| 219M| uint64_t a = x[i + p]; 42| 1.54G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (42:33): [True: 1.32G, False: 219M] ------------------ 43| 1.32G| uint64_MINMAX(a, x[i + r]); ------------------ | | 11| 1.32G| do { \ | | 12| 1.32G| uint64_t c = (b) - (a); \ | | 13| 1.32G| c >>= 63; \ | | 14| 1.32G| c = -c; \ | | 15| 1.32G| c &= (a) ^ (b); \ | | 16| 1.32G| (a) ^= c; \ | | 17| 1.32G| (b) ^= c; \ | | 18| 1.32G| } while(0) | | ------------------ | | | Branch (18:13): [Folded, False: 1.32G] | | ------------------ ------------------ 44| 1.32G| } 45| 219M| x[i + p] = a; 46| 219M| } 47| 439M| } 48| 415k| } 49| 70.3k| } 50| 5.50k|} PQCLEAN_MCELIECE348864F_AVX2_load_bits: 168| 78|void load_bits(uint64_t out[][32], const unsigned char *bits) { 169| 78| int i, low, block = 0; 170| | 171| 78| uint64_t cond[64]; 172| | 173| | // 174| | 175| 546| for (low = 0; low <= 5; low++) { ------------------ | Branch (175:19): [True: 468, False: 78] ------------------ 176| 30.4k| for (i = 0; i < 64; i++) { ------------------ | Branch (176:21): [True: 29.9k, False: 468] ------------------ 177| 29.9k| cond[i] = load4(bits + block * 256 + i * 4); 178| 29.9k| } 179| 468| transpose_64x64(cond); 180| | 181| 15.4k| for (i = 0; i < 32; i++) { ------------------ | Branch (181:21): [True: 14.9k, False: 468] ------------------ 182| 14.9k| out[ block ][i] = cond[i]; 183| 14.9k| } 184| 468| block++; 185| 468| } 186| | 187| 546| for (low = 0; low <= 5; low++) { ------------------ | Branch (187:19): [True: 468, False: 78] ------------------ 188| 15.4k| for (i = 0; i < 32; i++) { ------------------ | Branch (188:21): [True: 14.9k, False: 468] ------------------ 189| 14.9k| out[ block ][i] = load8(bits + block * 256 + i * 8); 190| 14.9k| } 191| 468| block++; 192| 468| } 193| | 194| 468| for (low = 4; low >= 0; low--) { ------------------ | Branch (194:19): [True: 390, False: 78] ------------------ 195| 12.8k| for (i = 0; i < 32; i++) { ------------------ | Branch (195:21): [True: 12.4k, False: 390] ------------------ 196| 12.4k| out[ block ][i] = load8(bits + block * 256 + i * 8); 197| 12.4k| } 198| 390| block++; 199| 390| } 200| | 201| 546| for (low = 5; low >= 0; low--) { ------------------ | Branch (201:19): [True: 468, False: 78] ------------------ 202| 30.4k| for (i = 0; i < 64; i++) { ------------------ | Branch (202:21): [True: 29.9k, False: 468] ------------------ 203| 29.9k| cond[i] = load4(bits + block * 256 + i * 4); 204| 29.9k| } 205| 468| transpose_64x64(cond); 206| | 207| 15.4k| for (i = 0; i < 32; i++) { ------------------ | Branch (207:21): [True: 14.9k, False: 468] ------------------ 208| 14.9k| out[ block ][i] = cond[i]; 209| 14.9k| } 210| 468| block++; 211| 468| } 212| 78|} PQCLEAN_MCELIECE348864F_AVX2_benes: 218| 156|void benes(uint64_t *r, uint64_t cond[][32], int rev) { 219| 156| int block, inc; 220| | 221| 156| uint64_t *bs = r; 222| | 223| | // 224| | 225| 156| if (rev == 0) { ------------------ | Branch (225:9): [True: 78, False: 78] ------------------ 226| 78| block = 0; 227| 78| inc = 1; 228| 78| } else { 229| 78| block = 22; 230| 78| inc = -1; 231| 78| } 232| | 233| 156| transpose_64x64(bs); 234| | 235| 156| layer_0(bs, cond[ block ]); 236| 156| block += inc; 237| 156| layer_1(bs, cond[ block ]); 238| 156| block += inc; 239| 156| layer_2(bs, cond[ block ]); 240| 156| block += inc; 241| 156| layer_3(bs, cond[ block ]); 242| 156| block += inc; 243| 156| layer_4(bs, cond[ block ]); 244| 156| block += inc; 245| 156| layer_5(bs, cond[ block ]); 246| 156| block += inc; 247| | 248| 156| transpose_64x64(bs); 249| | 250| 156| layer_0(bs, cond[ block ]); 251| 156| block += inc; 252| 156| layer_1(bs, cond[ block ]); 253| 156| block += inc; 254| 156| layer_2(bs, cond[ block ]); 255| 156| block += inc; 256| 156| layer_3(bs, cond[ block ]); 257| 156| block += inc; 258| 156| layer_4(bs, cond[ block ]); 259| 156| block += inc; 260| 156| layer_5(bs, cond[ block ]); 261| 156| block += inc; 262| 156| layer_4(bs, cond[ block ]); 263| 156| block += inc; 264| 156| layer_3(bs, cond[ block ]); 265| 156| block += inc; 266| 156| layer_2(bs, cond[ block ]); 267| 156| block += inc; 268| 156| layer_1(bs, cond[ block ]); 269| 156| block += inc; 270| 156| layer_0(bs, cond[ block ]); 271| 156| block += inc; 272| | 273| 156| transpose_64x64(bs); 274| | 275| 156| layer_5(bs, cond[ block ]); 276| 156| block += inc; 277| 156| layer_4(bs, cond[ block ]); 278| 156| block += inc; 279| 156| layer_3(bs, cond[ block ]); 280| 156| block += inc; 281| 156| layer_2(bs, cond[ block ]); 282| 156| block += inc; 283| 156| layer_1(bs, cond[ block ]); 284| 156| block += inc; 285| 156| layer_0(bs, cond[ block ]); 286| | 287| 156| transpose_64x64(bs); 288| 156|} PQCLEAN_MCELIECE348864F_AVX2_bm: 140| 78|void bm(uint64_t out[ GFBITS ], vec128 in[ GFBITS ]) { 141| 78| uint16_t i; 142| 78| uint16_t N, L; 143| | 144| 78| uint64_t prod[ GFBITS ]; 145| 78| uint64_t in_tmp[ GFBITS ]; 146| | 147| 78| uint64_t db[ GFBITS ][ 2 ]; 148| 78| uint64_t BC_tmp[ GFBITS ][ 2 ]; 149| 78| uint64_t BC[ GFBITS ][ 2 ]; 150| | 151| 78| uint64_t mask, t; 152| | 153| 78| gf d, b, c0 = 1; 154| | 155| 78| gf coefs[SYS_T * 2]; 156| | 157| | // init 158| | 159| 78| BC[0][1] = 0; 160| 78| BC[0][0] = 1; 161| 78| BC[0][0] <<= 63; 162| | 163| 936| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 936|#define GFBITS 12 ------------------ | Branch (163:17): [True: 858, False: 78] ------------------ 164| 858| BC[i][0] = BC[i][1] = 0; 165| 858| } 166| | 167| 78| b = 1; 168| 78| L = 0; 169| | 170| | // 171| | 172| 78| get_coefs(coefs, in); 173| | 174| 1.01k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.01k|#define GFBITS 12 ------------------ | Branch (174:17): [True: 936, False: 78] ------------------ 175| 936| in_tmp[i] = 0; 176| 936| } 177| | 178| 10.0k| for (N = 0; N < SYS_T * 2; N++) { ------------------ | | 8| 10.0k|#define SYS_T 64 ------------------ | Branch (178:17): [True: 9.98k, False: 78] ------------------ 179| | // computing d 180| | 181| 9.98k| vec_mul_sp(prod, in_tmp, &BC[0][0]); 182| | 183| 9.98k| update_asm(in_tmp, coefs[N], 8); ------------------ | | 1| 9.98k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 9.98k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 184| | 185| 9.98k| d = vec_reduce_asm(prod); ------------------ | | 3| 9.98k|#define vec_reduce_asm CRYPTO_NAMESPACE(vec_reduce_asm) | | ------------------ | | | | 4| 9.98k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 186| | 187| 9.98k| t = gf_mul2(c0, coefs[N], b); ------------------ | | 13| 9.98k|#define gf_mul2 CRYPTO_NAMESPACE(gf_mul2) | | ------------------ | | | | 4| 9.98k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 188| | 189| 9.98k| d ^= t & 0xFFFFFFFF; 190| | 191| | // 3 cases 192| | 193| 9.98k| mask = mask_nonzero(d) & mask_leq(L * 2, N); 194| | 195| 129k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 129k|#define GFBITS 12 ------------------ | Branch (195:21): [True: 119k, False: 9.98k] ------------------ 196| 119k| db[i][0] = (d >> i) & 1; 197| 119k| db[i][0] = -db[i][0]; 198| 119k| db[i][1] = (b >> i) & 1; 199| 119k| db[i][1] = -db[i][1]; 200| 119k| } 201| | 202| 9.98k| vec128_mul((vec128 *) BC_tmp, (vec128 *) db, (vec128 *) BC); 203| | 204| 9.98k| vec_cmov(BC, mask); 205| | 206| 9.98k| update_asm(BC, mask & c0, 16); ------------------ | | 1| 9.98k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 9.98k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 207| | 208| 129k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 129k|#define GFBITS 12 ------------------ | Branch (208:21): [True: 119k, False: 9.98k] ------------------ 209| 119k| BC[i][1] = BC_tmp[i][0] ^ BC_tmp[i][1]; 210| 119k| } 211| | 212| 9.98k| c0 = t >> 32; 213| 9.98k| b = (d & mask) | (b & ~mask); 214| 9.98k| L = ((N + 1 - L) & mask) | (L & ~mask); 215| | 216| 9.98k| } 217| | 218| 78| c0 = gf_inv(c0); ------------------ | | 11| 78|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 78|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 219| | 220| 1.01k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.01k|#define GFBITS 12 ------------------ | Branch (220:17): [True: 936, False: 78] ------------------ 221| 936| out[i] = (c0 >> i) & 1; 222| 936| out[i] = -out[i]; 223| 936| } 224| | 225| 78| vec_mul_sp(out, out, &BC[0][0]); 226| 78|} PQCLEAN_MCELIECE348864F_AVX2_controlbitsfrompermutation: 205| 78|void controlbitsfrompermutation(unsigned char *out, const int16 *pi, long long w, long long n) { 206| 78| PQCLEAN_VLA(int32, temp, (size_t)(2 * n)); ------------------ | | 57| 78|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 207| 78| PQCLEAN_VLA(int16, pi_test, (size_t)n); ------------------ | | 57| 78|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 208| 78| int16 diff; 209| 78| int i; 210| 78| unsigned char *ptr; 211| | 212| 78| OQS_MEM_cleanse(temp, (size_t)n * 2); 213| 78| OQS_MEM_cleanse(pi_test, (size_t)n); 214| | 215| 78| while (1) { ------------------ | Branch (215:12): [True: 78, Folded] ------------------ 216| 78| OQS_MEM_cleanse(out, (size_t)((((2 * w - 1)*n / 2) + 7) / 8)); 217| 78| cbrecursion(out, 0, 1, pi, w, n, temp); 218| | 219| | // check for correctness 220| | 221| 319k| for (i = 0; i < n; i++) { ------------------ | Branch (221:21): [True: 319k, False: 78] ------------------ 222| 319k| pi_test[i] = (int16)i; 223| 319k| } 224| | 225| 78| ptr = out; 226| 1.01k| for (i = 0; i < w; i++) { ------------------ | Branch (226:21): [True: 936, False: 78] ------------------ 227| 936| layer(pi_test, ptr, i, (int32)n); 228| 936| ptr += n >> 4; 229| 936| } 230| | 231| 936| for (i = (int)(w - 2); i >= 0; i--) { ------------------ | Branch (231:32): [True: 858, False: 78] ------------------ 232| 858| layer(pi_test, ptr, i, (int32)n); 233| 858| ptr += n >> 4; 234| 858| } 235| | 236| 78| diff = 0; 237| 319k| for (i = 0; i < n; i++) { ------------------ | Branch (237:21): [True: 319k, False: 78] ------------------ 238| 319k| diff |= pi[i] ^ pi_test[i]; 239| 319k| } 240| | 241| 78| diff = crypto_int16_nonzero_mask(diff); ------------------ | | 12| 78|#define crypto_int16_nonzero_mask CRYPTO_NAMESPACE(crypto_int16_nonzero_mask) | | ------------------ | | | | 4| 78|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 242| 78| crypto_declassify(&diff, sizeof diff); 243| 78| if (diff == 0) { ------------------ | Branch (243:13): [True: 78, False: 0] ------------------ 244| 78| break; 245| 78| } 246| 78| } 247| 78|} PQCLEAN_MCELIECE348864F_AVX2_crypto_int16_negative_mask: 3| 156|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 4| 156| return crypto_int16_x >> 15; 5| 156|} PQCLEAN_MCELIECE348864F_AVX2_crypto_int16_nonzero_mask: 7| 78|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 8| 78| return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 78|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 78|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 78|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 78|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 9| 78|} PQCLEAN_MCELIECE348864F_AVX2_crypto_int32_negative_mask: 3| 21.0M|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 4| 21.0M| return crypto_int32_x >> 31; 5| 21.0M|} PQCLEAN_MCELIECE348864F_AVX2_crypto_int32_min: 37| 21.0M|crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x, crypto_int32 crypto_int32_y) { 38| 21.0M| crypto_int32 crypto_int32_xy = crypto_int32_y ^ crypto_int32_x; 39| 21.0M| crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x; 40| 21.0M| crypto_int32_z ^= crypto_int32_xy & (crypto_int32_z ^ crypto_int32_y); 41| 21.0M| crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); ------------------ | | 9| 21.0M|#define crypto_int32_negative_mask CRYPTO_NAMESPACE(crypto_int32_negative_mask) | | ------------------ | | | | 4| 21.0M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 42| 21.0M| crypto_int32_z &= crypto_int32_xy; 43| 21.0M| return crypto_int32_x ^ crypto_int32_z; 44| 21.0M|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint16_signed_negative_mask: 3| 32.5k|crypto_uint16_signed crypto_uint16_signed_negative_mask(crypto_uint16_signed crypto_uint16_signed_x) { 4| 32.5k| return crypto_uint16_signed_x >> 15; 5| 32.5k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint16_nonzero_mask: 7| 6.33k|crypto_uint16 crypto_uint16_nonzero_mask(crypto_uint16 crypto_uint16_x) { 8| 6.33k| return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 6.33k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 6.33k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 6.33k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 6.33k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 9| 6.33k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint16_zero_mask: 11| 6.33k|crypto_uint16 crypto_uint16_zero_mask(crypto_uint16 crypto_uint16_x) { 12| 6.33k| return ~crypto_uint16_nonzero_mask(crypto_uint16_x); ------------------ | | 13| 6.33k|#define crypto_uint16_nonzero_mask CRYPTO_NAMESPACE(crypto_uint16_nonzero_mask) | | ------------------ | | | | 4| 6.33k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 13| 6.33k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint16_smaller_mask: 24| 19.8k|crypto_uint16 crypto_uint16_smaller_mask(crypto_uint16 crypto_uint16_x, crypto_uint16 crypto_uint16_y) { 25| 19.8k| crypto_uint16 crypto_uint16_xy = crypto_uint16_x ^ crypto_uint16_y; 26| 19.8k| crypto_uint16 crypto_uint16_z = crypto_uint16_x - crypto_uint16_y; 27| 19.8k| crypto_uint16_z ^= crypto_uint16_xy & (crypto_uint16_z ^ crypto_uint16_x ^ (((crypto_uint16) 1) << 15)); 28| 19.8k| return crypto_uint16_signed_negative_mask(crypto_uint16_z); ------------------ | | 11| 19.8k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 19.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 29| 19.8k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint32_signed_negative_mask: 3| 33.5k|crypto_uint32_signed crypto_uint32_signed_negative_mask(crypto_uint32_signed crypto_uint32_signed_x) { 4| 33.5k| return crypto_uint32_signed_x >> 31; 5| 33.5k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint32_nonzero_mask: 7| 16.7k|crypto_uint32 crypto_uint32_nonzero_mask(crypto_uint32 crypto_uint32_x) { 8| 16.7k| return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 16.7k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 16.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 16.7k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 16.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 9| 16.7k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint32_unequal_mask: 15| 16.7k|crypto_uint32 crypto_uint32_unequal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 16| 16.7k| crypto_uint32 crypto_uint32_xy = crypto_uint32_x ^ crypto_uint32_y; 17| 16.7k| return crypto_uint32_nonzero_mask(crypto_uint32_xy); ------------------ | | 13| 16.7k|#define crypto_uint32_nonzero_mask CRYPTO_NAMESPACE(crypto_uint32_nonzero_mask) | | ------------------ | | | | 4| 16.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 18| 16.7k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint32_equal_mask: 20| 16.7k|crypto_uint32 crypto_uint32_equal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 21| 16.7k| return ~crypto_uint32_unequal_mask(crypto_uint32_x, crypto_uint32_y); ------------------ | | 17| 16.7k|#define crypto_uint32_unequal_mask CRYPTO_NAMESPACE(crypto_uint32_unequal_mask) | | ------------------ | | | | 4| 16.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 22| 16.7k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint64_signed_negative_mask: 3| 819k|crypto_uint64_signed crypto_uint64_signed_negative_mask(crypto_uint64_signed crypto_uint64_signed_x) { 4| 819k| return crypto_uint64_signed_x >> 63; 5| 819k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint64_nonzero_mask: 7| 409k|crypto_uint64 crypto_uint64_nonzero_mask(crypto_uint64 crypto_uint64_x) { 8| 409k| return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 409k|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 409k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 409k|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 409k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 9| 409k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint64_zero_mask: 11| 62.4k|crypto_uint64 crypto_uint64_zero_mask(crypto_uint64 crypto_uint64_x) { 12| 62.4k| return ~crypto_uint64_nonzero_mask(crypto_uint64_x); ------------------ | | 13| 62.4k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 62.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 13| 62.4k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint64_unequal_mask: 15| 347k|crypto_uint64 crypto_uint64_unequal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 16| 347k| crypto_uint64 crypto_uint64_xy = crypto_uint64_x ^ crypto_uint64_y; 17| 347k| return crypto_uint64_nonzero_mask(crypto_uint64_xy); ------------------ | | 13| 347k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 347k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 18| 347k|} PQCLEAN_MCELIECE348864F_AVX2_crypto_uint64_equal_mask: 20| 347k|crypto_uint64 crypto_uint64_equal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 21| 347k| return ~crypto_uint64_unequal_mask(crypto_uint64_x, crypto_uint64_y); ------------------ | | 17| 347k|#define crypto_uint64_unequal_mask CRYPTO_NAMESPACE(crypto_uint64_unequal_mask) | | ------------------ | | | | 4| 347k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 22| 347k|} PQCLEAN_MCELIECE348864F_AVX2_decrypt: 171| 78|int decrypt(unsigned char *e, const unsigned char *sk, const unsigned char *s) { 172| 78| int i; 173| | 174| 78| uint16_t check_synd; 175| 78| uint16_t check_weight; 176| | 177| 78| vec256 inv[ 16 ][ GFBITS ]; 178| 78| vec256 scaled[ 16 ][ GFBITS ]; 179| 78| vec256 eval[16][ GFBITS ]; 180| | 181| 78| vec128 error128[ 32 ]; 182| 78| vec256 error256[ 16 ]; 183| | 184| 78| vec128 s_priv[ GFBITS ]; 185| 78| vec128 s_priv_cmp[ GFBITS ]; 186| 78| uint64_t locator[ GFBITS ]; 187| | 188| 78| vec128 recv128[ 32 ]; 189| 78| vec256 recv256[ 16 ]; 190| 78| vec256 allone; 191| | 192| 78| uint64_t bits_int[23][32]; 193| | 194| | // Berlekamp decoder 195| | 196| 78| preprocess(recv128, s); 197| | 198| 78| load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 10| 78|#define load_bits CRYPTO_NAMESPACE(load_bits) | | ------------------ | | | | 4| 78|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 11| 78|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 78|#define SYS_T 64 | | ------------------ ------------------ 199| 78| benes((uint64_t *) recv128, bits_int, 1); ------------------ | | 9| 78|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 78|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 200| | 201| 78| reformat_128to256(recv256, recv128); 202| | 203| 78| scaling(scaled, inv, sk, recv256); 204| 78| fft_tr(s_priv, scaled); ------------------ | | 9| 78|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 78|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 205| 78| bm(locator, s_priv); ------------------ | | 10| 78|#define bm CRYPTO_NAMESPACE(bm) | | ------------------ | | | | 4| 78|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 78| fft(eval, locator); ------------------ | | 10| 78|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 78|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| | // reencryption and weight check 210| | 211| 78| allone = vec256_set1_16b(0xFFFF); 212| | 213| 1.32k| for (i = 0; i < 16; i++) { ------------------ | Branch (213:17): [True: 1.24k, False: 78] ------------------ 214| 1.24k| error256[i] = vec256_or_reduce(eval[i]); 215| 1.24k| error256[i] = vec256_xor(error256[i], allone); 216| 1.24k| } 217| | 218| 78| scaling_inv(scaled, inv, error256); 219| 78| fft_tr(s_priv_cmp, scaled); ------------------ | | 9| 78|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 78|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 220| | 221| 78| check_synd = synd_cmp(s_priv, s_priv_cmp); 222| | 223| | // 224| | 225| 78| reformat_256to128(error128, error256); 226| 78| benes((uint64_t *) error128, bits_int, 0); ------------------ | | 9| 78|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 78|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 227| | 228| 78| postprocess(e, error128); 229| | 230| 78| check_weight = weight_check(e, error128); 231| | 232| 78| return 1 - (check_synd & check_weight); 233| 78|} PQCLEAN_MCELIECE348864F_AVX2_encrypt: 114| 78|void encrypt(unsigned char *s, const unsigned char *pk, unsigned char *e) { 115| 78| gen_e(e); 116| | 117| 78| syndrome_asm(s, pk, e); ------------------ | | 1| 78|#define syndrome_asm CRYPTO_NAMESPACE(syndrome_asm) | | ------------------ | | | | 4| 78|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 118| 78|} PQCLEAN_MCELIECE348864F_AVX2_fft: 171| 255|void fft(vec256 out[][ GFBITS ], uint64_t *in) { 172| 255| radix_conversions(in); 173| 255| butterflies(out, in); 174| 255|} PQCLEAN_MCELIECE348864F_AVX2_fft_tr: 354| 156|void fft_tr(vec128 out[GFBITS], vec256 in[][ GFBITS ]) { 355| 156| butterflies_tr(out, in); 356| 156| radix_conversions_tr(out); 357| 156|} PQCLEAN_MCELIECE348864F_AVX2_gf_mul: 22| 437k|gf gf_mul(gf in0, gf in1) { 23| 437k| int i; 24| | 25| 437k| uint32_t tmp; 26| 437k| uint32_t t0; 27| 437k| uint32_t t1; 28| 437k| uint32_t t; 29| | 30| 437k| t0 = in0; 31| 437k| t1 = in1; 32| | 33| 437k| tmp = t0 * (t1 & 1); 34| | 35| 5.25M| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 5.25M|#define GFBITS 12 ------------------ | Branch (35:17): [True: 4.81M, False: 437k] ------------------ 36| 4.81M| tmp ^= (t0 * (t1 & (1 << i))); 37| 4.81M| } 38| | 39| 437k| t = tmp & 0x7FC000; 40| 437k| tmp ^= t >> 9; 41| 437k| tmp ^= t >> 12; 42| | 43| 437k| t = tmp & 0x3000; 44| 437k| tmp ^= t >> 9; 45| 437k| tmp ^= t >> 12; 46| | 47| 437k| return tmp & ((1 << GFBITS) - 1); ------------------ | | 6| 437k|#define GFBITS 12 ------------------ 48| 437k|} PQCLEAN_MCELIECE348864F_AVX2_gf_inv: 74| 6.41k|gf gf_inv(gf in) { 75| 6.41k| gf tmp_11; 76| 6.41k| gf tmp_1111; 77| | 78| 6.41k| gf out = in; 79| | 80| 6.41k| out = gf_sq(out); 81| 6.41k| tmp_11 = gf_mul(out, in); // 11 ------------------ | | 14| 6.41k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 6.41k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 82| | 83| 6.41k| out = gf_sq(tmp_11); 84| 6.41k| out = gf_sq(out); 85| 6.41k| tmp_1111 = gf_mul(out, tmp_11); // 1111 ------------------ | | 14| 6.41k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 6.41k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 86| | 87| 6.41k| out = gf_sq(tmp_1111); 88| 6.41k| out = gf_sq(out); 89| 6.41k| out = gf_sq(out); 90| 6.41k| out = gf_sq(out); 91| 6.41k| out = gf_mul(out, tmp_1111); // 11111111 ------------------ | | 14| 6.41k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 6.41k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 92| | 93| 6.41k| out = gf_sq(out); 94| 6.41k| out = gf_sq(out); 95| 6.41k| out = gf_mul(out, tmp_11); // 1111111111 ------------------ | | 14| 6.41k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 6.41k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 96| | 97| 6.41k| out = gf_sq(out); 98| 6.41k| out = gf_mul(out, in); // 11111111111 ------------------ | | 14| 6.41k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 6.41k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 99| | 100| 6.41k| return gf_sq(out); // 111111111110 101| 6.41k|} bm.c:PQCLEAN_MCELIECE348864F_AVX2_gf_mul2: 32| 9.98k|static inline uint64_t gf_mul2(gf a, gf b0, gf b1) { 33| 9.98k| int i; 34| | 35| 9.98k| uint64_t tmp = 0; 36| 9.98k| uint64_t t0; 37| 9.98k| uint64_t t1; 38| 9.98k| uint64_t t; 39| 9.98k| uint64_t mask = 0x0000000100000001; 40| | 41| 9.98k| t0 = a; 42| 9.98k| t1 = b1; 43| 9.98k| t1 = (t1 << 32) | b0; 44| | 45| 129k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 129k|#define GFBITS 12 ------------------ | Branch (45:17): [True: 119k, False: 9.98k] ------------------ 46| 119k| tmp ^= t0 * (t1 & mask); 47| 119k| mask += mask; 48| 119k| } 49| | 50| | // 51| | 52| 9.98k| t = tmp & 0x007FC000007FC000; 53| 9.98k| tmp ^= (t >> 9) ^ (t >> 12); 54| | 55| 9.98k| t = tmp & 0x0000300000003000; 56| 9.98k| tmp ^= (t >> 9) ^ (t >> 12); 57| | 58| 9.98k| return tmp & 0x00000FFF00000FFF; 59| 9.98k|} pk_gen.c:PQCLEAN_MCELIECE348864F_AVX2_int32_sort: 21| 78|static void int32_sort(int32_t *x, long long n) { 22| 78| long long top, p, q, r, i; 23| | 24| 78| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 78] ------------------ 25| 0| return; 26| 0| } 27| 78| top = 1; 28| 780| while (top < n - top) { ------------------ | Branch (28:12): [True: 702, False: 78] ------------------ 29| 702| top += top; 30| 702| } 31| | 32| 858| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 780, False: 78] ------------------ 33| 520k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 519k, False: 780] ------------------ 34| 519k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 279k, False: 239k] ------------------ 35| 279k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 279k| do { \ | | 12| 279k| int32_t ab = (b) ^ (a); \ | | 13| 279k| int32_t c = (b) - (a); \ | | 14| 279k| c ^= ab & ((c) ^ (b)); \ | | 15| 279k| c >>= 31; \ | | 16| 279k| c &= ab; \ | | 17| 279k| (a) ^= c; \ | | 18| 279k| (b) ^= c; \ | | 19| 279k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 279k] | | ------------------ ------------------ 36| 279k| } 37| 519k| } 38| 780| i = 0; 39| 4.29k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 3.51k, False: 780] ------------------ 40| 462k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 459k, False: 3.51k] ------------------ 41| 459k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 239k, False: 219k] ------------------ 42| 239k| int32_t a = x[i + p]; 43| 1.27M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 1.03M, False: 239k] ------------------ 44| 1.03M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 1.03M| do { \ | | 12| 1.03M| int32_t ab = (b) ^ (a); \ | | 13| 1.03M| int32_t c = (b) - (a); \ | | 14| 1.03M| c ^= ab & ((c) ^ (b)); \ | | 15| 1.03M| c >>= 31; \ | | 16| 1.03M| c &= ab; \ | | 17| 1.03M| (a) ^= c; \ | | 18| 1.03M| (b) ^= c; \ | | 19| 1.03M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.03M] | | ------------------ ------------------ 45| 1.03M| } 46| 239k| x[i + p] = a; 47| 239k| } 48| 459k| } 49| 3.51k| } 50| 780| } 51| 78|} controlbits.c:PQCLEAN_MCELIECE348864F_AVX2_int32_sort: 21| 1.27M|static void int32_sort(int32_t *x, long long n) { 22| 1.27M| long long top, p, q, r, i; 23| | 24| 1.27M| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 1.27M] ------------------ 25| 0| return; 26| 0| } 27| 1.27M| top = 1; 28| 4.46M| while (top < n - top) { ------------------ | Branch (28:12): [True: 3.18M, False: 1.27M] ------------------ 29| 3.18M| top += top; 30| 3.18M| } 31| | 32| 5.73M| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 4.46M, False: 1.27M] ------------------ 33| 470M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 466M, False: 4.46M] ------------------ 34| 466M| if (!(i & p)) { ------------------ | Branch (34:17): [True: 263M, False: 202M] ------------------ 35| 263M| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 263M| do { \ | | 12| 263M| int32_t ab = (b) ^ (a); \ | | 13| 263M| int32_t c = (b) - (a); \ | | 14| 263M| c ^= ab & ((c) ^ (b)); \ | | 15| 263M| c >>= 31; \ | | 16| 263M| c &= ab; \ | | 17| 263M| (a) ^= c; \ | | 18| 263M| (b) ^= c; \ | | 19| 263M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 263M] | | ------------------ ------------------ 36| 263M| } 37| 466M| } 38| 4.46M| i = 0; 39| 12.0M| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 7.56M, False: 4.46M] ------------------ 40| 413M| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 405M, False: 7.56M] ------------------ 41| 405M| if (!(i & p)) { ------------------ | Branch (41:21): [True: 202M, False: 202M] ------------------ 42| 202M| int32_t a = x[i + p]; 43| 1.12G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 921M, False: 202M] ------------------ 44| 921M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 921M| do { \ | | 12| 921M| int32_t ab = (b) ^ (a); \ | | 13| 921M| int32_t c = (b) - (a); \ | | 14| 921M| c ^= ab & ((c) ^ (b)); \ | | 15| 921M| c >>= 31; \ | | 16| 921M| c &= ab; \ | | 17| 921M| (a) ^= c; \ | | 18| 921M| (b) ^= c; \ | | 19| 921M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 921M] | | ------------------ ------------------ 45| 921M| } 46| 202M| x[i + p] = a; 47| 202M| } 48| 405M| } 49| 7.56M| } 50| 4.46M| } 51| 1.27M|} encrypt.c:PQCLEAN_MCELIECE348864F_AVX2_int32_sort: 21| 266|static void int32_sort(int32_t *x, long long n) { 22| 266| long long top, p, q, r, i; 23| | 24| 266| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 266] ------------------ 25| 0| return; 26| 0| } 27| 266| top = 1; 28| 1.59k| while (top < n - top) { ------------------ | Branch (28:12): [True: 1.33k, False: 266] ------------------ 29| 1.33k| top += top; 30| 1.33k| } 31| | 32| 1.86k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 1.59k, False: 266] ------------------ 33| 86.9k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 85.3k, False: 1.59k] ------------------ 34| 85.3k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 51.0k, False: 34.3k] ------------------ 35| 51.0k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 51.0k| do { \ | | 12| 51.0k| int32_t ab = (b) ^ (a); \ | | 13| 51.0k| int32_t c = (b) - (a); \ | | 14| 51.0k| c ^= ab & ((c) ^ (b)); \ | | 15| 51.0k| c >>= 31; \ | | 16| 51.0k| c &= ab; \ | | 17| 51.0k| (a) ^= c; \ | | 18| 51.0k| (b) ^= c; \ | | 19| 51.0k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 51.0k] | | ------------------ ------------------ 36| 51.0k| } 37| 85.3k| } 38| 1.59k| i = 0; 39| 5.58k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 3.99k, False: 1.59k] ------------------ 40| 72.6k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 68.6k, False: 3.99k] ------------------ 41| 68.6k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 34.3k, False: 34.3k] ------------------ 42| 34.3k| int32_t a = x[i + p]; 43| 127k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 93.3k, False: 34.3k] ------------------ 44| 93.3k| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 93.3k| do { \ | | 12| 93.3k| int32_t ab = (b) ^ (a); \ | | 13| 93.3k| int32_t c = (b) - (a); \ | | 14| 93.3k| c ^= ab & ((c) ^ (b)); \ | | 15| 93.3k| c >>= 31; \ | | 16| 93.3k| c &= ab; \ | | 17| 93.3k| (a) ^= c; \ | | 18| 93.3k| (b) ^= c; \ | | 19| 93.3k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 93.3k] | | ------------------ ------------------ 45| 93.3k| } 46| 34.3k| x[i + p] = a; 47| 34.3k| } 48| 68.6k| } 49| 3.99k| } 50| 1.59k| } 51| 266|} PQCLEAN_MCELIECE348864F_AVX2_crypto_kem_enc: 22| 78|) { 23| 78| unsigned char e[ SYS_N / 8 ]; 24| 78| unsigned char one_ec[ 1 + SYS_N / 8 + SYND_BYTES ] = {1}; 25| | 26| | // 27| | 28| 78| encrypt(c, pk, e); ------------------ | | 9| 78|#define encrypt CRYPTO_NAMESPACE(encrypt) | | ------------------ | | | | 4| 78|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 29| | 30| 78| memcpy(one_ec + 1, e, SYS_N / 8); ------------------ | | 7| 78|#define SYS_N 3488 ------------------ 31| 78| memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 7| 78|#define SYS_N 3488 ------------------ memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 17| 78|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 78|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 78|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 78|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ 32| | 33| 78| crypto_hash_32b(key, one_ec, sizeof(one_ec)); ------------------ | | 7| 78| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 78|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 34| | 35| 78| return 0; 36| 78|} PQCLEAN_MCELIECE348864F_AVX2_crypto_kem_dec: 42| 78|) { 43| 78| int i; 44| | 45| 78| unsigned char ret_decrypt = 0; 46| | 47| 78| uint16_t m; 48| | 49| 78| unsigned char e[ SYS_N / 8 ]; 50| 78| unsigned char preimage[ 1 + SYS_N / 8 + SYND_BYTES ]; 51| 78| unsigned char *x = preimage; 52| 78| const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 11| 78|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 78|#define SYS_T 64 | | ------------------ ------------------ const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 10| 78|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 78|#define GFBITS 12 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 78|#define GFBITS 12 | | ------------------ ------------------ 53| | 54| | // 55| | 56| 78| ret_decrypt = (unsigned char)decrypt(e, sk + 40, c); ------------------ | | 9| 78|#define decrypt CRYPTO_NAMESPACE(decrypt) | | ------------------ | | | | 4| 78|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 57| | 58| 78| m = ret_decrypt; 59| 78| m -= 1; 60| 78| m >>= 8; 61| | 62| 78| *x++ = m & 1; 63| 34.0k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 34.0k|#define SYS_N 3488 ------------------ | Branch (63:17): [True: 34.0k, False: 78] ------------------ 64| 34.0k| *x++ = (~m & s[i]) | (m & e[i]); 65| 34.0k| } 66| | 67| 7.56k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 7.56k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 7.56k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 7.56k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 7.56k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (67:17): [True: 7.48k, False: 78] ------------------ 68| 7.48k| *x++ = c[i]; 69| 7.48k| } 70| | 71| 78| crypto_hash_32b(key, preimage, sizeof(preimage)); ------------------ | | 7| 78| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 78|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 72| | 73| 78| return 0; 74| 78|} PQCLEAN_MCELIECE348864F_AVX2_crypto_kem_keypair: 80| 78|) { 81| 78| int i; 82| 78| unsigned char seed[ 33 ] = {64}; 83| 78| unsigned char r[ SYS_N / 8 + (1 << GFBITS)*sizeof(uint32_t) + SYS_T * 2 + 32 ]; 84| 78| unsigned char *rp, *skp; 85| 78| uint64_t pivots; 86| | 87| 78| gf f[ SYS_T ]; // element in GF(2^mt) 88| 78| gf irr[ SYS_T ]; // Goppa polynomial 89| 78| uint32_t perm[ 1 << GFBITS ]; // random permutation as 32-bit integers 90| 78| int16_t pi[ 1 << GFBITS ]; // random permutation 91| | 92| 78| randombytes(seed + 1, 32); ------------------ | | 8| 78|#define randombytes OQS_randombytes ------------------ 93| | 94| 99| while (1) { ------------------ | Branch (94:12): [True: 99, Folded] ------------------ 95| 99| rp = &r[ sizeof(r) - 32 ]; 96| 99| skp = sk; 97| | 98| | // expanding and updating the seed 99| | 100| 99| shake(r, sizeof(r), seed, 33); ------------------ | | 10| 99| shake256(out, outlen, in, inlen) | | ------------------ | | | | 12| 99|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 101| 99| memcpy(skp, seed + 1, 32); 102| 99| skp += 32 + 8; 103| 99| memcpy(seed + 1, &r[ sizeof(r) - 32 ], 32); 104| | 105| | // generating irreducible polynomial 106| | 107| 99| rp -= sizeof(f); 108| | 109| 6.43k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 6.43k|#define SYS_T 64 ------------------ | Branch (109:21): [True: 6.33k, False: 99] ------------------ 110| 6.33k| f[i] = load_gf(rp + i * 2); 111| 6.33k| } 112| | 113| 99| if (genpoly_gen(irr, f)) { ------------------ | | 9| 99|#define genpoly_gen CRYPTO_NAMESPACE(genpoly_gen) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ | Branch (113:13): [True: 0, False: 99] ------------------ 114| 0| continue; 115| 0| } 116| | 117| 6.43k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 6.43k|#define SYS_T 64 ------------------ | Branch (117:21): [True: 6.33k, False: 99] ------------------ 118| 6.33k| store_gf(skp + i * 2, irr[i]); 119| 6.33k| } 120| | 121| 99| skp += IRR_BYTES; ------------------ | | 11| 99|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 99|#define SYS_T 64 | | ------------------ ------------------ 122| | 123| | // generating permutation 124| | 125| 99| rp -= sizeof(perm); 126| | 127| 405k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 405k|#define GFBITS 12 ------------------ | Branch (127:21): [True: 405k, False: 99] ------------------ 128| 405k| perm[i] = load4(rp + i * 4); 129| 405k| } 130| | 131| 99| if (pk_gen(pk, skp - IRR_BYTES, perm, pi, &pivots)) { ------------------ | | 9| 99|#define pk_gen CRYPTO_NAMESPACE(pk_gen) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ if (pk_gen(pk, skp - IRR_BYTES, perm, pi, &pivots)) { ------------------ | | 11| 99|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 99|#define SYS_T 64 | | ------------------ ------------------ | Branch (131:13): [True: 21, False: 78] ------------------ 132| 21| continue; 133| 21| } 134| | 135| 78| controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 10| 78|#define controlbitsfrompermutation CRYPTO_NAMESPACE(controlbitsfrompermutation) | | ------------------ | | | | 4| 78|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 78|#define GFBITS 12 ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 78|#define GFBITS 12 ------------------ 136| 78| skp += COND_BYTES; ------------------ | | 10| 78|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 78|#define GFBITS 12 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 78|#define GFBITS 12 | | ------------------ ------------------ 137| | 138| | // storing the random string s 139| | 140| 78| rp -= SYS_N / 8; ------------------ | | 7| 78|#define SYS_N 3488 ------------------ 141| 78| memcpy(skp, rp, SYS_N / 8); ------------------ | | 7| 78|#define SYS_N 3488 ------------------ 142| | 143| | // storing positions of the 32 pivots 144| | 145| 78| store8(sk + 32, pivots); 146| | 147| 78| break; 148| 99| } 149| | 150| 78| return 0; 151| 78|} PQCLEAN_MCELIECE348864F_AVX2_pk_gen: 316| 99|int pk_gen(unsigned char *pk, const unsigned char *irr, const uint32_t *perm, int16_t *pi, uint64_t *pivots) { 317| 99| int i, j, k, b; 318| 99| int row, c; 319| | 320| 99| union { 321| 99| uint64_t w[ PK_NROWS ][ (nBlocks_I + 1) * 4 ]; 322| 99| vec256 v[ PK_NROWS ][ nBlocks_I + 1 ]; 323| 99| } mat; 324| | 325| 99| union { 326| 99| uint64_t w[ PK_NROWS ][ par_width * 4 ]; 327| 99| vec256 v[ PK_NROWS ][ par_width ]; 328| 99| } par; 329| | 330| 99| uint16_t m; 331| 99| vec256 mm; 332| | 333| 99| uint64_t sk_int[ GFBITS ]; 334| | 335| 99| vec256 consts[ 16 ][ GFBITS ]; 336| 99| vec256 eval[ 16 ][ GFBITS ]; 337| 99| vec256 prod[ 16 ][ GFBITS ]; 338| 99| vec256 tmp[ GFBITS ]; 339| | 340| 99| uint64_t list[1 << GFBITS]; 341| 99| uint64_t one = 1; 342| 99| uint64_t t; 343| | 344| 99| uint16_t ind[ PK_NROWS ]; 345| 99| uint16_t ind_inv[ PK_NROWS ]; 346| | 347| | // compute the inverses 348| | 349| 99| irr_load(sk_int, irr); 350| | 351| 99| fft(eval, sk_int); ------------------ | | 10| 99|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 352| | 353| 99| vec256_copy(prod[0], eval[0]); 354| | 355| 1.58k| for (i = 1; i < 16; i++) { ------------------ | Branch (355:17): [True: 1.48k, False: 99] ------------------ 356| 1.48k| vec256_mul(prod[i], prod[i - 1], eval[i]); 357| 1.48k| } 358| | 359| 99| vec256_inv(tmp, prod[15]); ------------------ | | 11| 99|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 99|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 360| | 361| 1.58k| for (i = 14; i >= 0; i--) { ------------------ | Branch (361:18): [True: 1.48k, False: 99] ------------------ 362| 1.48k| vec256_mul(prod[i + 1], prod[i], tmp); 363| 1.48k| vec256_mul(tmp, tmp, eval[i + 1]); 364| 1.48k| } 365| | 366| 99| vec256_copy(prod[0], tmp); 367| | 368| | // fill matrix 369| | 370| 99| de_bitslicing(list, prod); 371| | 372| 405k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 405k|#define GFBITS 12 ------------------ | Branch (372:17): [True: 405k, False: 99] ------------------ 373| 405k| list[i] <<= GFBITS; ------------------ | | 6| 405k|#define GFBITS 12 ------------------ 374| 405k| list[i] |= i; 375| 405k| list[i] |= ((uint64_t) perm[i]) << 31; 376| 405k| } 377| | 378| 99| uint64_sort(list, 1 << GFBITS); ------------------ | | 6| 99|#define GFBITS 12 ------------------ 379| | 380| 347k| for (i = 1; i < (1 << GFBITS); i++) { ------------------ | | 6| 347k|#define GFBITS 12 ------------------ | Branch (380:17): [True: 347k, False: 78] ------------------ 381| 347k| if (uint64_is_equal_declassify(list[i - 1] >> 31, list[i] >> 31)) { ------------------ | Branch (381:13): [True: 21, False: 347k] ------------------ 382| 21| return -1; 383| 21| } 384| 347k| } 385| | 386| 78| to_bitslicing_2x(consts, prod, list); 387| | 388| 319k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 319k|#define GFBITS 12 ------------------ | Branch (388:17): [True: 319k, False: 78] ------------------ 389| 319k| pi[i] = list[i] & GFMASK; ------------------ | | 19| 319k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 319k|#define GFBITS 12 | | ------------------ ------------------ 390| 319k| } 391| | 392| 390| for (j = 0; j < nBlocks_I + 1; j++) { ------------------ | | 33| 390|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 390|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 390|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 390|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (392:17): [True: 312, False: 78] ------------------ 393| 4.05k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 4.05k|#define GFBITS 12 ------------------ | Branch (393:21): [True: 3.74k, False: 312] ------------------ 394| 3.74k| mat.v[ k ][ j ] = prod[ j ][ k ]; 395| 3.74k| } 396| 312| } 397| | 398| 4.99k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 4.99k|#define SYS_T 64 ------------------ | Branch (398:17): [True: 4.91k, False: 78] ------------------ 399| 24.5k| for (j = 0; j < nBlocks_I + 1; j++) { ------------------ | | 33| 24.5k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 24.5k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 24.5k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 24.5k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (399:21): [True: 19.6k, False: 4.91k] ------------------ 400| 19.6k| vec256_mul(prod[j], prod[j], consts[j]); 401| | 402| 255k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 255k|#define GFBITS 12 ------------------ | Branch (402:25): [True: 235k, False: 19.6k] ------------------ 403| 235k| mat.v[ i * GFBITS + k ][ j ] = prod[ j ][ k ]; ------------------ | | 6| 235k|#define GFBITS 12 ------------------ 404| 235k| } 405| 19.6k| } 406| 4.91k| } 407| | 408| | // Gaussian elimination + column swaps to obtain L, U, and P such that LP M = U 409| | // L and U are stored in the space of M 410| | // P is stored in ind 411| | 412| 59.9k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 59.9k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 59.9k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 59.9k|#define GFBITS 12 | | ------------------ ------------------ | Branch (412:17): [True: 59.9k, False: 78] ------------------ 413| 59.9k| ind_inv[i] = ind[ i ] = i; 414| 59.9k| } 415| | 416| 59.9k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 59.9k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 59.9k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 59.9k|#define GFBITS 12 | | ------------------ ------------------ | Branch (416:19): [True: 59.9k, False: 78] ------------------ 417| 59.9k| i = row >> 6; 418| 59.9k| j = row & 63; 419| | 420| 59.9k| if (row == PK_NROWS - 32) { ------------------ | | 13| 59.9k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 59.9k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 59.9k|#define GFBITS 12 | | ------------------ ------------------ | Branch (420:13): [True: 78, False: 59.8k] ------------------ 421| 78| if (mov_columns(mat.w, pi, pivots)) { ------------------ | Branch (421:17): [True: 0, False: 78] ------------------ 422| 0| return -1; 423| 0| } 424| 78| } 425| | 426| 23.0M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 23.0M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 23.0M|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 23.0M|#define GFBITS 12 | | ------------------ ------------------ | Branch (426:27): [True: 22.9M, False: 59.9k] ------------------ 427| 22.9M| extract_01_masks(&m, mat.w[ row ], mat.w[ k ], row); 428| 22.9M| uint16_cswap(&ind[row], &ind[k], m); 429| | 430| 22.9M| mm = vec256_set1_16b(m); 431| 114M| for (c = 0; c < nBlocks_I + 1; c++) { ------------------ | | 33| 114M|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 114M|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 114M|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 114M|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (431:25): [True: 91.8M, False: 22.9M] ------------------ 432| 91.8M| vec256_cswap(&mat.v[ row ][ c ], &mat.v[ k ][ c ], mm); 433| 91.8M| } 434| 22.9M| } 435| | 436| 59.9k| if ( uint64_is_zero_declassify((mat.w[ row ][ i ] >> j) & 1) ) { // return if not systematic ------------------ | Branch (436:14): [True: 0, False: 59.9k] ------------------ 437| 0| return -1; 438| 0| } 439| | 440| 23.0M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 23.0M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 23.0M|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 23.0M|#define GFBITS 12 | | ------------------ ------------------ | Branch (440:27): [True: 22.9M, False: 59.9k] ------------------ 441| 22.9M| t = mat.w[ k ][ i ] & (one << j); 442| 22.9M| mm = extract_mask256(mat.w[k], row); 443| | 444| 114M| for (c = 0; c < nBlocks_I + 1; c++) { ------------------ | | 33| 114M|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 114M|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 114M|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 114M|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ | Branch (444:25): [True: 91.8M, False: 22.9M] ------------------ 445| 91.8M| mat.v[ k ][ c ] ^= mat.v[ row ][ c ] & mm; 446| 91.8M| } 447| | 448| 22.9M| mat.w[ k ][ i ] |= t; 449| 22.9M| } 450| 59.9k| } 451| | 452| | // apply M^-1 to the remaining columns 453| | 454| 78| composeinv(PK_NROWS, ind_inv, ind_inv, ind); ------------------ | | 13| 78|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 78|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 78|#define GFBITS 12 | | ------------------ ------------------ 455| | 456| 1.01k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 1.01k|#define GFBITS 12 ------------------ | Branch (456:17): [True: 936, False: 78] ------------------ 457| 10.2k| for (b = 1; b < par_width; b++) { ------------------ | | 34| 10.2k|#define par_width 11 ------------------ | Branch (457:21): [True: 9.36k, False: 936] ------------------ 458| 9.36k| par.v[ k ][ b ] = prod[nBlocks_I + b][ k ]; ------------------ | | 33| 9.36k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 9.36k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 9.36k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 9.36k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ 459| 9.36k| } 460| 936| } 461| | 462| 4.99k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 4.99k|#define SYS_T 64 ------------------ | Branch (462:17): [True: 4.91k, False: 78] ------------------ 463| 54.0k| for (b = 1; b < par_width; b++) { ------------------ | | 34| 54.0k|#define par_width 11 ------------------ | Branch (463:21): [True: 49.1k, False: 4.91k] ------------------ 464| 49.1k| vec256_mul(prod[nBlocks_I + b], prod[nBlocks_I + b], consts[nBlocks_I + b]); ------------------ | | 33| 49.1k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 49.1k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 49.1k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 49.1k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ vec256_mul(prod[nBlocks_I + b], prod[nBlocks_I + b], consts[nBlocks_I + b]); ------------------ | | 33| 49.1k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 49.1k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 49.1k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 49.1k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ vec256_mul(prod[nBlocks_I + b], prod[nBlocks_I + b], consts[nBlocks_I + b]); ------------------ | | 33| 49.1k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 49.1k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 49.1k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 49.1k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ 465| 49.1k| } 466| | 467| 63.8k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 63.8k|#define GFBITS 12 ------------------ | Branch (467:21): [True: 58.9k, False: 4.91k] ------------------ 468| 648k| for (b = 1; b < par_width; b++) { ------------------ | | 34| 648k|#define par_width 11 ------------------ | Branch (468:25): [True: 589k, False: 58.9k] ------------------ 469| 589k| par.v[ i * GFBITS + k ][ b ] = prod[nBlocks_I + b][ k ]; ------------------ | | 6| 589k|#define GFBITS 12 ------------------ par.v[ i * GFBITS + k ][ b ] = prod[nBlocks_I + b][ k ]; ------------------ | | 33| 589k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 589k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 589k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 589k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ 470| 589k| } 471| 58.9k| } 472| 4.91k| } 473| | 474| | // apply P 475| | 476| 59.9k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 59.9k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 59.9k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 59.9k|#define GFBITS 12 | | ------------------ ------------------ | Branch (476:17): [True: 59.9k, False: 78] ------------------ 477| 59.9k| ind[i] = ind_inv[i]; 478| 59.9k| } 479| | 480| 78| sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 6| 78|#define GFBITS 12 ------------------ sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 13| 78|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 78|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 78|#define GFBITS 12 | | ------------------ ------------------ 481| | 482| | // apply L 483| | 484| 59.9k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 78|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 78|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 78|#define GFBITS 12 | | ------------------ ------------------ | Branch (484:30): [True: 59.9k, False: 78] ------------------ 485| 23.0M| for (i = row - 1; i >= 0; i--) { ------------------ | Branch (485:27): [True: 22.9M, False: 59.9k] ------------------ 486| 22.9M| mm = extract_mask256(mat.w[row], i); 487| | 488| 252M| for (k = 1; k < par_width; k++) { ------------------ | | 34| 252M|#define par_width 11 ------------------ | Branch (488:25): [True: 229M, False: 22.9M] ------------------ 489| 229M| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 490| 229M| } 491| 22.9M| } 492| 59.9k| } 493| | 494| | // apply U^-1 495| | 496| 59.9k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 59.9k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 59.9k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 59.9k|#define GFBITS 12 | | ------------------ ------------------ | Branch (496:17): [True: 59.9k, False: 78] ------------------ 497| 59.9k| par.v[i][0] = mat.v[i][nBlocks_I]; ------------------ | | 33| 59.9k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 59.9k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 59.9k|#define SYS_T 64 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 59.9k|#define GFBITS 12 | | | | ------------------ | | ------------------ ------------------ 498| 59.9k| } 499| | 500| 59.9k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 78|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 78|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 78|#define GFBITS 12 | | ------------------ ------------------ | Branch (500:30): [True: 59.9k, False: 78] ------------------ 501| 23.0M| for (i = PK_NROWS - 1; i > row; i--) { ------------------ | | 13| 59.9k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 59.9k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 59.9k|#define GFBITS 12 | | ------------------ ------------------ | Branch (501:32): [True: 22.9M, False: 59.9k] ------------------ 502| 22.9M| mm = extract_mask256(mat.w[row], i); 503| | 504| 275M| for (k = 0; k < par_width; k++) { ------------------ | | 34| 275M|#define par_width 11 ------------------ | Branch (504:25): [True: 252M, False: 22.9M] ------------------ 505| 252M| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 506| 252M| } 507| 22.9M| } 508| 59.9k| } 509| | 510| 59.9k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 59.9k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 59.9k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 59.9k|#define GFBITS 12 | | ------------------ ------------------ | Branch (510:19): [True: 59.9k, False: 78] ------------------ 511| 2.57M| for (k = 0; k < 42; k++) { ------------------ | Branch (511:21): [True: 2.51M, False: 59.9k] ------------------ 512| 2.51M| store8(pk + PK_ROW_BYTES * row + k * 8, par.w[row][k]); ------------------ | | 15| 2.51M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 2.51M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 2.51M|#define SYS_N 3488 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 2.51M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 2.51M|#define SYS_T 64 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 2.51M|#define GFBITS 12 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 513| 2.51M| } 514| | 515| 59.9k| store_i(pk + PK_ROW_BYTES * row + k * 8, par.w[row][k], 4); ------------------ | | 15| 59.9k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 59.9k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 59.9k|#define SYS_N 3488 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 59.9k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 59.9k|#define SYS_T 64 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 59.9k|#define GFBITS 12 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 516| 59.9k| } 517| | 518| | // 519| | 520| 78| return 0; 521| 78|} pk_gen.c:int16_cswap: 79| 629k|static inline void int16_cswap(int16_t *x, int16_t *y, uint16_t m) { 80| 629k| int16_t d; 81| | 82| 629k| d = *x ^ *y; 83| 629k| d &= m; 84| 629k| *x ^= d; 85| 629k| *y ^= d; 86| 629k|} PQCLEAN_MCELIECE348864F_AVX2_genpoly_gen: 55| 99|int genpoly_gen(gf *out, gf *f) { 56| 99| int i, j, k; 57| | 58| 99| gf t, inv; 59| | 60| 99| vec v[ GFBITS ], buf[ GFBITS ][ 64 ], mat[ 64 ][ GFBITS ], mask; 61| | 62| | // fill matrix 63| | 64| 99| buf[0][0] = 1; 65| 1.18k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.18k|#define GFBITS 12 ------------------ | Branch (65:17): [True: 1.08k, False: 99] ------------------ 66| 1.08k| buf[i][0] = 0; 67| 1.08k| } 68| | 69| 1.28k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 1.28k|#define GFBITS 12 ------------------ | Branch (69:17): [True: 1.18k, False: 99] ------------------ 70| 77.2k| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 1.18k|#define SYS_T 64 ------------------ | Branch (70:29): [True: 76.0k, False: 1.18k] ------------------ 71| 76.0k| v[j] <<= 1; 72| 76.0k| v[j] |= (f[i] >> j) & 1; 73| 76.0k| } 74| 1.18k| } 75| | 76| 1.28k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.28k|#define GFBITS 12 ------------------ | Branch (76:17): [True: 1.18k, False: 99] ------------------ 77| 1.18k| buf[i][1] = v[i]; 78| 1.18k| } 79| | 80| 6.33k| for (k = 2; k <= SYS_T; k++) { ------------------ | | 8| 6.33k|#define SYS_T 64 ------------------ | Branch (80:17): [True: 6.23k, False: 99] ------------------ 81| 6.23k| vec_GF_mul(v, v, f); ------------------ | | 6| 6.23k|#define vec_GF_mul CRYPTO_NAMESPACE(vec_GF_mul) | | ------------------ | | | | 4| 6.23k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 82| | 83| 6.23k| if (k < SYS_T) { ------------------ | | 8| 6.23k|#define SYS_T 64 ------------------ | Branch (83:13): [True: 6.13k, False: 99] ------------------ 84| 79.7k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 79.7k|#define GFBITS 12 ------------------ | Branch (84:25): [True: 73.6k, False: 6.13k] ------------------ 85| 73.6k| buf[i][k] = v[i]; 86| 73.6k| } 87| 6.13k| } else { 88| 6.43k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 6.43k|#define SYS_T 64 ------------------ | Branch (88:25): [True: 6.33k, False: 99] ------------------ 89| 6.33k| out[i] = extract_gf(v, i); 90| 6.33k| } 91| 99| } 92| 6.23k| } 93| | 94| 1.28k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.28k|#define GFBITS 12 ------------------ | Branch (94:17): [True: 1.18k, False: 99] ------------------ 95| 1.18k| transpose_64x64(buf[i]); 96| 1.18k| } 97| | 98| 6.43k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 6.43k|#define SYS_T 64 ------------------ | Branch (98:17): [True: 6.33k, False: 99] ------------------ 99| 82.3k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 82.3k|#define GFBITS 12 ------------------ | Branch (99:21): [True: 76.0k, False: 6.33k] ------------------ 100| 76.0k| mat[j][i] = buf[i][j]; 101| 76.0k| } 102| 6.33k| } 103| | 104| | // gaussian 105| | 106| 6.43k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 6.43k|#define SYS_T 64 ------------------ | Branch (106:17): [True: 6.33k, False: 99] ------------------ 107| 205k| for (j = i + 1; j < SYS_T; j++) { ------------------ | | 8| 205k|#define SYS_T 64 ------------------ | Branch (107:25): [True: 199k, False: 6.33k] ------------------ 108| 199k| mask = extract_bit(mat[i], i); 109| 199k| mask -= 1; 110| | 111| 2.59M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 2.59M|#define GFBITS 12 ------------------ | Branch (111:25): [True: 2.39M, False: 199k] ------------------ 112| 2.39M| mat[i][k] ^= mat[j][k] & mask; 113| 2.39M| } 114| | 115| 199k| out[i] ^= out[j] & mask; 116| 199k| } 117| | 118| | // 119| | 120| 6.33k| t = extract_gf(mat[i], i); 121| | 122| 6.33k| if (gf_is_zero_declassify(t)) { ------------------ | Branch (122:13): [True: 0, False: 6.33k] ------------------ 123| 0| return -1; // return if not systematic 124| 0| } 125| | 126| | // 127| | 128| 6.33k| inv = gf_inv(t); ------------------ | | 11| 6.33k|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 6.33k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 129| 6.33k| vec_mul_gf(mat[i], mat[i], inv); 130| | 131| 6.33k| out[i] = gf_mul(out[i], inv); ------------------ | | 14| 6.33k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 6.33k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 132| | 133| 411k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 411k|#define SYS_T 64 ------------------ | Branch (133:21): [True: 405k, False: 6.33k] ------------------ 134| 405k| if (j != i) { ------------------ | Branch (134:17): [True: 399k, False: 6.33k] ------------------ 135| 399k| t = extract_gf(mat[j], i); 136| | 137| 399k| vec_mul_gf(v, mat[i], t); 138| 399k| vec_add(mat[j], mat[j], v); 139| | 140| 399k| out[j] ^= gf_mul(out[i], t); ------------------ | | 14| 399k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 399k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 141| 399k| } 142| 405k| } 143| 6.33k| } 144| | 145| 99| return 0; 146| 99|} PQCLEAN_MCELIECE348864F_AVX2_vec_GF_mul: 6| 6.23k|void vec_GF_mul(vec out[ GFBITS ], vec v[ GFBITS ], gf a[ SYS_T ]) { 7| 6.23k| int i, j; 8| 6.23k| vec buf[GFBITS][2], prod[GFBITS], tmp[GFBITS]; 9| | 10| 6.23k| const vec allone = -1; 11| | 12| | // polynomial multiplication 13| | 14| 81.0k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 81.0k|#define GFBITS 12 ------------------ | Branch (14:17): [True: 74.8k, False: 6.23k] ------------------ 15| 74.8k| buf[i][0] = 0; 16| 74.8k| buf[i][1] = 0; 17| 74.8k| } 18| | 19| 405k| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 6.23k|#define SYS_T 64 ------------------ | Branch (19:25): [True: 399k, False: 6.23k] ------------------ 20| 5.18M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 5.18M|#define GFBITS 12 ------------------ | Branch (20:21): [True: 4.79M, False: 399k] ------------------ 21| 4.79M| buf[j][1] <<= 1; 22| 4.79M| buf[j][1] |= buf[j][0] >> 63; 23| 4.79M| buf[j][0] <<= 1; 24| 4.79M| } 25| | 26| 399k| vec_mul_gf(prod, v, a[i]); 27| | 28| 5.18M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 5.18M|#define GFBITS 12 ------------------ | Branch (28:21): [True: 4.79M, False: 399k] ------------------ 29| 4.79M| buf[j][0] ^= prod[j]; 30| 4.79M| } 31| 399k| } 32| | 33| | // reduction modulo y^64 + y^3 + y + z 34| | 35| 81.0k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 81.0k|#define GFBITS 12 ------------------ | Branch (35:17): [True: 74.8k, False: 6.23k] ------------------ 36| 74.8k| prod[i] = buf[i][1] & (allone << 3); 37| 74.8k| } 38| | 39| 6.23k| vec_mul_gf(tmp, prod, 2); 40| | 41| 81.0k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 81.0k|#define GFBITS 12 ------------------ | Branch (41:17): [True: 74.8k, False: 6.23k] ------------------ 42| 74.8k| buf[i][1] ^= prod[i] >> (SYS_T - 3); ------------------ | | 8| 74.8k|#define SYS_T 64 ------------------ 43| 74.8k| buf[i][0] ^= prod[i] << (64 - (SYS_T - 3)); ------------------ | | 8| 74.8k|#define SYS_T 64 ------------------ 44| 74.8k| buf[i][1] ^= prod[i] >> (SYS_T - 1); ------------------ | | 8| 74.8k|#define SYS_T 64 ------------------ 45| 74.8k| buf[i][0] ^= prod[i] << (64 - (SYS_T - 1)); ------------------ | | 8| 74.8k|#define SYS_T 64 ------------------ 46| 74.8k| buf[i][0] ^= tmp[i]; 47| 74.8k| } 48| | 49| | // 50| | 51| 81.0k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 81.0k|#define GFBITS 12 ------------------ | Branch (51:17): [True: 74.8k, False: 6.23k] ------------------ 52| 74.8k| prod[i] = buf[i][1] & 0x7; 53| 74.8k| } 54| | 55| 6.23k| vec_mul_gf(tmp, prod, 2); 56| | 57| 81.0k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 81.0k|#define GFBITS 12 ------------------ | Branch (57:17): [True: 74.8k, False: 6.23k] ------------------ 58| 74.8k| buf[i][0] ^= prod[i] << (64 - (SYS_T - 3)); ------------------ | | 8| 74.8k|#define SYS_T 64 ------------------ 59| 74.8k| buf[i][0] ^= prod[i] << (64 - (SYS_T - 1)); ------------------ | | 8| 74.8k|#define SYS_T 64 ------------------ 60| 74.8k| buf[i][0] ^= tmp[i]; 61| 74.8k| } 62| | 63| | // 64| | 65| 81.0k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 81.0k|#define GFBITS 12 ------------------ | Branch (65:17): [True: 74.8k, False: 6.23k] ------------------ 66| 74.8k| out[i] = buf[i][0]; 67| 74.8k| } 68| 6.23k|} PQCLEAN_MCELIECE348864F_AVX2_vec256_sq: 9| 3.19k|void vec256_sq(vec256 *out, vec256 *in) { 10| 3.19k| int i; 11| 3.19k| vec256 result[GFBITS]; 12| | 13| 3.19k| result[0] = in[0] ^ in[6]; 14| 3.19k| result[1] = in[11]; 15| 3.19k| result[2] = in[1] ^ in[7]; 16| 3.19k| result[3] = in[6]; 17| 3.19k| result[4] = in[2] ^ in[11] ^ in[8]; 18| 3.19k| result[5] = in[7]; 19| 3.19k| result[6] = in[3] ^ in[9]; 20| 3.19k| result[7] = in[8]; 21| 3.19k| result[8] = in[4] ^ in[10]; 22| 3.19k| result[9] = in[9]; 23| 3.19k| result[10] = in[5] ^ in[11]; 24| 3.19k| result[11] = in[10]; 25| | 26| 41.5k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 41.5k|#define GFBITS 12 ------------------ | Branch (26:17): [True: 38.3k, False: 3.19k] ------------------ 27| 38.3k| out[i] = result[i]; 28| 38.3k| } 29| 3.19k|} PQCLEAN_MCELIECE348864F_AVX2_vec256_inv: 32| 177|void vec256_inv(vec256 *out, vec256 *in) { 33| 177| vec256 tmp_11[ GFBITS ]; 34| 177| vec256 tmp_1111[ GFBITS ]; 35| | 36| 177| vec256_copy(out, in); 37| | 38| 177| vec256_sq(out, out); ------------------ | | 14| 177|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 177|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 39| 177| vec256_mul(tmp_11, out, in); // ^11 40| | 41| 177| vec256_sq(out, tmp_11); ------------------ | | 14| 177|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 177|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 42| 177| vec256_sq(out, out); ------------------ | | 14| 177|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 177|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 43| 177| vec256_mul(tmp_1111, out, tmp_11); // ^1111 44| | 45| 177| vec256_sq(out, tmp_1111); ------------------ | | 14| 177|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 177|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 46| 177| vec256_sq(out, out); ------------------ | | 14| 177|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 177|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 47| 177| vec256_sq(out, out); ------------------ | | 14| 177|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 177|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 48| 177| vec256_sq(out, out); ------------------ | | 14| 177|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 177|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 49| 177| vec256_mul(out, out, tmp_1111); // ^11111111 50| | 51| 177| vec256_sq(out, out); ------------------ | | 14| 177|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 177|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 52| 177| vec256_sq(out, out); ------------------ | | 14| 177|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 177|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 53| 177| vec256_mul(out, out, tmp_11); // ^1111111111 54| 177| vec256_sq(out, out); ------------------ | | 14| 177|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 177|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 55| 177| vec256_mul(out, out, in); // ^11111111111 56| | 57| 177| vec256_sq(out, out); // ^111111111110 ------------------ | | 14| 177|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 177|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_AVX2_ ## fun | | ------------------ ------------------ 58| 177|} pk_gen.c:mov_columns: 58| 414|static int mov_columns(uint8_t mat[][ SYS_N / 8 ], int16_t *pi, uint64_t *pivots) { 59| 414| int i, j, k, s, block_idx, row; 60| 414| uint64_t buf[64], ctz_list[32], t, d, mask, one = 1; 61| | 62| 414| row = PK_NROWS - 32; ------------------ | | 13| 414|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 414|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 414|#define GFBITS 12 | | ------------------ ------------------ 63| 414| block_idx = row / 8; 64| | 65| | // extract the 32x64 matrix 66| | 67| 13.6k| for (i = 0; i < 32; i++) { ------------------ | Branch (67:17): [True: 13.2k, False: 414] ------------------ 68| 13.2k| buf[i] = load8( &mat[ row + i ][ block_idx ] ); ------------------ | | 11| 13.2k|#define load8 CRYPTO_NAMESPACE(load8) | | ------------------ | | | | 4| 13.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_CLEAN_ ## fun | | ------------------ ------------------ 69| 13.2k| } 70| | 71| | // compute the column indices of pivots by Gaussian elimination. 72| | // the indices are stored in ctz_list 73| | 74| 414| *pivots = 0; 75| | 76| 13.6k| for (i = 0; i < 32; i++) { ------------------ | Branch (76:17): [True: 13.2k, False: 414] ------------------ 77| 13.2k| t = buf[i]; 78| 218k| for (j = i + 1; j < 32; j++) { ------------------ | Branch (78:25): [True: 205k, False: 13.2k] ------------------ 79| 205k| t |= buf[j]; 80| 205k| } 81| | 82| 13.2k| if (uint64_is_zero_declassify(t)) { ------------------ | Branch (82:13): [True: 0, False: 13.2k] ------------------ 83| 0| return -1; // return if buf is not full rank 84| 0| } 85| | 86| 13.2k| ctz_list[i] = s = ctz(t); 87| 13.2k| *pivots |= one << ctz_list[i]; 88| | 89| 218k| for (j = i + 1; j < 32; j++) { ------------------ | Branch (89:25): [True: 205k, False: 13.2k] ------------------ 90| 205k| mask = (buf[i] >> s) & 1; 91| 205k| mask -= 1; 92| 205k| buf[i] ^= buf[j] & mask; 93| 205k| } 94| 218k| for (j = i + 1; j < 32; j++) { ------------------ | Branch (94:25): [True: 205k, False: 13.2k] ------------------ 95| 205k| mask = (buf[j] >> s) & 1; 96| 205k| mask = -mask; 97| 205k| buf[j] ^= buf[i] & mask; 98| 205k| } 99| 13.2k| } 100| | 101| | // updating permutation 102| | 103| 13.6k| for (j = 0; j < 32; j++) { ------------------ | Branch (103:19): [True: 13.2k, False: 414] ------------------ 104| 642k| for (k = j + 1; k < 64; k++) { ------------------ | Branch (104:25): [True: 629k, False: 13.2k] ------------------ 105| 629k| d = pi[ row + j ] ^ pi[ row + k ]; 106| 629k| d &= same_mask((uint16_t)k, (uint16_t)ctz_list[j]); 107| 629k| pi[ row + j ] ^= d; 108| 629k| pi[ row + k ] ^= d; 109| 629k| } 110| 13.2k| } 111| | 112| | // moving columns of mat according to the column indices of pivots 113| | 114| 570k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 570k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 570k|#define SYS_T 64 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 570k|#define GFBITS 12 | | ------------------ ------------------ | Branch (114:17): [True: 570k, False: 414] ------------------ 115| 570k| t = load8( &mat[ i ][ block_idx ] ); ------------------ | | 11| 570k|#define load8 CRYPTO_NAMESPACE(load8) | | ------------------ | | | | 4| 570k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_CLEAN_ ## fun | | ------------------ ------------------ 116| | 117| 18.8M| for (j = 0; j < 32; j++) { ------------------ | Branch (117:21): [True: 18.2M, False: 570k] ------------------ 118| 18.2M| d = t >> j; 119| 18.2M| d ^= t >> ctz_list[j]; 120| 18.2M| d &= 1; 121| | 122| 18.2M| t ^= d << ctz_list[j]; 123| 18.2M| t ^= d << j; 124| 18.2M| } 125| | 126| 570k| store8( &mat[ i ][ block_idx ], t ); ------------------ | | 13| 570k|#define store8 CRYPTO_NAMESPACE(store8) | | ------------------ | | | | 4| 570k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE348864F_CLEAN_ ## fun | | ------------------ ------------------ 127| 570k| } 128| | 129| 414| return 0; 130| 414|} pk_gen.c:ctz: 35| 13.2k|static inline int ctz(uint64_t in) { 36| 13.2k| int i, b, m = 0, r = 0; 37| | 38| 861k| for (i = 0; i < 64; i++) { ------------------ | Branch (38:17): [True: 847k, False: 13.2k] ------------------ 39| 847k| b = (in >> i) & 1; 40| 847k| m |= b; 41| 847k| r += (m ^ 1) & (b ^ 1); 42| 847k| } 43| | 44| 13.2k| return r; 45| 13.2k|} pk_gen.c:same_mask: 47| 629k|static inline uint64_t same_mask(uint16_t x, uint16_t y) { 48| 629k| uint64_t mask; 49| | 50| 629k| mask = x ^ y; 51| 629k| mask -= 1; 52| 629k| mask >>= 63; 53| 629k| mask = -mask; 54| | 55| 629k| return mask; 56| 629k|} PQCLEAN_MCELIECE460896_AVX2_load_bits: 188| 116|void load_bits(vec128 bits_int[][32], const unsigned char *bits) { 189| 116| int i, j; 190| 116| const unsigned char *ptr = bits; 191| | 192| 116| vec128 buf[64]; 193| | 194| 464| for (i = 0; i <= 5; i += 2) { ------------------ | Branch (194:17): [True: 348, False: 116] ------------------ 195| 22.6k| for (j = 0; j < 64; j++) { ------------------ | Branch (195:21): [True: 22.2k, False: 348] ------------------ 196| 22.2k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 197| 22.2k| ptr += 8; 198| 22.2k| } 199| | 200| 348| transpose_64x128_sp( buf ); 201| | 202| 11.4k| for (j = 0; j < 32; j++) { ------------------ | Branch (202:21): [True: 11.1k, False: 348] ------------------ 203| 11.1k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 204| 11.1k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 205| 11.1k| } 206| | 207| 348| ptr += 512; 208| 348| } 209| | 210| 1.62k| for (i = 6; i <= 18; i++) { ------------------ | Branch (210:17): [True: 1.50k, False: 116] ------------------ 211| 49.7k| for (j = 0; j < 32; j++) { ------------------ | Branch (211:21): [True: 48.2k, False: 1.50k] ------------------ 212| 48.2k| bits_int[i][j] = load16(ptr); 213| 48.2k| ptr += 16; 214| 48.2k| } 215| 1.50k| } 216| | 217| 464| for (i = 19; i < 25; i += 2) { ------------------ | Branch (217:18): [True: 348, False: 116] ------------------ 218| 22.6k| for (j = 0; j < 64; j++) { ------------------ | Branch (218:21): [True: 22.2k, False: 348] ------------------ 219| 22.2k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 220| 22.2k| ptr += 8; 221| 22.2k| } 222| | 223| 348| transpose_64x128_sp( buf ); 224| | 225| 11.4k| for (j = 0; j < 32; j++) { ------------------ | Branch (225:21): [True: 11.1k, False: 348] ------------------ 226| 11.1k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 227| 11.1k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 228| 11.1k| } 229| | 230| 348| ptr += 512; 231| 348| } 232| 116|} PQCLEAN_MCELIECE460896_AVX2_benes: 238| 232|void benes(vec128 *r, vec128 b[][32], int rev) { 239| 232| int inc; 240| | 241| 232| vec128 *b_ptr; 242| | 243| 232| if (rev == 0) { ------------------ | Branch (243:9): [True: 116, False: 116] ------------------ 244| 116| inc = 32; 245| 116| b_ptr = b[ 0]; 246| 116| } else { 247| 116| inc = -32; 248| 116| b_ptr = b[24]; 249| 116| } 250| | 251| | // 252| | 253| 232| transpose_64x128_sp( r ); 254| | 255| 232| layer_0(r, b_ptr); 256| 232| b_ptr += inc; 257| 232| layer_1(r, b_ptr); 258| 232| b_ptr += inc; 259| 232| layer_2(r, b_ptr); 260| 232| b_ptr += inc; 261| 232| layer_3(r, b_ptr); 262| 232| b_ptr += inc; 263| 232| layer_4(r, b_ptr); 264| 232| b_ptr += inc; 265| 232| layer_5(r, b_ptr); 266| 232| b_ptr += inc; 267| | 268| 232| transpose_64x128_sp( r ); 269| | 270| 232| layer_x(r, b_ptr); 271| 232| b_ptr += inc; 272| 232| layer_0(r, b_ptr); 273| 232| b_ptr += inc; 274| 232| layer_1(r, b_ptr); 275| 232| b_ptr += inc; 276| 232| layer_2(r, b_ptr); 277| 232| b_ptr += inc; 278| 232| layer_3(r, b_ptr); 279| 232| b_ptr += inc; 280| 232| layer_4(r, b_ptr); 281| 232| b_ptr += inc; 282| 232| layer_5(r, b_ptr); 283| 232| b_ptr += inc; 284| 232| layer_4(r, b_ptr); 285| 232| b_ptr += inc; 286| 232| layer_3(r, b_ptr); 287| 232| b_ptr += inc; 288| 232| layer_2(r, b_ptr); 289| 232| b_ptr += inc; 290| 232| layer_1(r, b_ptr); 291| 232| b_ptr += inc; 292| 232| layer_0(r, b_ptr); 293| 232| b_ptr += inc; 294| 232| layer_x(r, b_ptr); 295| 232| b_ptr += inc; 296| | 297| 232| transpose_64x128_sp( r ); 298| | 299| 232| layer_5(r, b_ptr); 300| 232| b_ptr += inc; 301| 232| layer_4(r, b_ptr); 302| 232| b_ptr += inc; 303| 232| layer_3(r, b_ptr); 304| 232| b_ptr += inc; 305| 232| layer_2(r, b_ptr); 306| 232| b_ptr += inc; 307| 232| layer_1(r, b_ptr); 308| 232| b_ptr += inc; 309| 232| layer_0(r, b_ptr); 310| | 311| 232| transpose_64x128_sp( r ); 312| 232|} benes.c:layer_x: 14| 3.02k|static void layer_x(vec128 *data, vec128 *bits) { 15| 3.02k| int i; 16| 3.02k| vec128 v0, v1; 17| 3.02k| vec128 d; 18| | 19| 99.7k| for (i = 0; i < 64; i += 2) { ------------------ | Branch (19:17): [True: 96.7k, False: 3.02k] ------------------ 20| 96.7k| v0 = vec128_unpack_low(data[i + 0], data[i + 1]); 21| 96.7k| v1 = vec128_unpack_high(data[i + 0], data[i + 1]); 22| | 23| 96.7k| d = vec128_xor(v0, v1); 24| 96.7k| d = vec128_and(d, *bits++); 25| 96.7k| v0 = vec128_xor(v0, d); 26| 96.7k| v1 = vec128_xor(v1, d); 27| | 28| 96.7k| data[i + 0] = vec128_unpack_low(v0, v1); 29| 96.7k| data[i + 1] = vec128_unpack_high(v0, v1); 30| 96.7k| } 31| 3.02k|} PQCLEAN_MCELIECE460896_AVX2_bm: 147| 116|void bm(vec128 *out, vec256 *in) { 148| 116| int i; 149| 116| uint16_t N, L; 150| 116| uint16_t mask; 151| 116| uint64_t one = 1; 152| 116| uint64_t v[2]; 153| | 154| 116| typedef union { 155| 116| vec128 v[GFBITS][2]; 156| 116| vec256 V[GFBITS]; 157| 116| } db_t; 158| | 159| 116| vec128 prod[ GFBITS ]; 160| 116| vec128 interval[GFBITS]; 161| | 162| 116| db_t db; 163| 116| db_t BC_tmp; 164| 116| db_t BC; 165| | 166| 116| gf d, b; 167| 116| gf coefs[256]; 168| | 169| | // initialization 170| | 171| 116| get_coefs(coefs, in); 172| | 173| 116| BC.v[0][0] = vec128_set2x(0, one << 62); 174| 116| BC.v[0][1] = vec128_set2x(0, one << 63); 175| | 176| 1.50k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.50k|#define GFBITS 13 ------------------ | Branch (176:17): [True: 1.39k, False: 116] ------------------ 177| 1.39k| BC.v[i][0] = BC.v[i][1] = vec128_setzero(); 178| 1.39k| } 179| | 180| 116| b = 1; 181| 116| L = 0; 182| | 183| | // 184| | 185| 1.62k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.62k|#define GFBITS 13 ------------------ | Branch (185:17): [True: 1.50k, False: 116] ------------------ 186| 1.50k| interval[i] = vec128_setzero(); 187| 1.50k| } 188| | 189| 22.3k| for (N = 0; N < SYS_T * 2; N++) { ------------------ | | 8| 22.3k|#define SYS_T 96 ------------------ | Branch (189:17): [True: 22.2k, False: 116] ------------------ 190| 22.2k| update_asm(interval, coefs[N], 16); ------------------ | | 1| 22.2k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 22.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 191| 22.2k| vec128_mul_asm(prod, interval, BC.v[0] + 1, 32); ------------------ | | 10| 22.2k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 22.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 192| | 193| 22.2k| d = vec_reduce_asm(prod); ------------------ | | 3| 22.2k|#define vec_reduce_asm CRYPTO_NAMESPACE(vec_reduce_asm) | | ------------------ | | | | 4| 22.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 194| | 195| 22.2k| mask = mask_nonzero(d) & mask_leq(L * 2, N); 196| | 197| 311k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 311k|#define GFBITS 13 ------------------ | Branch (197:21): [True: 289k, False: 22.2k] ------------------ 198| 289k| db.v[i][0] = vec128_setbits((d >> i) & 1); 199| 289k| db.v[i][1] = vec128_setbits((b >> i) & 1); 200| 289k| } 201| | 202| 22.2k| vec256_mul((vec256 *)BC_tmp.V, (vec256 *)db.V, (vec256 *)BC.V); 203| | 204| 22.2k| vec128_cmov(BC.v, mask); 205| 22.2k| update_asm(BC.v, 0, 32); ------------------ | | 1| 22.2k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 22.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 311k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 311k|#define GFBITS 13 ------------------ | Branch (207:21): [True: 289k, False: 22.2k] ------------------ 208| 289k| BC.v[i][1] = vec128_xor(BC_tmp.v[i][0], BC_tmp.v[i][1]); 209| 289k| } 210| | 211| 22.2k| b = (d & mask) | (b & ~mask); 212| 22.2k| L = ((N + 1 - L) & mask) | (L & ~mask); 213| 22.2k| } 214| | 215| 1.62k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.62k|#define GFBITS 13 ------------------ | Branch (215:17): [True: 1.50k, False: 116] ------------------ 216| 1.50k| v[0] = vec128_extract(BC.v[i][1], 0); ------------------ | | 29| 1.50k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 217| 1.50k| v[1] = vec128_extract(BC.v[i][1], 1); ------------------ | | 29| 1.50k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 218| | 219| 1.50k| out[i] = vec128_set2x((v[0] >> 31) | (v[1] << 33), v[1] >> 31); 220| 1.50k| } 221| 116|} bm.c:vec128_cmov: 45| 176k|static inline void vec128_cmov(vec128 out[][2], uint16_t mask) { 46| 176k| int i; 47| | 48| 176k| vec128 v0, v1; 49| | 50| 176k| vec128 m0 = vec128_set1_16b( mask); 51| 176k| vec128 m1 = vec128_set1_16b(~mask); 52| | 53| 2.47M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 2.47M|#define GFBITS 13 ------------------ | Branch (53:17): [True: 2.29M, False: 176k] ------------------ 54| 2.29M| v0 = vec128_and(out[i][1], m0); 55| 2.29M| v1 = vec128_and(out[i][0], m1); 56| 2.29M| out[i][0] = vec128_or(v0, v1); 57| 2.29M| } 58| 176k|} PQCLEAN_MCELIECE460896_AVX2_controlbitsfrompermutation: 205| 116|void controlbitsfrompermutation(unsigned char *out, const int16 *pi, long long w, long long n) { 206| 116| PQCLEAN_VLA(int32, temp, (size_t)(2 * n)); ------------------ | | 57| 116|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 207| 116| PQCLEAN_VLA(int16, pi_test, (size_t)n); ------------------ | | 57| 116|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 208| 116| int16 diff; 209| 116| int i; 210| 116| unsigned char *ptr; 211| | 212| 116| OQS_MEM_cleanse(temp, (size_t)n * 2); 213| 116| OQS_MEM_cleanse(pi_test, (size_t)n); 214| | 215| 116| while (1) { ------------------ | Branch (215:12): [True: 116, Folded] ------------------ 216| 116| OQS_MEM_cleanse(out, (size_t)((((2 * w - 1)*n / 2) + 7) / 8)); 217| 116| cbrecursion(out, 0, 1, pi, w, n, temp); 218| | 219| | // check for correctness 220| | 221| 950k| for (i = 0; i < n; i++) { ------------------ | Branch (221:21): [True: 950k, False: 116] ------------------ 222| 950k| pi_test[i] = (int16)i; 223| 950k| } 224| | 225| 116| ptr = out; 226| 1.62k| for (i = 0; i < w; i++) { ------------------ | Branch (226:21): [True: 1.50k, False: 116] ------------------ 227| 1.50k| layer(pi_test, ptr, i, (int32)n); 228| 1.50k| ptr += n >> 4; 229| 1.50k| } 230| | 231| 1.50k| for (i = (int)(w - 2); i >= 0; i--) { ------------------ | Branch (231:32): [True: 1.39k, False: 116] ------------------ 232| 1.39k| layer(pi_test, ptr, i, (int32)n); 233| 1.39k| ptr += n >> 4; 234| 1.39k| } 235| | 236| 116| diff = 0; 237| 950k| for (i = 0; i < n; i++) { ------------------ | Branch (237:21): [True: 950k, False: 116] ------------------ 238| 950k| diff |= pi[i] ^ pi_test[i]; 239| 950k| } 240| | 241| 116| diff = crypto_int16_nonzero_mask(diff); ------------------ | | 12| 116|#define crypto_int16_nonzero_mask CRYPTO_NAMESPACE(crypto_int16_nonzero_mask) | | ------------------ | | | | 4| 116|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 242| 116| crypto_declassify(&diff, sizeof diff); 243| 116| if (diff == 0) { ------------------ | Branch (243:13): [True: 116, False: 0] ------------------ 244| 116| break; 245| 116| } 246| 116| } 247| 116|} PQCLEAN_MCELIECE460896_AVX2_crypto_int16_negative_mask: 3| 232|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 4| 232| return crypto_int16_x >> 15; 5| 232|} PQCLEAN_MCELIECE460896_AVX2_crypto_int16_nonzero_mask: 7| 116|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 8| 116| return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 116|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 116|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 116|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 116|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 9| 116|} PQCLEAN_MCELIECE460896_AVX2_crypto_int32_negative_mask: 3| 74.1M|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 4| 74.1M| return crypto_int32_x >> 31; 5| 74.1M|} PQCLEAN_MCELIECE460896_AVX2_crypto_int32_min: 37| 74.1M|crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x, crypto_int32 crypto_int32_y) { 38| 74.1M| crypto_int32 crypto_int32_xy = crypto_int32_y ^ crypto_int32_x; 39| 74.1M| crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x; 40| 74.1M| crypto_int32_z ^= crypto_int32_xy & (crypto_int32_z ^ crypto_int32_y); 41| 74.1M| crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); ------------------ | | 9| 74.1M|#define crypto_int32_negative_mask CRYPTO_NAMESPACE(crypto_int32_negative_mask) | | ------------------ | | | | 4| 74.1M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 42| 74.1M| crypto_int32_z &= crypto_int32_xy; 43| 74.1M| return crypto_int32_x ^ crypto_int32_z; 44| 74.1M|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint16_signed_negative_mask: 3| 325k|crypto_uint16_signed crypto_uint16_signed_negative_mask(crypto_uint16_signed crypto_uint16_signed_x) { 4| 325k| return crypto_uint16_signed_x >> 15; 5| 325k|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint16_nonzero_mask: 7| 110k|crypto_uint16 crypto_uint16_nonzero_mask(crypto_uint16 crypto_uint16_x) { 8| 110k| return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 110k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 110k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 110k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 110k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 9| 110k|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint16_zero_mask: 11| 110k|crypto_uint16 crypto_uint16_zero_mask(crypto_uint16 crypto_uint16_x) { 12| 110k| return ~crypto_uint16_nonzero_mask(crypto_uint16_x); ------------------ | | 13| 110k|#define crypto_uint16_nonzero_mask CRYPTO_NAMESPACE(crypto_uint16_nonzero_mask) | | ------------------ | | | | 4| 110k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 13| 110k|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint16_smaller_mask: 24| 103k|crypto_uint16 crypto_uint16_smaller_mask(crypto_uint16 crypto_uint16_x, crypto_uint16 crypto_uint16_y) { 25| 103k| crypto_uint16 crypto_uint16_xy = crypto_uint16_x ^ crypto_uint16_y; 26| 103k| crypto_uint16 crypto_uint16_z = crypto_uint16_x - crypto_uint16_y; 27| 103k| crypto_uint16_z ^= crypto_uint16_xy & (crypto_uint16_z ^ crypto_uint16_x ^ (((crypto_uint16) 1) << 15)); 28| 103k| return crypto_uint16_signed_negative_mask(crypto_uint16_z); ------------------ | | 11| 103k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 103k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 29| 103k|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint32_signed_negative_mask: 3| 108k|crypto_uint32_signed crypto_uint32_signed_negative_mask(crypto_uint32_signed crypto_uint32_signed_x) { 4| 108k| return crypto_uint32_signed_x >> 31; 5| 108k|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint32_nonzero_mask: 7| 54.1k|crypto_uint32 crypto_uint32_nonzero_mask(crypto_uint32 crypto_uint32_x) { 8| 54.1k| return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 54.1k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 54.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 54.1k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 54.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 9| 54.1k|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint32_unequal_mask: 15| 54.1k|crypto_uint32 crypto_uint32_unequal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 16| 54.1k| crypto_uint32 crypto_uint32_xy = crypto_uint32_x ^ crypto_uint32_y; 17| 54.1k| return crypto_uint32_nonzero_mask(crypto_uint32_xy); ------------------ | | 13| 54.1k|#define crypto_uint32_nonzero_mask CRYPTO_NAMESPACE(crypto_uint32_nonzero_mask) | | ------------------ | | | | 4| 54.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 18| 54.1k|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint32_equal_mask: 20| 54.1k|crypto_uint32 crypto_uint32_equal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 21| 54.1k| return ~crypto_uint32_unequal_mask(crypto_uint32_x, crypto_uint32_y); ------------------ | | 17| 54.1k|#define crypto_uint32_unequal_mask CRYPTO_NAMESPACE(crypto_uint32_unequal_mask) | | ------------------ | | | | 4| 54.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 22| 54.1k|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint64_signed_negative_mask: 3| 21.3M|crypto_uint64_signed crypto_uint64_signed_negative_mask(crypto_uint64_signed crypto_uint64_signed_x) { 4| 21.3M| return crypto_uint64_signed_x >> 63; 5| 21.3M|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint64_nonzero_mask: 7| 10.6M|crypto_uint64 crypto_uint64_nonzero_mask(crypto_uint64 crypto_uint64_x) { 8| 10.6M| return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 10.6M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 10.6M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 10.6M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 10.6M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 9| 10.6M|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint64_zero_mask: 11| 1.39M|crypto_uint64 crypto_uint64_zero_mask(crypto_uint64 crypto_uint64_x) { 12| 1.39M| return ~crypto_uint64_nonzero_mask(crypto_uint64_x); ------------------ | | 13| 1.39M|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 1.39M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 13| 1.39M|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint64_unequal_mask: 15| 9.28M|crypto_uint64 crypto_uint64_unequal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 16| 9.28M| crypto_uint64 crypto_uint64_xy = crypto_uint64_x ^ crypto_uint64_y; 17| 9.28M| return crypto_uint64_nonzero_mask(crypto_uint64_xy); ------------------ | | 13| 9.28M|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 9.28M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 18| 9.28M|} PQCLEAN_MCELIECE460896_AVX2_crypto_uint64_equal_mask: 20| 9.28M|crypto_uint64 crypto_uint64_equal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 21| 9.28M| return ~crypto_uint64_unequal_mask(crypto_uint64_x, crypto_uint64_y); ------------------ | | 17| 9.28M|#define crypto_uint64_unequal_mask CRYPTO_NAMESPACE(crypto_uint64_unequal_mask) | | ------------------ | | | | 4| 9.28M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 22| 9.28M|} PQCLEAN_MCELIECE460896_AVX2_decrypt: 171| 116|int decrypt(unsigned char *e, const unsigned char *sk, const unsigned char *s) { 172| 116| int i; 173| | 174| 116| uint16_t check_synd; 175| 116| uint16_t check_weight; 176| | 177| 116| vec256 inv[ 32 ][ GFBITS ]; 178| 116| vec256 scaled[ 32 ][ GFBITS ]; 179| 116| vec256 eval[32][ GFBITS ]; 180| | 181| 116| vec128 error128[ 64 ]; 182| 116| vec256 error256[ 32 ]; 183| | 184| 116| vec256 s_priv[ GFBITS ]; 185| 116| vec256 s_priv_cmp[ GFBITS ]; 186| 116| vec128 locator[ GFBITS ]; 187| | 188| 116| vec128 recv128[ 64 ]; 189| 116| vec256 recv256[ 32 ]; 190| 116| vec256 allone; 191| | 192| 116| vec128 bits_int[25][32]; 193| | 194| | // Berlekamp decoder 195| | 196| 116| preprocess(recv128, s); 197| | 198| 116| load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 10| 116|#define load_bits CRYPTO_NAMESPACE(load_bits) | | ------------------ | | | | 4| 116|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 11| 116|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 116|#define SYS_T 96 | | ------------------ ------------------ 199| 116| benes(recv128, bits_int, 1); ------------------ | | 9| 116|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 116|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 200| | 201| 116| reformat_128to256(recv256, recv128); 202| | 203| 116| scaling(scaled, inv, sk, recv256); 204| 116| fft_tr(s_priv, scaled); ------------------ | | 9| 116|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 116|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 205| 116| bm(locator, s_priv); ------------------ | | 10| 116|#define bm CRYPTO_NAMESPACE(bm) | | ------------------ | | | | 4| 116|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 116| fft(eval, locator); ------------------ | | 10| 116|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 116|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| | // reencryption and weight check 210| | 211| 116| allone = vec256_set1_16b(0xFFFF); 212| | 213| 3.82k| for (i = 0; i < 32; i++) { ------------------ | Branch (213:17): [True: 3.71k, False: 116] ------------------ 214| 3.71k| error256[i] = vec256_or_reduce(eval[i]); 215| 3.71k| error256[i] = vec256_xor(error256[i], allone); 216| 3.71k| } 217| | 218| 116| scaling_inv(scaled, inv, error256); 219| 116| fft_tr(s_priv_cmp, scaled); ------------------ | | 9| 116|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 116|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 220| | 221| 116| check_synd = synd_cmp(s_priv, s_priv_cmp); 222| | 223| | // 224| | 225| 116| reformat_256to128(error128, error256); 226| 116| benes(error128, bits_int, 0); ------------------ | | 9| 116|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 116|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 227| | 228| 116| postprocess(e, error128); 229| | 230| 116| check_weight = weight_check(e, error128); 231| | 232| 116| return 1 - (check_synd & check_weight); 233| 116|} PQCLEAN_MCELIECE460896_AVX2_encrypt: 112| 116|void encrypt(unsigned char *s, const unsigned char *pk, unsigned char *e) { 113| 116| gen_e(e); 114| | 115| 116| syndrome_asm(s, pk, e); ------------------ | | 1| 116|#define syndrome_asm CRYPTO_NAMESPACE(syndrome_asm) | | ------------------ | | | | 4| 116|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 116| 116|} PQCLEAN_MCELIECE460896_AVX2_fft: 265| 1.38k|void fft(vec256 out[][GFBITS], vec128 *in) { 266| 1.38k| radix_conversions(in); 267| 1.38k| butterflies(out, in); 268| 1.38k|} PQCLEAN_MCELIECE460896_AVX2_fft_tr: 397| 232|void fft_tr(vec256 *out, vec256 in[][ GFBITS ]) { 398| 232| butterflies_tr(out, in); 399| 232| radix_conversions_tr(out); 400| | 401| 232| postprocess(out); 402| 232|} fft_tr.c:postprocess: 381| 820|static void postprocess(vec256 *out) { 382| 820| int i; 383| 820| uint64_t v[4]; 384| | 385| 11.4k| for (i = 0; i < 13; i++) { ------------------ | Branch (385:17): [True: 10.6k, False: 820] ------------------ 386| 10.6k| v[0] = vec256_extract(out[i], 0); ------------------ | | 39| 10.6k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 387| 10.6k| v[1] = vec256_extract(out[i], 1); ------------------ | | 39| 10.6k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 388| 10.6k| v[2] = vec256_extract(out[i], 2); ------------------ | | 39| 10.6k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 389| 10.6k| v[3] = vec256_extract(out[i], 3); ------------------ | | 39| 10.6k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 390| | 391| 10.6k| v[3] = 0; 392| | 393| 10.6k| out[i] = vec256_set4x(v[0], v[1], v[2], v[3]); 394| 10.6k| } 395| 820|} PQCLEAN_MCELIECE460896_AVX2_gf_mul: 20| 10.6M|gf gf_mul(gf in0, gf in1) { 21| 10.6M| int i; 22| | 23| 10.6M| uint64_t tmp; 24| 10.6M| uint64_t t0; 25| 10.6M| uint64_t t1; 26| 10.6M| uint64_t t; 27| | 28| 10.6M| t0 = in0; 29| 10.6M| t1 = in1; 30| | 31| 10.6M| tmp = t0 * (t1 & 1); 32| | 33| 138M| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 138M|#define GFBITS 13 ------------------ | Branch (33:17): [True: 127M, False: 10.6M] ------------------ 34| 127M| tmp ^= (t0 * (t1 & (1 << i))); 35| 127M| } 36| | 37| | // 38| | 39| 10.6M| t = tmp & 0x1FF0000; 40| 10.6M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 41| | 42| 10.6M| t = tmp & 0x000E000; 43| 10.6M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 44| | 45| 10.6M| return tmp & GFMASK; ------------------ | | 19| 10.6M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 10.6M|#define GFBITS 13 | | ------------------ ------------------ 46| 10.6M|} PQCLEAN_MCELIECE460896_AVX2_gf_frac: 156| 110k|gf gf_frac(gf den, gf num) { 157| 110k| gf tmp_11; 158| 110k| gf tmp_1111; 159| 110k| gf out; 160| | 161| 110k| tmp_11 = gf_sqmul(den, den); // ^11 162| 110k| tmp_1111 = gf_sq2mul(tmp_11, tmp_11); // ^1111 163| 110k| out = gf_sq2(tmp_1111); 164| 110k| out = gf_sq2mul(out, tmp_1111); // ^11111111 165| 110k| out = gf_sq2(out); 166| 110k| out = gf_sq2mul(out, tmp_1111); // ^111111111111 167| | 168| 110k| return gf_sqmul(out, num); // ^1111111111110 = ^-1 169| 110k|} PQCLEAN_MCELIECE460896_AVX2_gf_inv: 172| 110k|gf gf_inv(gf den) { 173| 110k| return gf_frac(den, ((gf) 1)); ------------------ | | 10| 110k|#define gf_frac CRYPTO_NAMESPACE(gf_frac) | | ------------------ | | | | 4| 110k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 174| 110k|} pk_gen.c:PQCLEAN_MCELIECE460896_AVX2_int32_sort: 21| 116|static void int32_sort(int32_t *x, long long n) { 22| 116| long long top, p, q, r, i; 23| | 24| 116| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 116] ------------------ 25| 0| return; 26| 0| } 27| 116| top = 1; 28| 1.27k| while (top < n - top) { ------------------ | Branch (28:12): [True: 1.16k, False: 116] ------------------ 29| 1.16k| top += top; 30| 1.16k| } 31| | 32| 1.39k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 1.27k, False: 116] ------------------ 33| 1.35M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.35M, False: 1.27k] ------------------ 34| 1.35M| if (!(i & p)) { ------------------ | Branch (34:17): [True: 718k, False: 636k] ------------------ 35| 718k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 718k| do { \ | | 12| 718k| int32_t ab = (b) ^ (a); \ | | 13| 718k| int32_t c = (b) - (a); \ | | 14| 718k| c ^= ab & ((c) ^ (b)); \ | | 15| 718k| c >>= 31; \ | | 16| 718k| c &= ab; \ | | 17| 718k| (a) ^= c; \ | | 18| 718k| (b) ^= c; \ | | 19| 718k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 718k] | | ------------------ ------------------ 36| 718k| } 37| 1.35M| } 38| 1.27k| i = 0; 39| 7.65k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 6.38k, False: 1.27k] ------------------ 40| 1.21M| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.21M, False: 6.38k] ------------------ 41| 1.21M| if (!(i & p)) { ------------------ | Branch (41:21): [True: 636k, False: 573k] ------------------ 42| 636k| int32_t a = x[i + p]; 43| 3.60M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 2.97M, False: 636k] ------------------ 44| 2.97M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 2.97M| do { \ | | 12| 2.97M| int32_t ab = (b) ^ (a); \ | | 13| 2.97M| int32_t c = (b) - (a); \ | | 14| 2.97M| c ^= ab & ((c) ^ (b)); \ | | 15| 2.97M| c >>= 31; \ | | 16| 2.97M| c &= ab; \ | | 17| 2.97M| (a) ^= c; \ | | 18| 2.97M| (b) ^= c; \ | | 19| 2.97M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.97M] | | ------------------ ------------------ 45| 2.97M| } 46| 636k| x[i + p] = a; 47| 636k| } 48| 1.21M| } 49| 6.38k| } 50| 1.27k| } 51| 116|} controlbits.c:PQCLEAN_MCELIECE460896_AVX2_int32_sort: 21| 3.80M|static void int32_sort(int32_t *x, long long n) { 22| 3.80M| long long top, p, q, r, i; 23| | 24| 3.80M| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 3.80M] ------------------ 25| 0| return; 26| 0| } 27| 3.80M| top = 1; 28| 13.3M| while (top < n - top) { ------------------ | Branch (28:12): [True: 9.52M, False: 3.80M] ------------------ 29| 9.52M| top += top; 30| 9.52M| } 31| | 32| 17.1M| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 13.3M, False: 3.80M] ------------------ 33| 1.83G| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.81G, False: 13.3M] ------------------ 34| 1.81G| if (!(i & p)) { ------------------ | Branch (34:17): [True: 1.01G, False: 802M] ------------------ 35| 1.01G| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 1.01G| do { \ | | 12| 1.01G| int32_t ab = (b) ^ (a); \ | | 13| 1.01G| int32_t c = (b) - (a); \ | | 14| 1.01G| c ^= ab & ((c) ^ (b)); \ | | 15| 1.01G| c >>= 31; \ | | 16| 1.01G| c &= ab; \ | | 17| 1.01G| (a) ^= c; \ | | 18| 1.01G| (b) ^= c; \ | | 19| 1.01G| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.01G] | | ------------------ ------------------ 36| 1.01G| } 37| 1.81G| } 38| 13.3M| i = 0; 39| 36.1M| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 22.8M, False: 13.3M] ------------------ 40| 1.62G| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.60G, False: 22.8M] ------------------ 41| 1.60G| if (!(i & p)) { ------------------ | Branch (41:21): [True: 802M, False: 802M] ------------------ 42| 802M| int32_t a = x[i + p]; 43| 4.75G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 3.95G, False: 802M] ------------------ 44| 3.95G| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 3.95G| do { \ | | 12| 3.95G| int32_t ab = (b) ^ (a); \ | | 13| 3.95G| int32_t c = (b) - (a); \ | | 14| 3.95G| c ^= ab & ((c) ^ (b)); \ | | 15| 3.95G| c >>= 31; \ | | 16| 3.95G| c &= ab; \ | | 17| 3.95G| (a) ^= c; \ | | 18| 3.95G| (b) ^= c; \ | | 19| 3.95G| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.95G] | | ------------------ ------------------ 45| 3.95G| } 46| 802M| x[i + p] = a; 47| 802M| } 48| 1.60G| } 49| 22.8M| } 50| 13.3M| } 51| 3.80M|} encrypt.c:PQCLEAN_MCELIECE460896_AVX2_int32_sort: 21| 570|static void int32_sort(int32_t *x, long long n) { 22| 570| long long top, p, q, r, i; 23| | 24| 570| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 570] ------------------ 25| 0| return; 26| 0| } 27| 570| top = 1; 28| 3.99k| while (top < n - top) { ------------------ | Branch (28:12): [True: 3.42k, False: 570] ------------------ 29| 3.42k| top += top; 30| 3.42k| } 31| | 32| 4.56k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 3.99k, False: 570] ------------------ 33| 314k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 310k, False: 3.99k] ------------------ 34| 310k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 173k, False: 137k] ------------------ 35| 173k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 173k| do { \ | | 12| 173k| int32_t ab = (b) ^ (a); \ | | 13| 173k| int32_t c = (b) - (a); \ | | 14| 173k| c ^= ab & ((c) ^ (b)); \ | | 15| 173k| c >>= 31; \ | | 16| 173k| c &= ab; \ | | 17| 173k| (a) ^= c; \ | | 18| 173k| (b) ^= c; \ | | 19| 173k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 173k] | | ------------------ ------------------ 36| 173k| } 37| 310k| } 38| 3.99k| i = 0; 39| 15.9k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 11.9k, False: 3.99k] ------------------ 40| 268k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 256k, False: 11.9k] ------------------ 41| 256k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 137k, False: 119k] ------------------ 42| 137k| int32_t a = x[i + p]; 43| 538k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 400k, False: 137k] ------------------ 44| 400k| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 400k| do { \ | | 12| 400k| int32_t ab = (b) ^ (a); \ | | 13| 400k| int32_t c = (b) - (a); \ | | 14| 400k| c ^= ab & ((c) ^ (b)); \ | | 15| 400k| c >>= 31; \ | | 16| 400k| c &= ab; \ | | 17| 400k| (a) ^= c; \ | | 18| 400k| (b) ^= c; \ | | 19| 400k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 400k] | | ------------------ ------------------ 45| 400k| } 46| 137k| x[i + p] = a; 47| 137k| } 48| 256k| } 49| 11.9k| } 50| 3.99k| } 51| 570|} PQCLEAN_MCELIECE460896_AVX2_crypto_kem_enc: 22| 116|) { 23| 116| unsigned char e[ SYS_N / 8 ]; 24| 116| unsigned char one_ec[ 1 + SYS_N / 8 + SYND_BYTES ] = {1}; 25| | 26| | // 27| | 28| 116| encrypt(c, pk, e); ------------------ | | 9| 116|#define encrypt CRYPTO_NAMESPACE(encrypt) | | ------------------ | | | | 4| 116|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 29| | 30| 116| memcpy(one_ec + 1, e, SYS_N / 8); ------------------ | | 7| 116|#define SYS_N 4608 ------------------ 31| 116| memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 7| 116|#define SYS_N 4608 ------------------ memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 17| 116|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 116|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 116|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 116|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 32| | 33| 116| crypto_hash_32b(key, one_ec, sizeof(one_ec)); ------------------ | | 7| 116| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 116|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 34| | 35| 116| return 0; 36| 116|} PQCLEAN_MCELIECE460896_AVX2_crypto_kem_dec: 42| 116|) { 43| 116| int i; 44| | 45| 116| unsigned char ret_decrypt = 0; 46| | 47| 116| uint16_t m; 48| | 49| 116| unsigned char e[ SYS_N / 8 ]; 50| 116| unsigned char preimage[ 1 + SYS_N / 8 + SYND_BYTES ]; 51| 116| unsigned char *x = preimage; 52| 116| const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 11| 116|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 116|#define SYS_T 96 | | ------------------ ------------------ const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 10| 116|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 116|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 116|#define GFBITS 13 | | ------------------ ------------------ 53| | 54| | // 55| | 56| 116| ret_decrypt = (unsigned char)decrypt(e, sk + 40, c); ------------------ | | 9| 116|#define decrypt CRYPTO_NAMESPACE(decrypt) | | ------------------ | | | | 4| 116|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 57| | 58| 116| m = ret_decrypt; 59| 116| m -= 1; 60| 116| m >>= 8; 61| | 62| 116| *x++ = m & 1; 63| 66.9k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 66.9k|#define SYS_N 4608 ------------------ | Branch (63:17): [True: 66.8k, False: 116] ------------------ 64| 66.8k| *x++ = (~m & s[i]) | (m & e[i]); 65| 66.8k| } 66| | 67| 18.2k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 18.2k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 18.2k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 18.2k|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 18.2k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (67:17): [True: 18.0k, False: 116] ------------------ 68| 18.0k| *x++ = c[i]; 69| 18.0k| } 70| | 71| 116| crypto_hash_32b(key, preimage, sizeof(preimage)); ------------------ | | 7| 116| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 116|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 72| | 73| 116| return 0; 74| 116|} PQCLEAN_MCELIECE460896_AVX2_crypto_kem_keypair: 80| 116|) { 81| 116| int i; 82| 116| unsigned char seed[ 33 ] = {64}; 83| 116| unsigned char r[ SYS_N / 8 + (1 << GFBITS)*sizeof(uint32_t) + SYS_T * 2 + 32 ]; 84| 116| unsigned char *rp, *skp; 85| | 86| 116| gf f[ SYS_T ]; // element in GF(2^mt) 87| 116| gf irr[ SYS_T ]; // Goppa polynomial 88| 116| uint32_t perm[ 1 << GFBITS ]; // random permutation as 32-bit integers 89| 116| int16_t pi[ 1 << GFBITS ]; // random permutation 90| | 91| 116| randombytes(seed + 1, 32); ------------------ | | 8| 116|#define randombytes OQS_randombytes ------------------ 92| | 93| 1.15k| while (1) { ------------------ | Branch (93:12): [True: 1.15k, Folded] ------------------ 94| 1.15k| rp = &r[ sizeof(r) - 32 ]; 95| 1.15k| skp = sk; 96| | 97| | // expanding and updating the seed 98| | 99| 1.15k| shake(r, sizeof(r), seed, 33); ------------------ | | 10| 1.15k| shake256(out, outlen, in, inlen) | | ------------------ | | | | 12| 1.15k|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 100| 1.15k| memcpy(skp, seed + 1, 32); 101| 1.15k| skp += 32 + 8; 102| 1.15k| memcpy(seed + 1, &r[ sizeof(r) - 32 ], 32); 103| | 104| | // generating irreducible polynomial 105| | 106| 1.15k| rp -= sizeof(f); 107| | 108| 111k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 111k|#define SYS_T 96 ------------------ | Branch (108:21): [True: 110k, False: 1.15k] ------------------ 109| 110k| f[i] = load_gf(rp + i * 2); 110| 110k| } 111| | 112| 1.15k| if (genpoly_gen(irr, f)) { ------------------ | | 9| 1.15k|#define genpoly_gen CRYPTO_NAMESPACE(genpoly_gen) | | ------------------ | | | | 4| 1.15k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ | Branch (112:13): [True: 0, False: 1.15k] ------------------ 113| 0| continue; 114| 0| } 115| | 116| 111k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 111k|#define SYS_T 96 ------------------ | Branch (116:21): [True: 110k, False: 1.15k] ------------------ 117| 110k| store_gf(skp + i * 2, irr[i]); 118| 110k| } 119| | 120| 1.15k| skp += IRR_BYTES; ------------------ | | 11| 1.15k|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 1.15k|#define SYS_T 96 | | ------------------ ------------------ 121| | 122| | // generating permutation 123| | 124| 1.15k| rp -= sizeof(perm); 125| | 126| 9.44M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 9.44M|#define GFBITS 13 ------------------ | Branch (126:21): [True: 9.44M, False: 1.15k] ------------------ 127| 9.44M| perm[i] = load4(rp + i * 4); 128| 9.44M| } 129| | 130| 1.15k| if (pk_gen(pk, skp - IRR_BYTES, perm, pi)) { ------------------ | | 9| 1.15k|#define pk_gen CRYPTO_NAMESPACE(pk_gen) | | ------------------ | | | | 4| 1.15k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ if (pk_gen(pk, skp - IRR_BYTES, perm, pi)) { ------------------ | | 11| 1.15k|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 1.15k|#define SYS_T 96 | | ------------------ ------------------ | Branch (130:13): [True: 1.03k, False: 116] ------------------ 131| 1.03k| continue; 132| 1.03k| } 133| | 134| 116| controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 10| 116|#define controlbitsfrompermutation CRYPTO_NAMESPACE(controlbitsfrompermutation) | | ------------------ | | | | 4| 116|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 116|#define GFBITS 13 ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 116|#define GFBITS 13 ------------------ 135| 116| skp += COND_BYTES; ------------------ | | 10| 116|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 116|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 116|#define GFBITS 13 | | ------------------ ------------------ 136| | 137| | // storing the random string s 138| | 139| 116| rp -= SYS_N / 8; ------------------ | | 7| 116|#define SYS_N 4608 ------------------ 140| 116| memcpy(skp, rp, SYS_N / 8); ------------------ | | 7| 116|#define SYS_N 4608 ------------------ 141| | 142| | // storing positions of the 32 pivots 143| | 144| 116| store8(sk + 32, 0xFFFFFFFF); 145| | 146| 116| break; 147| 1.15k| } 148| | 149| 116| return 0; 150| 116|} PQCLEAN_MCELIECE460896_AVX2_pk_gen: 199| 1.15k|int pk_gen(unsigned char *pk, const unsigned char *irr, const uint32_t *perm, int16_t *pi) { 200| 1.15k|#define nBlocks_I ((PK_NROWS + 255) / 256) 201| | 202| 1.15k| int i, j, k, b; 203| 1.15k| int row, c; 204| | 205| 1.15k| union { 206| 1.15k| uint64_t w[ PK_NROWS ][ nBlocks_I * 4 ]; 207| 1.15k| vec256 v[ PK_NROWS ][ nBlocks_I ]; 208| 1.15k| } mat; 209| | 210| 1.15k| union { 211| 1.15k| uint64_t w[ PK_NROWS ][ par_width * 4 ]; 212| 1.15k| vec256 v[ PK_NROWS ][ par_width ]; 213| 1.15k| } par; 214| | 215| 1.15k| uint64_t one = 1; 216| 1.15k| uint64_t t; 217| 1.15k| uint16_t m; 218| 1.15k| vec256 mm; 219| | 220| 1.15k| vec128 sk_int[ GFBITS ]; 221| | 222| 1.15k| vec256 consts[ 32 ][ GFBITS ]; 223| 1.15k| vec256 eval[ 32 ][ GFBITS ]; 224| 1.15k| vec256 prod[ 32 ][ GFBITS ]; 225| 1.15k| vec256 tmp[ GFBITS ]; 226| | 227| 1.15k| uint64_t list[1 << GFBITS]; 228| | 229| 1.15k| uint16_t ind[ PK_NROWS ]; 230| 1.15k| uint16_t ind_inv[ PK_NROWS ]; 231| | 232| | // compute the inverses 233| | 234| 1.15k| irr_load(sk_int, irr); 235| | 236| 1.15k| fft(eval, sk_int); ------------------ | | 10| 1.15k|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 1.15k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 237| | 238| 1.15k| vec256_copy(prod[0], eval[0]); 239| | 240| 36.8k| for (i = 1; i < 32; i++) { ------------------ | Branch (240:17): [True: 35.7k, False: 1.15k] ------------------ 241| 35.7k| vec256_mul(prod[i], prod[i - 1], eval[i]); 242| 35.7k| } 243| | 244| 1.15k| vec256_inv(tmp, prod[31]); ------------------ | | 11| 1.15k|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 1.15k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 245| | 246| 36.8k| for (i = 30; i >= 0; i--) { ------------------ | Branch (246:18): [True: 35.7k, False: 1.15k] ------------------ 247| 35.7k| vec256_mul(prod[i + 1], prod[i], tmp); 248| 35.7k| vec256_mul(tmp, tmp, eval[i + 1]); 249| 35.7k| } 250| | 251| 1.15k| vec256_copy(prod[0], tmp); 252| | 253| | // fill matrix 254| | 255| 1.15k| de_bitslicing(list, prod); 256| | 257| 9.44M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 9.44M|#define GFBITS 13 ------------------ | Branch (257:17): [True: 9.44M, False: 1.15k] ------------------ 258| 9.44M| list[i] <<= GFBITS; ------------------ | | 6| 9.44M|#define GFBITS 13 ------------------ 259| 9.44M| list[i] |= i; 260| 9.44M| list[i] |= ((uint64_t) perm[i]) << 31; 261| 9.44M| } 262| | 263| 1.15k| uint64_sort(list, 1 << GFBITS); ------------------ | | 6| 1.15k|#define GFBITS 13 ------------------ 264| | 265| 9.28M| for (i = 1; i < (1 << GFBITS); i++) { ------------------ | | 6| 9.28M|#define GFBITS 13 ------------------ | Branch (265:17): [True: 9.28M, False: 1.11k] ------------------ 266| 9.28M| if (uint64_is_equal_declassify(list[i - 1] >> 31, list[i] >> 31)) { ------------------ | Branch (266:13): [True: 35, False: 9.28M] ------------------ 267| 35| return -1; 268| 35| } 269| 9.28M| } 270| | 271| 1.11k| to_bitslicing_2x(consts, prod, list); 272| | 273| 9.15M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 9.15M|#define GFBITS 13 ------------------ | Branch (273:17): [True: 9.15M, False: 1.11k] ------------------ 274| 9.15M| pi[i] = list[i] & GFMASK; ------------------ | | 19| 9.15M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 9.15M|#define GFBITS 13 | | ------------------ ------------------ 275| 9.15M| } 276| | 277| 6.70k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 200| 6.70k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 6.70k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 6.70k|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 6.70k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (277:17): [True: 5.59k, False: 1.11k] ------------------ 278| 78.2k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 78.2k|#define GFBITS 13 ------------------ | Branch (278:21): [True: 72.6k, False: 5.59k] ------------------ 279| 72.6k| mat.v[ k ][ j ] = prod[ j ][ k ]; 280| 72.6k| } 281| 5.59k| } 282| | 283| 107k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 107k|#define SYS_T 96 ------------------ | Branch (283:17): [True: 106k, False: 1.11k] ------------------ 284| 637k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 200| 637k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 637k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 637k|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 637k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (284:21): [True: 531k, False: 106k] ------------------ 285| 531k| vec256_mul(prod[j], prod[j], consts[j]); 286| | 287| 7.43M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 7.43M|#define GFBITS 13 ------------------ | Branch (287:25): [True: 6.90M, False: 531k] ------------------ 288| 6.90M| mat.v[ i * GFBITS + k ][ j ] = prod[ j ][ k ]; ------------------ | | 6| 6.90M|#define GFBITS 13 ------------------ 289| 6.90M| } 290| 531k| } 291| 106k| } 292| | 293| | // gaussian elimination to obtain L, U, and P such that LP M = U 294| | // L and U are stored in the space of M 295| | // P is stored in ind 296| | 297| 1.39M| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 1.39M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.39M|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.39M|#define GFBITS 13 | | ------------------ ------------------ | Branch (297:17): [True: 1.39M, False: 1.11k] ------------------ 298| 1.39M| ind_inv[i] = ind[ i ] = i; 299| 1.39M| } 300| | 301| 1.39M| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 1.39M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.39M|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.39M|#define GFBITS 13 | | ------------------ ------------------ | Branch (301:19): [True: 1.39M, False: 116] ------------------ 302| 1.39M| i = row >> 6; 303| 1.39M| j = row & 63; 304| | 305| 871M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 871M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 871M|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 871M|#define GFBITS 13 | | ------------------ ------------------ | Branch (305:27): [True: 869M, False: 1.39M] ------------------ 306| 869M| extract_01_masks(&m, mat.w[ row ], mat.w[ k ], row); 307| 869M| uint16_cswap(&ind[row], &ind[k], m); 308| | 309| 869M| mm = vec256_set1_16b(m); 310| 5.21G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 200| 5.21G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 5.21G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 5.21G|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 5.21G|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (310:25): [True: 4.34G, False: 869M] ------------------ 311| 4.34G| vec256_cswap(&mat.v[ row ][ c ], &mat.v[ k ][ c ], mm); 312| 4.34G| } 313| 869M| } 314| | 315| 1.39M| if ( uint64_is_zero_declassify((mat.w[ row ][ i ] >> j) & 1) ) { // return if not systematic ------------------ | Branch (315:14): [True: 1.00k, False: 1.39M] ------------------ 316| 1.00k| return -1; 317| 1.00k| } 318| | 319| 871M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 871M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 871M|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 871M|#define GFBITS 13 | | ------------------ ------------------ | Branch (319:27): [True: 869M, False: 1.39M] ------------------ 320| 869M| t = mat.w[ k ][ i ] & (one << j); 321| 869M| mm = extract_mask256(mat.w[k], row); 322| | 323| 5.21G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 200| 5.21G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 5.21G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 5.21G|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 5.21G|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (323:25): [True: 4.34G, False: 869M] ------------------ 324| 4.34G| mat.v[ k ][ c ] ^= mat.v[ row ][ c ] & mm; 325| 4.34G| } 326| | 327| 869M| mat.w[ k ][ i ] |= t; 328| 869M| } 329| 1.39M| } 330| | 331| | // apply M^-1 to the remaining columns 332| | 333| 116| composeinv(PK_NROWS, ind_inv, ind_inv, ind); ------------------ | | 13| 116|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 116|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 116|#define GFBITS 13 | | ------------------ ------------------ 334| | 335| 348| for (j = 4; j < 18; j += par_width) { ------------------ | | 30| 232|#define par_width 7 ------------------ | Branch (335:17): [True: 232, False: 116] ------------------ 336| 3.24k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 3.24k|#define GFBITS 13 ------------------ | Branch (336:21): [True: 3.01k, False: 232] ------------------ 337| 24.1k| for (b = 0; b < par_width; b++) { ------------------ | | 30| 24.1k|#define par_width 7 ------------------ | Branch (337:25): [True: 21.1k, False: 3.01k] ------------------ 338| 21.1k| par.v[ k ][ b ] = prod[ j + b ][ k ]; 339| 21.1k| } 340| 3.01k| } 341| | 342| 22.2k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 22.2k|#define SYS_T 96 ------------------ | Branch (342:21): [True: 22.0k, False: 232] ------------------ 343| 176k| for (b = 0; b < par_width; b++) { ------------------ | | 30| 176k|#define par_width 7 ------------------ | Branch (343:25): [True: 154k, False: 22.0k] ------------------ 344| 154k| vec256_mul(prod[j + b], prod[j + b], consts[j + b]); 345| 154k| } 346| | 347| 308k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 308k|#define GFBITS 13 ------------------ | Branch (347:25): [True: 286k, False: 22.0k] ------------------ 348| 2.29M| for (b = 0; b < par_width; b++) { ------------------ | | 30| 2.29M|#define par_width 7 ------------------ | Branch (348:29): [True: 2.00M, False: 286k] ------------------ 349| 2.00M| par.v[ i * GFBITS + k ][ b ] = prod[ j + b ][ k ]; ------------------ | | 6| 2.00M|#define GFBITS 13 ------------------ 350| 2.00M| } 351| 286k| } 352| 22.0k| } 353| | 354| | // apply P 355| | 356| 289k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 289k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 289k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 289k|#define GFBITS 13 | | ------------------ ------------------ | Branch (356:21): [True: 289k, False: 232] ------------------ 357| 289k| ind[i] = ind_inv[i]; 358| 289k| } 359| | 360| 232| sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 6| 232|#define GFBITS 13 ------------------ sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 13| 232|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 232|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 232|#define GFBITS 13 | | ------------------ ------------------ 361| | 362| | // apply L 363| | 364| 289k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 232|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 232|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 232|#define GFBITS 13 | | ------------------ ------------------ | Branch (364:34): [True: 289k, False: 232] ------------------ 365| 180M| for (i = row - 1; i >= 0; i--) { ------------------ | Branch (365:31): [True: 180M, False: 289k] ------------------ 366| 180M| mm = extract_mask256(mat.w[row], i); 367| | 368| 1.44G| for (k = 0; k < par_width; k++) { ------------------ | | 30| 1.44G|#define par_width 7 ------------------ | Branch (368:29): [True: 1.26G, False: 180M] ------------------ 369| 1.26G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 370| 1.26G| } 371| 180M| } 372| 289k| } 373| | 374| | // apply U^-1 375| | 376| 232| if (j == 4) { ------------------ | Branch (376:13): [True: 116, False: 116] ------------------ 377| 144k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 144k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 144k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 144k|#define GFBITS 13 | | ------------------ ------------------ | Branch (377:25): [True: 144k, False: 116] ------------------ 378| 144k| par.v[i][0] = mat.v[i][nBlocks_I - 1]; ------------------ | | 200| 144k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 144k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 144k|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 144k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 379| 144k| } 380| 116| } 381| | 382| 289k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 232|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 232|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 232|#define GFBITS 13 | | ------------------ ------------------ | Branch (382:34): [True: 289k, False: 232] ------------------ 383| 180M| for (i = PK_NROWS - 1; i > row; i--) { ------------------ | | 13| 289k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 289k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 289k|#define GFBITS 13 | | ------------------ ------------------ | Branch (383:36): [True: 180M, False: 289k] ------------------ 384| 180M| mm = extract_mask256(mat.w[row], i); 385| | 386| 1.44G| for (k = 0; k < par_width; k++) { ------------------ | | 30| 1.44G|#define par_width 7 ------------------ | Branch (386:29): [True: 1.26G, False: 180M] ------------------ 387| 1.26G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 388| 1.26G| } 389| 180M| } 390| 289k| } 391| | 392| 232| if (j == 4) { ------------------ | Branch (392:13): [True: 116, False: 116] ------------------ 393| 144k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 144k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 144k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 144k|#define GFBITS 13 | | ------------------ ------------------ | Branch (393:27): [True: 144k, False: 116] ------------------ 394| 144k| k = 3; 395| 144k| store_i(pk + PK_ROW_BYTES * row + j * 32 + k * 8 + 4 - 13 * 12, par.w[row][k] >> 32, 4); ------------------ | | 15| 144k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 144k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 144k|#define SYS_N 4608 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 144k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 144k|#define SYS_T 96 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 144k|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 396| | 397| 3.61M| for (k = 4; k < 28; k++) { ------------------ | Branch (397:29): [True: 3.47M, False: 144k] ------------------ 398| 3.47M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 12, par.w[row][k]); ------------------ | | 15| 3.47M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 3.47M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 3.47M|#define SYS_N 4608 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 3.47M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 3.47M|#define SYS_T 96 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 3.47M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 399| 3.47M| } 400| 144k| } 401| 116| } else { 402| 144k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 144k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 144k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 144k|#define GFBITS 13 | | ------------------ ------------------ | Branch (402:27): [True: 144k, False: 116] ------------------ 403| 4.19M| for (k = 0; k < 28; k++) { ------------------ | Branch (403:29): [True: 4.05M, False: 144k] ------------------ 404| 4.05M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 12, par.w[row][k]); ------------------ | | 15| 4.05M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 4.05M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 4.05M|#define SYS_N 4608 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 4.05M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 4.05M|#define SYS_T 96 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 4.05M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 405| 4.05M| } 406| 144k| } 407| 116| } 408| 232| } 409| | 410| | // 411| | 412| 116| return 0; 413| 1.11k|} PQCLEAN_MCELIECE460896_AVX2_genpoly_gen: 88| 1.15k|int genpoly_gen(gf *out, gf *f) { 89| 1.15k| int i, j, k; 90| | 91| 1.15k| gf t, inv; 92| | 93| 1.15k| uint64_t m; 94| 1.15k| vec128 mask; 95| | 96| 1.15k| union { 97| 1.15k| uint64_t d[ GFBITS ][ 128 ][2]; 98| 1.15k| vec128 v[ GFBITS ][ 128 ]; 99| 1.15k| } buf; 100| | 101| 1.15k| union { 102| 1.15k| uint64_t d[GFBITS][2]; 103| 1.15k| vec128 v[GFBITS]; 104| 1.15k| } v; 105| | 106| 1.15k| union { 107| 1.15k| uint64_t d[SYS_T][GFBITS][2]; 108| 1.15k| vec128 v[SYS_T][GFBITS]; 109| 1.15k| } mat; 110| | 111| | // fill matrix 112| | 113| 1.15k| buf.v[0][0] = vec128_set2x(1, 0); 114| 14.9k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 14.9k|#define GFBITS 13 ------------------ | Branch (114:17): [True: 13.8k, False: 1.15k] ------------------ 115| 13.8k| buf.v[i][0] = vec128_setzero(); 116| 13.8k| } 117| | 118| 16.1k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 16.1k|#define GFBITS 13 ------------------ | Branch (118:17): [True: 14.9k, False: 1.15k] ------------------ 119| 14.9k| v.v[j] = vec128_setzero(); 120| | 121| 1.45M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 14.9k|#define SYS_T 96 ------------------ | Branch (121:29): [True: 1.43M, False: 14.9k] ------------------ 122| 1.43M| v.d[j][1] <<= 1; 123| 1.43M| v.d[j][1] |= v.d[j][0] >> 63; 124| 1.43M| v.d[j][0] <<= 1; 125| 1.43M| v.d[j][0] |= (f[i] >> j) & 1; 126| 1.43M| } 127| 14.9k| } 128| | 129| 16.1k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 16.1k|#define GFBITS 13 ------------------ | Branch (129:17): [True: 14.9k, False: 1.15k] ------------------ 130| 14.9k| buf.v[i][1] = v.v[i]; 131| 14.9k| } 132| | 133| 110k| for (k = 2; k <= SYS_T; k++) { ------------------ | | 8| 110k|#define SYS_T 96 ------------------ | Branch (133:17): [True: 109k, False: 1.15k] ------------------ 134| 109k| vec128_mul_GF(v.v, v.v, f); ------------------ | | 11| 109k|#define vec128_mul_GF CRYPTO_NAMESPACE(vec128_mul_GF) | | ------------------ | | | | 4| 109k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 135| | 136| 109k| if (k < SYS_T) { ------------------ | | 8| 109k|#define SYS_T 96 ------------------ | Branch (136:13): [True: 108k, False: 1.15k] ------------------ 137| 1.51M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.51M|#define GFBITS 13 ------------------ | Branch (137:25): [True: 1.40M, False: 108k] ------------------ 138| 1.40M| buf.v[i][k] = v.v[i]; 139| 1.40M| } 140| 108k| } else { 141| 111k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 111k|#define SYS_T 96 ------------------ | Branch (141:25): [True: 110k, False: 1.15k] ------------------ 142| 110k| out[i] = extract_gf(v.d, i); 143| 110k| } 144| 1.15k| } 145| 109k| } 146| | 147| 16.1k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 16.1k|#define GFBITS 13 ------------------ | Branch (147:17): [True: 14.9k, False: 1.15k] ------------------ 148| 14.9k| transpose_128x128(buf.d[i]); 149| 14.9k| } 150| | 151| 111k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 111k|#define SYS_T 96 ------------------ | Branch (151:17): [True: 110k, False: 1.15k] ------------------ 152| 1.54M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.54M|#define GFBITS 13 ------------------ | Branch (152:21): [True: 1.43M, False: 110k] ------------------ 153| 1.43M| mat.v[j][i] = buf.v[i][j]; 154| 1.43M| } 155| 110k| } 156| | 157| | // gaussian 158| | 159| 111k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 111k|#define SYS_T 96 ------------------ | Branch (159:17): [True: 110k, False: 1.15k] ------------------ 160| 5.36M| for (j = i + 1; j < SYS_T; j++) { ------------------ | | 8| 5.36M|#define SYS_T 96 ------------------ | Branch (160:25): [True: 5.25M, False: 110k] ------------------ 161| 5.25M| m = extract_bit(mat.d[i], i); 162| 5.25M| m -= 1; 163| 5.25M| mask = vec128_set2x(m, m); 164| | 165| 73.6M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 73.6M|#define GFBITS 13 ------------------ | Branch (165:25): [True: 68.3M, False: 5.25M] ------------------ 166| 68.3M| mat.v[i][k] ^= mat.v[j][k] & mask; 167| 68.3M| } 168| | 169| 5.25M| out[i] ^= out[j] & m; 170| 5.25M| } 171| | 172| | // 173| | 174| 110k| t = extract_gf(mat.d[i], i); 175| | 176| 110k| if (gf_is_zero_declassify(t)) { ------------------ | Branch (176:13): [True: 0, False: 110k] ------------------ 177| 0| return -1; // return if not systematic 178| 0| } 179| | 180| | // 181| | 182| 110k| inv = gf_inv(t); ------------------ | | 11| 110k|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 110k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 183| 110k| vec128_mul_gf(mat.v[i], mat.v[i], inv); 184| | 185| 110k| out[i] = gf_mul(out[i], inv); ------------------ | | 14| 110k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 110k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 186| | 187| 10.7M| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 10.7M|#define SYS_T 96 ------------------ | Branch (187:21): [True: 10.6M, False: 110k] ------------------ 188| 10.6M| if (j != i) { ------------------ | Branch (188:17): [True: 10.5M, False: 110k] ------------------ 189| 10.5M| t = extract_gf(mat.d[j], i); 190| | 191| 10.5M| vec128_mul_gf(v.v, mat.v[i], t); 192| 10.5M| vec128_add(mat.v[j], mat.v[j], v.v); 193| | 194| 10.5M| out[j] ^= gf_mul(out[i], t); ------------------ | | 14| 10.5M|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 10.5M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 195| 10.5M| } 196| 10.6M| } 197| 110k| } 198| | 199| 1.15k| return 0; 200| 1.15k|} sk_gen.c:transpose_128x128: 52| 56.7k|static void transpose_128x128(uint64_t (*in)[2]) { 53| 56.7k| int i, j, k; 54| 56.7k| uint64_t m[2][2][64], t; 55| | 56| 170k| for (i = 0; i < 2; i++) { ------------------ | Branch (56:17): [True: 113k, False: 56.7k] ------------------ 57| 340k| for (j = 0; j < 2; j++) { ------------------ | Branch (57:21): [True: 226k, False: 113k] ------------------ 58| 14.7M| for (k = 0; k < 64; k++) { ------------------ | Branch (58:25): [True: 14.5M, False: 226k] ------------------ 59| 14.5M| m[i][j][k] = in[64 * i + k][j]; 60| 14.5M| } 61| 226k| } 62| 113k| } 63| | 64| 3.68M| for (k = 0; k < 64; k++) { ------------------ | Branch (64:17): [True: 3.63M, False: 56.7k] ------------------ 65| 3.63M| t = m[0][1][k]; 66| 3.63M| m[0][1][k] = m[1][0][k]; 67| 3.63M| m[1][0][k] = t; 68| 3.63M| } 69| | 70| 170k| for (i = 0; i < 2; i++) { ------------------ | Branch (70:17): [True: 113k, False: 56.7k] ------------------ 71| 340k| for (j = 0; j < 2; j++) { ------------------ | Branch (71:21): [True: 226k, False: 113k] ------------------ 72| 226k| transpose_64x64(m[i][j]); 73| 226k| } 74| 113k| } 75| | 76| 170k| for (i = 0; i < 2; i++) { ------------------ | Branch (76:17): [True: 113k, False: 56.7k] ------------------ 77| 340k| for (j = 0; j < 2; j++) { ------------------ | Branch (77:21): [True: 226k, False: 113k] ------------------ 78| 14.7M| for (k = 0; k < 64; k++) { ------------------ | Branch (78:25): [True: 14.5M, False: 226k] ------------------ 79| 14.5M| in[64 * i + k][j] = m[i][j][k]; 80| 14.5M| } 81| 226k| } 82| 113k| } 83| 56.7k|} fft.c:transpose_64x256_sp: 31| 41.1k|static inline void transpose_64x256_sp(vec256 *in) { 32| 41.1k| transpose_64x256_sp_asm(in); ------------------ | | 10| 41.1k|#define transpose_64x256_sp_asm CRYPTO_NAMESPACE(transpose_64x256_sp_asm) | | ------------------ | | | | 4| 41.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 33| 41.1k|} benes.c:transpose_64x128_sp: 25| 10.5k|static inline void transpose_64x128_sp(vec128 *in) { 26| 10.5k| transpose_64x128_sp_asm(in); ------------------ | | 9| 10.5k|#define transpose_64x128_sp_asm CRYPTO_NAMESPACE(transpose_64x128_sp_asm) | | ------------------ | | | | 4| 10.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 27| 10.5k|} benes.c:load16: 100| 314k|static inline vec128 load16(const unsigned char *in) { 101| 314k| return vec128_set2x( load8(in), load8(in + 8) ); 102| 314k|} PQCLEAN_MCELIECE460896_AVX2_vec128_mul_GF: 6| 109k|void vec128_mul_GF(vec128 out[ GFBITS ], vec128 v[ GFBITS ], gf a[ SYS_T ]) { 7| 109k| int i, j; 8| 109k| uint64_t buf[GFBITS][3]; 9| 109k| vec128 prod[GFBITS]; 10| 109k| uint64_t p[GFBITS]; 11| | 12| 109k| const uint64_t allone = -1; 13| | 14| | // polynomial multiplication 15| | 16| 1.53M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.53M|#define GFBITS 13 ------------------ | Branch (16:17): [True: 1.42M, False: 109k] ------------------ 17| 1.42M| buf[i][0] = 0; 18| 1.42M| buf[i][1] = 0; 19| 1.42M| buf[i][2] = 0; 20| 1.42M| } 21| | 22| 10.6M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 109k|#define SYS_T 96 ------------------ | Branch (22:25): [True: 10.5M, False: 109k] ------------------ 23| 147M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 147M|#define GFBITS 13 ------------------ | Branch (23:21): [True: 136M, False: 10.5M] ------------------ 24| 136M| buf[j][2] <<= 1; 25| 136M| buf[j][2] |= buf[j][1] >> 63; 26| 136M| buf[j][1] <<= 1; 27| 136M| buf[j][1] |= buf[j][0] >> 63; 28| 136M| buf[j][0] <<= 1; 29| 136M| } 30| | 31| 10.5M| vec128_mul_gf(prod, v, a[i]); 32| | 33| 147M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 147M|#define GFBITS 13 ------------------ | Branch (33:21): [True: 136M, False: 10.5M] ------------------ 34| 136M| buf[j][0] ^= vec128_extract(prod[j], 0); ------------------ | | 29| 136M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 35| 136M| buf[j][1] ^= vec128_extract(prod[j], 1); ------------------ | | 29| 136M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 36| 136M| } 37| 10.5M| } 38| | 39| | // reduction modulo y^96+y^10+y^9+y^6+1 40| | 41| 1.53M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.53M|#define GFBITS 13 ------------------ | Branch (41:17): [True: 1.42M, False: 109k] ------------------ 42| 1.42M| p[i] = buf[i][2]; 43| | 44| 1.42M| buf[i][1] ^= p[i] >> (SYS_T - 10 - 64); ------------------ | | 8| 1.42M|#define SYS_T 96 ------------------ 45| 1.42M| buf[i][0] ^= p[i] << (64 - (SYS_T - 10 - 64)); ------------------ | | 8| 1.42M|#define SYS_T 96 ------------------ 46| 1.42M| buf[i][1] ^= p[i] >> (SYS_T - 9 - 64); ------------------ | | 8| 1.42M|#define SYS_T 96 ------------------ 47| 1.42M| buf[i][0] ^= p[i] << (64 - (SYS_T - 9 - 64)); ------------------ | | 8| 1.42M|#define SYS_T 96 ------------------ 48| 1.42M| buf[i][1] ^= p[i] >> (SYS_T - 6 - 64); ------------------ | | 8| 1.42M|#define SYS_T 96 ------------------ 49| 1.42M| buf[i][0] ^= p[i] << (64 - (SYS_T - 6 - 64)); ------------------ | | 8| 1.42M|#define SYS_T 96 ------------------ 50| 1.42M| buf[i][1] ^= p[i] >> (SYS_T - 64); ------------------ | | 8| 1.42M|#define SYS_T 96 ------------------ 51| 1.42M| buf[i][0] ^= p[i] << (64 - (SYS_T - 64)); ------------------ | | 8| 1.42M|#define SYS_T 96 ------------------ 52| 1.42M| } 53| | 54| | // 55| | 56| 1.53M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.53M|#define GFBITS 13 ------------------ | Branch (56:17): [True: 1.42M, False: 109k] ------------------ 57| 1.42M| p[i] = buf[i][1] & (allone << 32); 58| | 59| 1.42M| buf[i][0] ^= p[i] >> (SYS_T - 10 - 64); ------------------ | | 8| 1.42M|#define SYS_T 96 ------------------ 60| 1.42M| buf[i][0] ^= p[i] >> (SYS_T - 9 - 64); ------------------ | | 8| 1.42M|#define SYS_T 96 ------------------ 61| 1.42M| buf[i][0] ^= p[i] >> (SYS_T - 6 - 64); ------------------ | | 8| 1.42M|#define SYS_T 96 ------------------ 62| 1.42M| buf[i][0] ^= p[i] >> (SYS_T - 64); ------------------ | | 8| 1.42M|#define SYS_T 96 ------------------ 63| 1.42M| } 64| | 65| | // 66| | 67| 1.53M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.53M|#define GFBITS 13 ------------------ | Branch (67:17): [True: 1.42M, False: 109k] ------------------ 68| 1.42M| out[i] = vec128_set2x(buf[i][0], buf[i][1] & 0xFFFFFFFF); 69| 1.42M| } 70| 109k|} pk_gen.c:vec128_set2x: 46| 56.7k|static inline vec128 vec128_set2x(uint64_t a0, uint64_t a1) { 47| 56.7k| return _mm_set_epi64x(a1, a0); 48| 56.7k|} sk_gen.c:vec128_setzero: 25| 109k|static inline vec128 vec128_setzero(void) { 26| 109k| return _mm_setzero_si128(); 27| 109k|} sk_gen.c:vec128_xor: 35| 768M|static inline vec128 vec128_xor(vec128 a, vec128 b) { 36| 768M| return _mm_xor_si128(a, b); 37| 768M|} sk_gen.c:vec128_set2x: 46| 804M|static inline vec128 vec128_set2x(uint64_t a0, uint64_t a1) { 47| 804M| return _mm_set_epi64x(a1, a0); 48| 804M|} sk_gen.c:vec128_add: 70| 59.1M|static inline void vec128_add(vec128 *c, vec128 *a, vec128 *b) { 71| 59.1M| int i; 72| | 73| 827M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 827M|#define GFBITS 13 ------------------ | Branch (73:17): [True: 768M, False: 59.1M] ------------------ 74| 768M| c[i] = vec128_xor(a[i], b[i]); 75| 768M| } 76| 59.1M|} sk_gen.c:vec128_mul: 93| 59.6M|static inline void vec128_mul(vec128 *h, vec128 *f, const vec128 *g) { 94| 59.6M| vec128_mul_asm(h, f, g, 16); ------------------ | | 10| 59.6M|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 59.6M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 95| 59.6M|} sk_gen.c:vec128_mul_gf: 97| 59.6M|static inline void vec128_mul_gf(vec128 out[ GFBITS ], vec128 v[ GFBITS ], gf a) { 98| 59.6M| int i; 99| | 100| 59.6M| uint64_t b; 101| 59.6M| vec128 bits[GFBITS]; 102| | 103| 834M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 834M|#define GFBITS 13 ------------------ | Branch (103:17): [True: 775M, False: 59.6M] ------------------ 104| 775M| b = -((a >> i) & 1); 105| 775M| bits[i] = vec128_set2x(b, b); 106| 775M| } 107| | 108| 59.6M| vec128_mul(out, v, bits); 109| 59.6M|} vec128.c:vec128_mul_gf: 97| 59.1M|static inline void vec128_mul_gf(vec128 out[ GFBITS ], vec128 v[ GFBITS ], gf a) { 98| 59.1M| int i; 99| | 100| 59.1M| uint64_t b; 101| 59.1M| vec128 bits[GFBITS]; 102| | 103| 827M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 827M|#define GFBITS 13 ------------------ | Branch (103:17): [True: 768M, False: 59.1M] ------------------ 104| 768M| b = -((a >> i) & 1); 105| 768M| bits[i] = vec128_set2x(b, b); 106| 768M| } 107| | 108| 59.1M| vec128_mul(out, v, bits); 109| 59.1M|} vec128.c:vec128_mul: 93| 59.1M|static inline void vec128_mul(vec128 *h, vec128 *f, const vec128 *g) { 94| 59.1M| vec128_mul_asm(h, f, g, 16); ------------------ | | 10| 59.1M|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 59.1M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 95| 59.1M|} vec128.c:vec128_set2x: 46| 775M|static inline vec128 vec128_set2x(uint64_t a0, uint64_t a1) { 47| 775M| return _mm_set_epi64x(a1, a0); 48| 775M|} fft.c:vec128_and: 31| 2.29M|static inline vec128 vec128_and(vec128 a, vec128 b) { 32| 2.29M| return _mm_and_si128(a, b); 33| 2.29M|} fft.c:vec128_xor: 35| 2.29M|static inline vec128 vec128_xor(vec128 a, vec128 b) { 36| 2.29M| return _mm_xor_si128(a, b); 37| 2.29M|} fft.c:vec128_set2x: 46| 1.20M|static inline vec128 vec128_set2x(uint64_t a0, uint64_t a1) { 47| 1.20M| return _mm_set_epi64x(a1, a0); 48| 1.20M|} fft.c:vec128_unpack_low: 50| 381k|static inline vec128 vec128_unpack_low(vec128 a, vec128 b) { 51| 381k| return _mm_unpacklo_epi64(a, b); 52| 381k|} fft.c:vec128_unpack_high: 54| 381k|static inline vec128 vec128_unpack_high(vec128 a, vec128 b) { 55| 381k| return _mm_unpackhi_epi64(a, b); 56| 381k|} fft.c:vec128_mul: 93| 52.8k|static inline void vec128_mul(vec128 *h, vec128 *f, const vec128 *g) { 94| 52.8k| vec128_mul_asm(h, f, g, 16); ------------------ | | 10| 52.8k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 52.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 95| 52.8k|} fft_tr.c:vec128_xor: 35| 98.2k|static inline vec128 vec128_xor(vec128 a, vec128 b) { 36| 98.2k| return _mm_xor_si128(a, b); 37| 98.2k|} fft_tr.c:vec128_setbits: 58| 117k|static inline vec128 vec128_setbits(uint64_t a) { 59| 117k| return _mm_set1_epi64x(-a); 60| 117k|} benes.c:vec128_and: 31| 1.20M|static inline vec128 vec128_and(vec128 a, vec128 b) { 32| 1.20M| return _mm_and_si128(a, b); 33| 1.20M|} benes.c:vec128_xor: 35| 3.62M|static inline vec128 vec128_xor(vec128 a, vec128 b) { 36| 3.62M| return _mm_xor_si128(a, b); 37| 3.62M|} benes.c:vec128_set2x: 46| 604k|static inline vec128 vec128_set2x(uint64_t a0, uint64_t a1) { 47| 604k| return _mm_set_epi64x(a1, a0); 48| 604k|} benes.c:vec128_unpack_low: 50| 338k|static inline vec128 vec128_unpack_low(vec128 a, vec128 b) { 51| 338k| return _mm_unpacklo_epi64(a, b); 52| 338k|} benes.c:vec128_unpack_high: 54| 338k|static inline vec128 vec128_unpack_high(vec128 a, vec128 b) { 55| 338k| return _mm_unpackhi_epi64(a, b); 56| 338k|} bm.c:vec128_xor: 35| 2.29M|static inline vec128 vec128_xor(vec128 a, vec128 b) { 36| 2.29M| return _mm_xor_si128(a, b); 37| 2.29M|} bm.c:vec128_set2x: 46| 6.49k|static inline vec128 vec128_set2x(uint64_t a0, uint64_t a1) { 47| 6.49k| return _mm_set_epi64x(a1, a0); 48| 6.49k|} bm.c:vec128_setbits: 58| 4.59M|static inline vec128 vec128_setbits(uint64_t a) { 59| 4.59M| return _mm_set1_epi64x(-a); 60| 4.59M|} PQCLEAN_MCELIECE460896_AVX2_vec256_sq: 9| 18.9k|void vec256_sq(vec256 *out, vec256 *in) { 10| 18.9k| int i; 11| 18.9k| vec256 result[GFBITS], t; 12| | 13| 18.9k| t = vec256_xor(in[11], in[12]); 14| | 15| 18.9k| result[0] = vec256_xor(in[0], in[11]); 16| 18.9k| result[1] = vec256_xor(in[7], t); 17| 18.9k| result[2] = vec256_xor(in[1], in[7]); 18| 18.9k| result[3] = vec256_xor(in[8], t); 19| 18.9k| result[4] = vec256_xor(in[2], in[7]); 20| 18.9k| result[4] = vec256_xor(result[4], in[8]); 21| 18.9k| result[4] = vec256_xor(result[4], t); 22| 18.9k| result[5] = vec256_xor(in[7], in[9]); 23| 18.9k| result[6] = vec256_xor(in[3], in[8]); 24| 18.9k| result[6] = vec256_xor(result[6], in[9]); 25| 18.9k| result[6] = vec256_xor(result[6], in[12]); 26| 18.9k| result[7] = vec256_xor(in[8], in[10]); 27| 18.9k| result[8] = vec256_xor(in[4], in[9]); 28| 18.9k| result[8] = vec256_xor(result[8], in[10]); 29| 18.9k| result[9] = vec256_xor(in[9], in[11]); 30| 18.9k| result[10] = vec256_xor(in[5], in[10]); 31| 18.9k| result[10] = vec256_xor(result[10], in[11]); 32| 18.9k| result[11] = vec256_xor(in[10], in[12]); 33| 18.9k| result[12] = vec256_xor(in[6], t); 34| | 35| 265k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 265k|#define GFBITS 13 ------------------ | Branch (35:17): [True: 246k, False: 18.9k] ------------------ 36| 246k| out[i] = result[i]; 37| 246k| } 38| 18.9k|} PQCLEAN_MCELIECE460896_AVX2_vec256_inv: 41| 1.26k|void vec256_inv(vec256 *out, vec256 *in) { 42| 1.26k| vec256 tmp_11[ GFBITS ]; 43| 1.26k| vec256 tmp_1111[ GFBITS ]; 44| | 45| 1.26k| vec256_copy(out, in); 46| | 47| 1.26k| vec256_sq(out, out); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 48| 1.26k| vec256_mul(tmp_11, out, in); // ^11 49| | 50| 1.26k| vec256_sq(out, tmp_11); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 51| 1.26k| vec256_sq(out, out); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 52| 1.26k| vec256_mul(tmp_1111, out, tmp_11); // ^1111 53| | 54| 1.26k| vec256_sq(out, tmp_1111); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 55| 1.26k| vec256_sq(out, out); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 56| 1.26k| vec256_sq(out, out); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 57| 1.26k| vec256_sq(out, out); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 58| 1.26k| vec256_mul(out, out, tmp_1111); // ^11111111 59| | 60| 1.26k| vec256_sq(out, out); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 61| 1.26k| vec256_sq(out, out); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 62| 1.26k| vec256_sq(out, out); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 63| 1.26k| vec256_sq(out, out); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 64| 1.26k| vec256_mul(out, out, tmp_1111); // ^111111111111 65| | 66| 1.26k| vec256_sq(out, out); // ^1111111111110 ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 67| 1.26k|} vec256.c:vec256_xor: 49| 1.71M|static inline vec256 vec256_xor(vec256 a, vec256 b) { 50| 1.71M| return _mm256_xor_si256(a, b); 51| 1.71M|} decrypt.c:vec256_testz: 41| 756|static inline int vec256_testz(vec256 a) { 42| 756| return _mm256_testz_si256(a, a); 43| 756|} fft_tr.c:vec256_and: 45| 589k|static inline vec256 vec256_and(vec256 a, vec256 b) { 46| 589k| return _mm256_and_si256(a, b); 47| 589k|} bm.c:vec256_setzero: 30| 2.26k|static inline vec256 vec256_setzero(void) { 31| 2.26k| return _mm256_setzero_si256(); 32| 2.26k|} bm.c:vec256_set1_16b: 22| 6.04k|static inline vec256 vec256_set1_16b(uint16_t a) { 23| 6.04k| return _mm256_set1_epi16(a); 24| 6.04k|} bm.c:vec256_or: 53| 48.3k|static inline vec256 vec256_or(vec256 a, vec256 b) { 54| 48.3k| return _mm256_or_si256(a, b); 55| 48.3k|} bm.c:vec256_and: 45| 96.7k|static inline vec256 vec256_and(vec256 a, vec256 b) { 46| 96.7k| return _mm256_and_si256(a, b); 47| 96.7k|} bm.c:vec256_mul: 99| 176k|static inline void vec256_mul(vec256 *h, vec256 *f, const vec256 *g) { 100| 176k| vec256_mul_asm(h, f, g); ------------------ | | 13| 176k|#define vec256_mul_asm CRYPTO_NAMESPACE(vec256_mul_asm) | | ------------------ | | | | 4| 176k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896_AVX2_ ## fun | | ------------------ ------------------ 101| 176k|} gf.c:gf_sqmul: 85| 1.01M|static inline gf gf_sqmul(gf in, gf m) { 86| 1.01M| int i; 87| | 88| 1.01M| uint64_t x; 89| 1.01M| uint64_t t0; 90| 1.01M| uint64_t t1; 91| 1.01M| uint64_t t; 92| | 93| 1.01M| const uint64_t M[] = {0x0000001FF0000000, 94| 1.01M| 0x000000000FF80000, 95| 1.01M| 0x000000000007E000 96| 1.01M| }; 97| | 98| 1.01M| t0 = in; 99| 1.01M| t1 = m; 100| | 101| 1.01M| x = (t1 << 6) * (t0 & (1 << 6)); 102| | 103| 1.01M| t0 ^= (t0 << 7); 104| | 105| 1.01M| x ^= (t1 * (t0 & (0x04001))); 106| 1.01M| x ^= (t1 * (t0 & (0x08002))) << 1; 107| 1.01M| x ^= (t1 * (t0 & (0x10004))) << 2; 108| 1.01M| x ^= (t1 * (t0 & (0x20008))) << 3; 109| 1.01M| x ^= (t1 * (t0 & (0x40010))) << 4; 110| 1.01M| x ^= (t1 * (t0 & (0x80020))) << 5; 111| | 112| 4.05M| for (i = 0; i < 3; i++) { ------------------ | Branch (112:17): [True: 3.04M, False: 1.01M] ------------------ 113| 3.04M| t = x & M[i]; 114| 3.04M| x ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 115| 3.04M| } 116| | 117| 1.01M| return x & GFMASK; ------------------ | | 19| 1.01M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 1.01M|#define GFBITS 13 | | ------------------ ------------------ 118| 1.01M|} gf.c:gf_sq2mul: 122| 1.52M|static inline gf gf_sq2mul(gf in, gf m) { 123| 1.52M| int i; 124| | 125| 1.52M| uint64_t x; 126| 1.52M| uint64_t t0; 127| 1.52M| uint64_t t1; 128| 1.52M| uint64_t t; 129| | 130| 1.52M| const uint64_t M[] = {0x1FF0000000000000, 131| 1.52M| 0x000FF80000000000, 132| 1.52M| 0x000007FC00000000, 133| 1.52M| 0x00000003FE000000, 134| 1.52M| 0x0000000001FE0000, 135| 1.52M| 0x000000000001E000 136| 1.52M| }; 137| | 138| 1.52M| t0 = in; 139| 1.52M| t1 = m; 140| | 141| 1.52M| x = (t1 << 18) * (t0 & (1 << 6)); 142| | 143| 1.52M| t0 ^= (t0 << 21); 144| | 145| 1.52M| x ^= (t1 * (t0 & (0x010000001))); 146| 1.52M| x ^= (t1 * (t0 & (0x020000002))) << 3; 147| 1.52M| x ^= (t1 * (t0 & (0x040000004))) << 6; 148| 1.52M| x ^= (t1 * (t0 & (0x080000008))) << 9; 149| 1.52M| x ^= (t1 * (t0 & (0x100000010))) << 12; 150| 1.52M| x ^= (t1 * (t0 & (0x200000020))) << 15; 151| | 152| 10.6M| for (i = 0; i < 6; i++) { ------------------ | Branch (152:17): [True: 9.12M, False: 1.52M] ------------------ 153| 9.12M| t = x & M[i]; 154| 9.12M| x ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 155| 9.12M| } 156| | 157| 1.52M| return x & GFMASK; ------------------ | | 19| 1.52M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 1.52M|#define GFBITS 13 | | ------------------ ------------------ 158| 1.52M|} gf.c:gf_sq2: 52| 1.01M|static inline gf gf_sq2(gf in) { 53| 1.01M| int i; 54| | 55| 1.01M| const uint64_t B[] = {0x1111111111111111, 56| 1.01M| 0x0303030303030303, 57| 1.01M| 0x000F000F000F000F, 58| 1.01M| 0x000000FF000000FF 59| 1.01M| }; 60| | 61| 1.01M| const uint64_t M[] = {0x0001FF0000000000, 62| 1.01M| 0x000000FF80000000, 63| 1.01M| 0x000000007FC00000, 64| 1.01M| 0x00000000003FE000 65| 1.01M| }; 66| | 67| 1.01M| uint64_t x = in; 68| 1.01M| uint64_t t; 69| | 70| 1.01M| x = (x | (x << 24)) & B[3]; 71| 1.01M| x = (x | (x << 12)) & B[2]; 72| 1.01M| x = (x | (x << 6)) & B[1]; 73| 1.01M| x = (x | (x << 3)) & B[0]; 74| | 75| 5.07M| for (i = 0; i < 4; i++) { ------------------ | Branch (75:17): [True: 4.05M, False: 1.01M] ------------------ 76| 4.05M| t = x & M[i]; 77| 4.05M| x ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 78| 4.05M| } 79| | 80| 1.01M| return x & GFMASK; ------------------ | | 19| 1.01M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 1.01M|#define GFBITS 13 | | ------------------ ------------------ 81| 1.01M|} PQCLEAN_MCELIECE460896F_AVX2_load_bits: 188| 92|void load_bits(vec128 bits_int[][32], const unsigned char *bits) { 189| 92| int i, j; 190| 92| const unsigned char *ptr = bits; 191| | 192| 92| vec128 buf[64]; 193| | 194| 368| for (i = 0; i <= 5; i += 2) { ------------------ | Branch (194:17): [True: 276, False: 92] ------------------ 195| 17.9k| for (j = 0; j < 64; j++) { ------------------ | Branch (195:21): [True: 17.6k, False: 276] ------------------ 196| 17.6k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 197| 17.6k| ptr += 8; 198| 17.6k| } 199| | 200| 276| transpose_64x128_sp( buf ); 201| | 202| 9.10k| for (j = 0; j < 32; j++) { ------------------ | Branch (202:21): [True: 8.83k, False: 276] ------------------ 203| 8.83k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 204| 8.83k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 205| 8.83k| } 206| | 207| 276| ptr += 512; 208| 276| } 209| | 210| 1.28k| for (i = 6; i <= 18; i++) { ------------------ | Branch (210:17): [True: 1.19k, False: 92] ------------------ 211| 39.4k| for (j = 0; j < 32; j++) { ------------------ | Branch (211:21): [True: 38.2k, False: 1.19k] ------------------ 212| 38.2k| bits_int[i][j] = load16(ptr); 213| 38.2k| ptr += 16; 214| 38.2k| } 215| 1.19k| } 216| | 217| 368| for (i = 19; i < 25; i += 2) { ------------------ | Branch (217:18): [True: 276, False: 92] ------------------ 218| 17.9k| for (j = 0; j < 64; j++) { ------------------ | Branch (218:21): [True: 17.6k, False: 276] ------------------ 219| 17.6k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 220| 17.6k| ptr += 8; 221| 17.6k| } 222| | 223| 276| transpose_64x128_sp( buf ); 224| | 225| 9.10k| for (j = 0; j < 32; j++) { ------------------ | Branch (225:21): [True: 8.83k, False: 276] ------------------ 226| 8.83k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 227| 8.83k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 228| 8.83k| } 229| | 230| 276| ptr += 512; 231| 276| } 232| 92|} PQCLEAN_MCELIECE460896F_AVX2_benes: 238| 184|void benes(vec128 *r, vec128 b[][32], int rev) { 239| 184| int inc; 240| | 241| 184| vec128 *b_ptr; 242| | 243| 184| if (rev == 0) { ------------------ | Branch (243:9): [True: 92, False: 92] ------------------ 244| 92| inc = 32; 245| 92| b_ptr = b[ 0]; 246| 92| } else { 247| 92| inc = -32; 248| 92| b_ptr = b[24]; 249| 92| } 250| | 251| | // 252| | 253| 184| transpose_64x128_sp( r ); 254| | 255| 184| layer_0(r, b_ptr); 256| 184| b_ptr += inc; 257| 184| layer_1(r, b_ptr); 258| 184| b_ptr += inc; 259| 184| layer_2(r, b_ptr); 260| 184| b_ptr += inc; 261| 184| layer_3(r, b_ptr); 262| 184| b_ptr += inc; 263| 184| layer_4(r, b_ptr); 264| 184| b_ptr += inc; 265| 184| layer_5(r, b_ptr); 266| 184| b_ptr += inc; 267| | 268| 184| transpose_64x128_sp( r ); 269| | 270| 184| layer_x(r, b_ptr); 271| 184| b_ptr += inc; 272| 184| layer_0(r, b_ptr); 273| 184| b_ptr += inc; 274| 184| layer_1(r, b_ptr); 275| 184| b_ptr += inc; 276| 184| layer_2(r, b_ptr); 277| 184| b_ptr += inc; 278| 184| layer_3(r, b_ptr); 279| 184| b_ptr += inc; 280| 184| layer_4(r, b_ptr); 281| 184| b_ptr += inc; 282| 184| layer_5(r, b_ptr); 283| 184| b_ptr += inc; 284| 184| layer_4(r, b_ptr); 285| 184| b_ptr += inc; 286| 184| layer_3(r, b_ptr); 287| 184| b_ptr += inc; 288| 184| layer_2(r, b_ptr); 289| 184| b_ptr += inc; 290| 184| layer_1(r, b_ptr); 291| 184| b_ptr += inc; 292| 184| layer_0(r, b_ptr); 293| 184| b_ptr += inc; 294| 184| layer_x(r, b_ptr); 295| 184| b_ptr += inc; 296| | 297| 184| transpose_64x128_sp( r ); 298| | 299| 184| layer_5(r, b_ptr); 300| 184| b_ptr += inc; 301| 184| layer_4(r, b_ptr); 302| 184| b_ptr += inc; 303| 184| layer_3(r, b_ptr); 304| 184| b_ptr += inc; 305| 184| layer_2(r, b_ptr); 306| 184| b_ptr += inc; 307| 184| layer_1(r, b_ptr); 308| 184| b_ptr += inc; 309| 184| layer_0(r, b_ptr); 310| | 311| 184| transpose_64x128_sp( r ); 312| 184|} PQCLEAN_MCELIECE460896F_AVX2_bm: 147| 92|void bm(vec128 *out, vec256 *in) { 148| 92| int i; 149| 92| uint16_t N, L; 150| 92| uint16_t mask; 151| 92| uint64_t one = 1; 152| 92| uint64_t v[2]; 153| | 154| 92| typedef union { 155| 92| vec128 v[GFBITS][2]; 156| 92| vec256 V[GFBITS]; 157| 92| } db_t; 158| | 159| 92| vec128 prod[ GFBITS ]; 160| 92| vec128 interval[GFBITS]; 161| | 162| 92| db_t db; 163| 92| db_t BC_tmp; 164| 92| db_t BC; 165| | 166| 92| gf d, b; 167| 92| gf coefs[256]; 168| | 169| | // initialization 170| | 171| 92| get_coefs(coefs, in); 172| | 173| 92| BC.v[0][0] = vec128_set2x(0, one << 62); 174| 92| BC.v[0][1] = vec128_set2x(0, one << 63); 175| | 176| 1.19k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.19k|#define GFBITS 13 ------------------ | Branch (176:17): [True: 1.10k, False: 92] ------------------ 177| 1.10k| BC.v[i][0] = BC.v[i][1] = vec128_setzero(); 178| 1.10k| } 179| | 180| 92| b = 1; 181| 92| L = 0; 182| | 183| | // 184| | 185| 1.28k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.28k|#define GFBITS 13 ------------------ | Branch (185:17): [True: 1.19k, False: 92] ------------------ 186| 1.19k| interval[i] = vec128_setzero(); 187| 1.19k| } 188| | 189| 17.7k| for (N = 0; N < SYS_T * 2; N++) { ------------------ | | 8| 17.7k|#define SYS_T 96 ------------------ | Branch (189:17): [True: 17.6k, False: 92] ------------------ 190| 17.6k| update_asm(interval, coefs[N], 16); ------------------ | | 1| 17.6k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 17.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 191| 17.6k| vec128_mul_asm(prod, interval, BC.v[0] + 1, 32); ------------------ | | 10| 17.6k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 17.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 192| | 193| 17.6k| d = vec_reduce_asm(prod); ------------------ | | 3| 17.6k|#define vec_reduce_asm CRYPTO_NAMESPACE(vec_reduce_asm) | | ------------------ | | | | 4| 17.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 194| | 195| 17.6k| mask = mask_nonzero(d) & mask_leq(L * 2, N); 196| | 197| 247k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 247k|#define GFBITS 13 ------------------ | Branch (197:21): [True: 229k, False: 17.6k] ------------------ 198| 229k| db.v[i][0] = vec128_setbits((d >> i) & 1); 199| 229k| db.v[i][1] = vec128_setbits((b >> i) & 1); 200| 229k| } 201| | 202| 17.6k| vec256_mul((vec256 *)BC_tmp.V, (vec256 *)db.V, (vec256 *)BC.V); 203| | 204| 17.6k| vec128_cmov(BC.v, mask); 205| 17.6k| update_asm(BC.v, 0, 32); ------------------ | | 1| 17.6k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 17.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 247k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 247k|#define GFBITS 13 ------------------ | Branch (207:21): [True: 229k, False: 17.6k] ------------------ 208| 229k| BC.v[i][1] = vec128_xor(BC_tmp.v[i][0], BC_tmp.v[i][1]); 209| 229k| } 210| | 211| 17.6k| b = (d & mask) | (b & ~mask); 212| 17.6k| L = ((N + 1 - L) & mask) | (L & ~mask); 213| 17.6k| } 214| | 215| 1.28k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.28k|#define GFBITS 13 ------------------ | Branch (215:17): [True: 1.19k, False: 92] ------------------ 216| 1.19k| v[0] = vec128_extract(BC.v[i][1], 0); ------------------ | | 29| 1.19k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 217| 1.19k| v[1] = vec128_extract(BC.v[i][1], 1); ------------------ | | 29| 1.19k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 218| | 219| 1.19k| out[i] = vec128_set2x((v[0] >> 31) | (v[1] << 33), v[1] >> 31); 220| 1.19k| } 221| 92|} PQCLEAN_MCELIECE460896F_AVX2_controlbitsfrompermutation: 205| 92|void controlbitsfrompermutation(unsigned char *out, const int16 *pi, long long w, long long n) { 206| 92| PQCLEAN_VLA(int32, temp, (size_t)(2 * n)); ------------------ | | 57| 92|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 207| 92| PQCLEAN_VLA(int16, pi_test, (size_t)n); ------------------ | | 57| 92|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 208| 92| int16 diff; 209| 92| int i; 210| 92| unsigned char *ptr; 211| | 212| 92| OQS_MEM_cleanse(temp, (size_t)n * 2); 213| 92| OQS_MEM_cleanse(pi_test, (size_t)n); 214| | 215| 92| while (1) { ------------------ | Branch (215:12): [True: 92, Folded] ------------------ 216| 92| OQS_MEM_cleanse(out, (size_t)((((2 * w - 1)*n / 2) + 7) / 8)); 217| 92| cbrecursion(out, 0, 1, pi, w, n, temp); 218| | 219| | // check for correctness 220| | 221| 753k| for (i = 0; i < n; i++) { ------------------ | Branch (221:21): [True: 753k, False: 92] ------------------ 222| 753k| pi_test[i] = (int16)i; 223| 753k| } 224| | 225| 92| ptr = out; 226| 1.28k| for (i = 0; i < w; i++) { ------------------ | Branch (226:21): [True: 1.19k, False: 92] ------------------ 227| 1.19k| layer(pi_test, ptr, i, (int32)n); 228| 1.19k| ptr += n >> 4; 229| 1.19k| } 230| | 231| 1.19k| for (i = (int)(w - 2); i >= 0; i--) { ------------------ | Branch (231:32): [True: 1.10k, False: 92] ------------------ 232| 1.10k| layer(pi_test, ptr, i, (int32)n); 233| 1.10k| ptr += n >> 4; 234| 1.10k| } 235| | 236| 92| diff = 0; 237| 753k| for (i = 0; i < n; i++) { ------------------ | Branch (237:21): [True: 753k, False: 92] ------------------ 238| 753k| diff |= pi[i] ^ pi_test[i]; 239| 753k| } 240| | 241| 92| diff = crypto_int16_nonzero_mask(diff); ------------------ | | 12| 92|#define crypto_int16_nonzero_mask CRYPTO_NAMESPACE(crypto_int16_nonzero_mask) | | ------------------ | | | | 4| 92|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 242| 92| crypto_declassify(&diff, sizeof diff); 243| 92| if (diff == 0) { ------------------ | Branch (243:13): [True: 92, False: 0] ------------------ 244| 92| break; 245| 92| } 246| 92| } 247| 92|} PQCLEAN_MCELIECE460896F_AVX2_crypto_int16_negative_mask: 3| 184|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 4| 184| return crypto_int16_x >> 15; 5| 184|} PQCLEAN_MCELIECE460896F_AVX2_crypto_int16_nonzero_mask: 7| 92|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 8| 92| return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 92|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 92|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 92|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 92|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 9| 92|} PQCLEAN_MCELIECE460896F_AVX2_crypto_int32_negative_mask: 3| 58.7M|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 4| 58.7M| return crypto_int32_x >> 31; 5| 58.7M|} PQCLEAN_MCELIECE460896F_AVX2_crypto_int32_min: 37| 58.7M|crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x, crypto_int32 crypto_int32_y) { 38| 58.7M| crypto_int32 crypto_int32_xy = crypto_int32_y ^ crypto_int32_x; 39| 58.7M| crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x; 40| 58.7M| crypto_int32_z ^= crypto_int32_xy & (crypto_int32_z ^ crypto_int32_y); 41| 58.7M| crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); ------------------ | | 9| 58.7M|#define crypto_int32_negative_mask CRYPTO_NAMESPACE(crypto_int32_negative_mask) | | ------------------ | | | | 4| 58.7M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 42| 58.7M| crypto_int32_z &= crypto_int32_xy; 43| 58.7M| return crypto_int32_x ^ crypto_int32_z; 44| 58.7M|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint16_signed_negative_mask: 3| 117k|crypto_uint16_signed crypto_uint16_signed_negative_mask(crypto_uint16_signed crypto_uint16_signed_x) { 4| 117k| return crypto_uint16_signed_x >> 15; 5| 117k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint16_nonzero_mask: 7| 10.3k|crypto_uint16 crypto_uint16_nonzero_mask(crypto_uint16 crypto_uint16_x) { 8| 10.3k| return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 10.3k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 10.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 10.3k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 10.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 9| 10.3k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint16_zero_mask: 11| 10.3k|crypto_uint16 crypto_uint16_zero_mask(crypto_uint16 crypto_uint16_x) { 12| 10.3k| return ~crypto_uint16_nonzero_mask(crypto_uint16_x); ------------------ | | 13| 10.3k|#define crypto_uint16_nonzero_mask CRYPTO_NAMESPACE(crypto_uint16_nonzero_mask) | | ------------------ | | | | 4| 10.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 13| 10.3k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint16_smaller_mask: 24| 96.3k|crypto_uint16 crypto_uint16_smaller_mask(crypto_uint16 crypto_uint16_x, crypto_uint16 crypto_uint16_y) { 25| 96.3k| crypto_uint16 crypto_uint16_xy = crypto_uint16_x ^ crypto_uint16_y; 26| 96.3k| crypto_uint16 crypto_uint16_z = crypto_uint16_x - crypto_uint16_y; 27| 96.3k| crypto_uint16_z ^= crypto_uint16_xy & (crypto_uint16_z ^ crypto_uint16_x ^ (((crypto_uint16) 1) << 15)); 28| 96.3k| return crypto_uint16_signed_negative_mask(crypto_uint16_z); ------------------ | | 11| 96.3k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 96.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 29| 96.3k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint32_signed_negative_mask: 3| 102k|crypto_uint32_signed crypto_uint32_signed_negative_mask(crypto_uint32_signed crypto_uint32_signed_x) { 4| 102k| return crypto_uint32_signed_x >> 31; 5| 102k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint32_nonzero_mask: 7| 51.1k|crypto_uint32 crypto_uint32_nonzero_mask(crypto_uint32 crypto_uint32_x) { 8| 51.1k| return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 51.1k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 51.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 51.1k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 51.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 9| 51.1k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint32_unequal_mask: 15| 51.1k|crypto_uint32 crypto_uint32_unequal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 16| 51.1k| crypto_uint32 crypto_uint32_xy = crypto_uint32_x ^ crypto_uint32_y; 17| 51.1k| return crypto_uint32_nonzero_mask(crypto_uint32_xy); ------------------ | | 13| 51.1k|#define crypto_uint32_nonzero_mask CRYPTO_NAMESPACE(crypto_uint32_nonzero_mask) | | ------------------ | | | | 4| 51.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 18| 51.1k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint32_equal_mask: 20| 51.1k|crypto_uint32 crypto_uint32_equal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 21| 51.1k| return ~crypto_uint32_unequal_mask(crypto_uint32_x, crypto_uint32_y); ------------------ | | 17| 51.1k|#define crypto_uint32_unequal_mask CRYPTO_NAMESPACE(crypto_uint32_unequal_mask) | | ------------------ | | | | 4| 51.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 22| 51.1k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint64_signed_negative_mask: 3| 1.85M|crypto_uint64_signed crypto_uint64_signed_negative_mask(crypto_uint64_signed crypto_uint64_signed_x) { 4| 1.85M| return crypto_uint64_signed_x >> 63; 5| 1.85M|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint64_nonzero_mask: 7| 929k|crypto_uint64 crypto_uint64_nonzero_mask(crypto_uint64 crypto_uint64_x) { 8| 929k| return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 929k|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 929k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 929k|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 929k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 9| 929k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint64_zero_mask: 11| 117k|crypto_uint64 crypto_uint64_zero_mask(crypto_uint64 crypto_uint64_x) { 12| 117k| return ~crypto_uint64_nonzero_mask(crypto_uint64_x); ------------------ | | 13| 117k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 117k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 13| 117k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint64_unequal_mask: 15| 811k|crypto_uint64 crypto_uint64_unequal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 16| 811k| crypto_uint64 crypto_uint64_xy = crypto_uint64_x ^ crypto_uint64_y; 17| 811k| return crypto_uint64_nonzero_mask(crypto_uint64_xy); ------------------ | | 13| 811k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 811k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 18| 811k|} PQCLEAN_MCELIECE460896F_AVX2_crypto_uint64_equal_mask: 20| 811k|crypto_uint64 crypto_uint64_equal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 21| 811k| return ~crypto_uint64_unequal_mask(crypto_uint64_x, crypto_uint64_y); ------------------ | | 17| 811k|#define crypto_uint64_unequal_mask CRYPTO_NAMESPACE(crypto_uint64_unequal_mask) | | ------------------ | | | | 4| 811k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 22| 811k|} PQCLEAN_MCELIECE460896F_AVX2_decrypt: 171| 92|int decrypt(unsigned char *e, const unsigned char *sk, const unsigned char *s) { 172| 92| int i; 173| | 174| 92| uint16_t check_synd; 175| 92| uint16_t check_weight; 176| | 177| 92| vec256 inv[ 32 ][ GFBITS ]; 178| 92| vec256 scaled[ 32 ][ GFBITS ]; 179| 92| vec256 eval[32][ GFBITS ]; 180| | 181| 92| vec128 error128[ 64 ]; 182| 92| vec256 error256[ 32 ]; 183| | 184| 92| vec256 s_priv[ GFBITS ]; 185| 92| vec256 s_priv_cmp[ GFBITS ]; 186| 92| vec128 locator[ GFBITS ]; 187| | 188| 92| vec128 recv128[ 64 ]; 189| 92| vec256 recv256[ 32 ]; 190| 92| vec256 allone; 191| | 192| 92| vec128 bits_int[25][32]; 193| | 194| | // Berlekamp decoder 195| | 196| 92| preprocess(recv128, s); 197| | 198| 92| load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 10| 92|#define load_bits CRYPTO_NAMESPACE(load_bits) | | ------------------ | | | | 4| 92|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 11| 92|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 92|#define SYS_T 96 | | ------------------ ------------------ 199| 92| benes(recv128, bits_int, 1); ------------------ | | 9| 92|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 92|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 200| | 201| 92| reformat_128to256(recv256, recv128); 202| | 203| 92| scaling(scaled, inv, sk, recv256); 204| 92| fft_tr(s_priv, scaled); ------------------ | | 9| 92|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 92|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 205| 92| bm(locator, s_priv); ------------------ | | 10| 92|#define bm CRYPTO_NAMESPACE(bm) | | ------------------ | | | | 4| 92|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 92| fft(eval, locator); ------------------ | | 10| 92|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 92|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| | // reencryption and weight check 210| | 211| 92| allone = vec256_set1_16b(0xFFFF); 212| | 213| 3.03k| for (i = 0; i < 32; i++) { ------------------ | Branch (213:17): [True: 2.94k, False: 92] ------------------ 214| 2.94k| error256[i] = vec256_or_reduce(eval[i]); 215| 2.94k| error256[i] = vec256_xor(error256[i], allone); 216| 2.94k| } 217| | 218| 92| scaling_inv(scaled, inv, error256); 219| 92| fft_tr(s_priv_cmp, scaled); ------------------ | | 9| 92|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 92|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 220| | 221| 92| check_synd = synd_cmp(s_priv, s_priv_cmp); 222| | 223| | // 224| | 225| 92| reformat_256to128(error128, error256); 226| 92| benes(error128, bits_int, 0); ------------------ | | 9| 92|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 92|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 227| | 228| 92| postprocess(e, error128); 229| | 230| 92| check_weight = weight_check(e, error128); 231| | 232| 92| return 1 - (check_synd & check_weight); 233| 92|} PQCLEAN_MCELIECE460896F_AVX2_encrypt: 112| 92|void encrypt(unsigned char *s, const unsigned char *pk, unsigned char *e) { 113| 92| gen_e(e); 114| | 115| 92| syndrome_asm(s, pk, e); ------------------ | | 1| 92|#define syndrome_asm CRYPTO_NAMESPACE(syndrome_asm) | | ------------------ | | | | 4| 92|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 116| 92|} PQCLEAN_MCELIECE460896F_AVX2_fft: 265| 292|void fft(vec256 out[][GFBITS], vec128 *in) { 266| 292| radix_conversions(in); 267| 292| butterflies(out, in); 268| 292|} PQCLEAN_MCELIECE460896F_AVX2_fft_tr: 397| 184|void fft_tr(vec256 *out, vec256 in[][ GFBITS ]) { 398| 184| butterflies_tr(out, in); 399| 184| radix_conversions_tr(out); 400| | 401| 184| postprocess(out); 402| 184|} PQCLEAN_MCELIECE460896F_AVX2_gf_mul: 20| 995k|gf gf_mul(gf in0, gf in1) { 21| 995k| int i; 22| | 23| 995k| uint64_t tmp; 24| 995k| uint64_t t0; 25| 995k| uint64_t t1; 26| 995k| uint64_t t; 27| | 28| 995k| t0 = in0; 29| 995k| t1 = in1; 30| | 31| 995k| tmp = t0 * (t1 & 1); 32| | 33| 12.9M| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 12.9M|#define GFBITS 13 ------------------ | Branch (33:17): [True: 11.9M, False: 995k] ------------------ 34| 11.9M| tmp ^= (t0 * (t1 & (1 << i))); 35| 11.9M| } 36| | 37| | // 38| | 39| 995k| t = tmp & 0x1FF0000; 40| 995k| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 41| | 42| 995k| t = tmp & 0x000E000; 43| 995k| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 44| | 45| 995k| return tmp & GFMASK; ------------------ | | 19| 995k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 995k|#define GFBITS 13 | | ------------------ ------------------ 46| 995k|} PQCLEAN_MCELIECE460896F_AVX2_gf_frac: 156| 10.3k|gf gf_frac(gf den, gf num) { 157| 10.3k| gf tmp_11; 158| 10.3k| gf tmp_1111; 159| 10.3k| gf out; 160| | 161| 10.3k| tmp_11 = gf_sqmul(den, den); // ^11 162| 10.3k| tmp_1111 = gf_sq2mul(tmp_11, tmp_11); // ^1111 163| 10.3k| out = gf_sq2(tmp_1111); 164| 10.3k| out = gf_sq2mul(out, tmp_1111); // ^11111111 165| 10.3k| out = gf_sq2(out); 166| 10.3k| out = gf_sq2mul(out, tmp_1111); // ^111111111111 167| | 168| 10.3k| return gf_sqmul(out, num); // ^1111111111110 = ^-1 169| 10.3k|} PQCLEAN_MCELIECE460896F_AVX2_gf_inv: 172| 10.3k|gf gf_inv(gf den) { 173| 10.3k| return gf_frac(den, ((gf) 1)); ------------------ | | 10| 10.3k|#define gf_frac CRYPTO_NAMESPACE(gf_frac) | | ------------------ | | | | 4| 10.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 174| 10.3k|} pk_gen.c:PQCLEAN_MCELIECE460896F_AVX2_int32_sort: 21| 92|static void int32_sort(int32_t *x, long long n) { 22| 92| long long top, p, q, r, i; 23| | 24| 92| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 92] ------------------ 25| 0| return; 26| 0| } 27| 92| top = 1; 28| 1.01k| while (top < n - top) { ------------------ | Branch (28:12): [True: 920, False: 92] ------------------ 29| 920| top += top; 30| 920| } 31| | 32| 1.10k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 1.01k, False: 92] ------------------ 33| 1.07M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.07M, False: 1.01k] ------------------ 34| 1.07M| if (!(i & p)) { ------------------ | Branch (34:17): [True: 569k, False: 504k] ------------------ 35| 569k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 569k| do { \ | | 12| 569k| int32_t ab = (b) ^ (a); \ | | 13| 569k| int32_t c = (b) - (a); \ | | 14| 569k| c ^= ab & ((c) ^ (b)); \ | | 15| 569k| c >>= 31; \ | | 16| 569k| c &= ab; \ | | 17| 569k| (a) ^= c; \ | | 18| 569k| (b) ^= c; \ | | 19| 569k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 569k] | | ------------------ ------------------ 36| 569k| } 37| 1.07M| } 38| 1.01k| i = 0; 39| 6.07k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 5.06k, False: 1.01k] ------------------ 40| 964k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 959k, False: 5.06k] ------------------ 41| 959k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 504k, False: 454k] ------------------ 42| 504k| int32_t a = x[i + p]; 43| 2.86M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 2.35M, False: 504k] ------------------ 44| 2.35M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 2.35M| do { \ | | 12| 2.35M| int32_t ab = (b) ^ (a); \ | | 13| 2.35M| int32_t c = (b) - (a); \ | | 14| 2.35M| c ^= ab & ((c) ^ (b)); \ | | 15| 2.35M| c >>= 31; \ | | 16| 2.35M| c &= ab; \ | | 17| 2.35M| (a) ^= c; \ | | 18| 2.35M| (b) ^= c; \ | | 19| 2.35M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.35M] | | ------------------ ------------------ 45| 2.35M| } 46| 504k| x[i + p] = a; 47| 504k| } 48| 959k| } 49| 5.06k| } 50| 1.01k| } 51| 92|} controlbits.c:PQCLEAN_MCELIECE460896F_AVX2_int32_sort: 21| 3.01M|static void int32_sort(int32_t *x, long long n) { 22| 3.01M| long long top, p, q, r, i; 23| | 24| 3.01M| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 3.01M] ------------------ 25| 0| return; 26| 0| } 27| 3.01M| top = 1; 28| 10.5M| while (top < n - top) { ------------------ | Branch (28:12): [True: 7.55M, False: 3.01M] ------------------ 29| 7.55M| top += top; 30| 7.55M| } 31| | 32| 13.5M| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 10.5M, False: 3.01M] ------------------ 33| 1.45G| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.44G, False: 10.5M] ------------------ 34| 1.44G| if (!(i & p)) { ------------------ | Branch (34:17): [True: 807M, False: 636M] ------------------ 35| 807M| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 807M| do { \ | | 12| 807M| int32_t ab = (b) ^ (a); \ | | 13| 807M| int32_t c = (b) - (a); \ | | 14| 807M| c ^= ab & ((c) ^ (b)); \ | | 15| 807M| c >>= 31; \ | | 16| 807M| c &= ab; \ | | 17| 807M| (a) ^= c; \ | | 18| 807M| (b) ^= c; \ | | 19| 807M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 807M] | | ------------------ ------------------ 36| 807M| } 37| 1.44G| } 38| 10.5M| i = 0; 39| 28.6M| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 18.1M, False: 10.5M] ------------------ 40| 1.29G| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.27G, False: 18.1M] ------------------ 41| 1.27G| if (!(i & p)) { ------------------ | Branch (41:21): [True: 636M, False: 636M] ------------------ 42| 636M| int32_t a = x[i + p]; 43| 3.76G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 3.13G, False: 636M] ------------------ 44| 3.13G| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 3.13G| do { \ | | 12| 3.13G| int32_t ab = (b) ^ (a); \ | | 13| 3.13G| int32_t c = (b) - (a); \ | | 14| 3.13G| c ^= ab & ((c) ^ (b)); \ | | 15| 3.13G| c >>= 31; \ | | 16| 3.13G| c &= ab; \ | | 17| 3.13G| (a) ^= c; \ | | 18| 3.13G| (b) ^= c; \ | | 19| 3.13G| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.13G] | | ------------------ ------------------ 45| 3.13G| } 46| 636M| x[i + p] = a; 47| 636M| } 48| 1.27G| } 49| 18.1M| } 50| 10.5M| } 51| 3.01M|} encrypt.c:PQCLEAN_MCELIECE460896F_AVX2_int32_sort: 21| 538|static void int32_sort(int32_t *x, long long n) { 22| 538| long long top, p, q, r, i; 23| | 24| 538| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 538] ------------------ 25| 0| return; 26| 0| } 27| 538| top = 1; 28| 3.76k| while (top < n - top) { ------------------ | Branch (28:12): [True: 3.22k, False: 538] ------------------ 29| 3.22k| top += top; 30| 3.22k| } 31| | 32| 4.30k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 3.76k, False: 538] ------------------ 33| 296k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 293k, False: 3.76k] ------------------ 34| 293k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 163k, False: 129k] ------------------ 35| 163k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 163k| do { \ | | 12| 163k| int32_t ab = (b) ^ (a); \ | | 13| 163k| int32_t c = (b) - (a); \ | | 14| 163k| c ^= ab & ((c) ^ (b)); \ | | 15| 163k| c >>= 31; \ | | 16| 163k| c &= ab; \ | | 17| 163k| (a) ^= c; \ | | 18| 163k| (b) ^= c; \ | | 19| 163k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 163k] | | ------------------ ------------------ 36| 163k| } 37| 293k| } 38| 3.76k| i = 0; 39| 15.0k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 11.2k, False: 3.76k] ------------------ 40| 253k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 242k, False: 11.2k] ------------------ 41| 242k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 129k, False: 112k] ------------------ 42| 129k| int32_t a = x[i + p]; 43| 507k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 378k, False: 129k] ------------------ 44| 378k| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 378k| do { \ | | 12| 378k| int32_t ab = (b) ^ (a); \ | | 13| 378k| int32_t c = (b) - (a); \ | | 14| 378k| c ^= ab & ((c) ^ (b)); \ | | 15| 378k| c >>= 31; \ | | 16| 378k| c &= ab; \ | | 17| 378k| (a) ^= c; \ | | 18| 378k| (b) ^= c; \ | | 19| 378k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 378k] | | ------------------ ------------------ 45| 378k| } 46| 129k| x[i + p] = a; 47| 129k| } 48| 242k| } 49| 11.2k| } 50| 3.76k| } 51| 538|} PQCLEAN_MCELIECE460896F_AVX2_crypto_kem_enc: 22| 92|) { 23| 92| unsigned char e[ SYS_N / 8 ]; 24| 92| unsigned char one_ec[ 1 + SYS_N / 8 + SYND_BYTES ] = {1}; 25| | 26| | // 27| | 28| 92| encrypt(c, pk, e); ------------------ | | 9| 92|#define encrypt CRYPTO_NAMESPACE(encrypt) | | ------------------ | | | | 4| 92|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 29| | 30| 92| memcpy(one_ec + 1, e, SYS_N / 8); ------------------ | | 7| 92|#define SYS_N 4608 ------------------ 31| 92| memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 7| 92|#define SYS_N 4608 ------------------ memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 17| 92|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 92|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 92|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 92|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 32| | 33| 92| crypto_hash_32b(key, one_ec, sizeof(one_ec)); ------------------ | | 7| 92| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 92|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 34| | 35| 92| return 0; 36| 92|} PQCLEAN_MCELIECE460896F_AVX2_crypto_kem_dec: 42| 92|) { 43| 92| int i; 44| | 45| 92| unsigned char ret_decrypt = 0; 46| | 47| 92| uint16_t m; 48| | 49| 92| unsigned char e[ SYS_N / 8 ]; 50| 92| unsigned char preimage[ 1 + SYS_N / 8 + SYND_BYTES ]; 51| 92| unsigned char *x = preimage; 52| 92| const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 11| 92|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 92|#define SYS_T 96 | | ------------------ ------------------ const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 10| 92|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 92|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 92|#define GFBITS 13 | | ------------------ ------------------ 53| | 54| | // 55| | 56| 92| ret_decrypt = (unsigned char)decrypt(e, sk + 40, c); ------------------ | | 9| 92|#define decrypt CRYPTO_NAMESPACE(decrypt) | | ------------------ | | | | 4| 92|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 57| | 58| 92| m = ret_decrypt; 59| 92| m -= 1; 60| 92| m >>= 8; 61| | 62| 92| *x++ = m & 1; 63| 53.0k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 53.0k|#define SYS_N 4608 ------------------ | Branch (63:17): [True: 52.9k, False: 92] ------------------ 64| 52.9k| *x++ = (~m & s[i]) | (m & e[i]); 65| 52.9k| } 66| | 67| 14.4k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 14.4k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 14.4k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 14.4k|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 14.4k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (67:17): [True: 14.3k, False: 92] ------------------ 68| 14.3k| *x++ = c[i]; 69| 14.3k| } 70| | 71| 92| crypto_hash_32b(key, preimage, sizeof(preimage)); ------------------ | | 7| 92| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 92|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 72| | 73| 92| return 0; 74| 92|} PQCLEAN_MCELIECE460896F_AVX2_crypto_kem_keypair: 80| 92|) { 81| 92| int i; 82| 92| unsigned char seed[ 33 ] = {64}; 83| 92| unsigned char r[ SYS_N / 8 + (1 << GFBITS)*sizeof(uint32_t) + SYS_T * 2 + 32 ]; 84| 92| unsigned char *rp, *skp; 85| 92| uint64_t pivots; 86| | 87| 92| gf f[ SYS_T ]; // element in GF(2^mt) 88| 92| gf irr[ SYS_T ]; // Goppa polynomial 89| 92| uint32_t perm[ 1 << GFBITS ]; // random permutation as 32-bit integers 90| 92| int16_t pi[ 1 << GFBITS ]; // random permutation 91| | 92| 92| randombytes(seed + 1, 32); ------------------ | | 8| 92|#define randombytes OQS_randombytes ------------------ 93| | 94| 108| while (1) { ------------------ | Branch (94:12): [True: 108, Folded] ------------------ 95| 108| rp = &r[ sizeof(r) - 32 ]; 96| 108| skp = sk; 97| | 98| | // expanding and updating the seed 99| | 100| 108| shake(r, sizeof(r), seed, 33); ------------------ | | 10| 108| shake256(out, outlen, in, inlen) | | ------------------ | | | | 12| 108|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 101| 108| memcpy(skp, seed + 1, 32); 102| 108| skp += 32 + 8; 103| 108| memcpy(seed + 1, &r[ sizeof(r) - 32 ], 32); 104| | 105| | // generating irreducible polynomial 106| | 107| 108| rp -= sizeof(f); 108| | 109| 10.4k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 10.4k|#define SYS_T 96 ------------------ | Branch (109:21): [True: 10.3k, False: 108] ------------------ 110| 10.3k| f[i] = load_gf(rp + i * 2); 111| 10.3k| } 112| | 113| 108| if (genpoly_gen(irr, f)) { ------------------ | | 9| 108|#define genpoly_gen CRYPTO_NAMESPACE(genpoly_gen) | | ------------------ | | | | 4| 108|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ | Branch (113:13): [True: 0, False: 108] ------------------ 114| 0| continue; 115| 0| } 116| | 117| 10.4k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 10.4k|#define SYS_T 96 ------------------ | Branch (117:21): [True: 10.3k, False: 108] ------------------ 118| 10.3k| store_gf(skp + i * 2, irr[i]); 119| 10.3k| } 120| | 121| 108| skp += IRR_BYTES; ------------------ | | 11| 108|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 108|#define SYS_T 96 | | ------------------ ------------------ 122| | 123| | // generating permutation 124| | 125| 108| rp -= sizeof(perm); 126| | 127| 884k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 884k|#define GFBITS 13 ------------------ | Branch (127:21): [True: 884k, False: 108] ------------------ 128| 884k| perm[i] = load4(rp + i * 4); 129| 884k| } 130| | 131| 108| if (pk_gen(pk, skp - IRR_BYTES, perm, pi, &pivots)) { ------------------ | | 9| 108|#define pk_gen CRYPTO_NAMESPACE(pk_gen) | | ------------------ | | | | 4| 108|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ if (pk_gen(pk, skp - IRR_BYTES, perm, pi, &pivots)) { ------------------ | | 11| 108|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 108|#define SYS_T 96 | | ------------------ ------------------ | Branch (131:13): [True: 16, False: 92] ------------------ 132| 16| continue; 133| 16| } 134| | 135| 92| controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 10| 92|#define controlbitsfrompermutation CRYPTO_NAMESPACE(controlbitsfrompermutation) | | ------------------ | | | | 4| 92|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 92|#define GFBITS 13 ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 92|#define GFBITS 13 ------------------ 136| 92| skp += COND_BYTES; ------------------ | | 10| 92|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 92|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 92|#define GFBITS 13 | | ------------------ ------------------ 137| | 138| | // storing the random string s 139| | 140| 92| rp -= SYS_N / 8; ------------------ | | 7| 92|#define SYS_N 4608 ------------------ 141| 92| memcpy(skp, rp, SYS_N / 8); ------------------ | | 7| 92|#define SYS_N 4608 ------------------ 142| | 143| | // storing positions of the 32 pivots 144| | 145| 92| store8(sk + 32, pivots); 146| | 147| 92| break; 148| 108| } 149| | 150| 92| return 0; 151| 92|} PQCLEAN_MCELIECE460896F_AVX2_pk_gen: 312| 108|int pk_gen(unsigned char *pk, const unsigned char *irr, const uint32_t *perm, int16_t *pi, uint64_t *pivots) { 313| 108| int i, j, k, b; 314| 108| int row, c; 315| | 316| 108| union { 317| 108| uint64_t w[ PK_NROWS ][ nBlocks_I * 4 ]; 318| 108| vec256 v[ PK_NROWS ][ nBlocks_I ]; 319| 108| } mat; 320| | 321| 108| union { 322| 108| uint64_t w[ PK_NROWS ][ 28 ]; 323| 108| vec256 v[ PK_NROWS ][ 7 ]; 324| 108| } par; 325| | 326| 108| uint64_t one = 1; 327| 108| uint64_t t; 328| 108| uint16_t m; 329| 108| vec256 mm; 330| | 331| 108| vec128 sk_int[ GFBITS ]; 332| | 333| 108| vec256 consts[ 32 ][ GFBITS ]; 334| 108| vec256 eval[ 32 ][ GFBITS ]; 335| 108| vec256 prod[ 32 ][ GFBITS ]; 336| 108| vec256 tmp[ GFBITS ]; 337| | 338| 108| uint64_t list[1 << GFBITS]; 339| | 340| 108| uint16_t ind[ PK_NROWS ]; 341| 108| uint16_t ind_inv[ PK_NROWS ]; 342| | 343| | // compute the inverses 344| | 345| 108| irr_load(sk_int, irr); 346| | 347| 108| fft(eval, sk_int); ------------------ | | 10| 108|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 108|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 348| | 349| 108| vec256_copy(prod[0], eval[0]); 350| | 351| 3.45k| for (i = 1; i < 32; i++) { ------------------ | Branch (351:17): [True: 3.34k, False: 108] ------------------ 352| 3.34k| vec256_mul(prod[i], prod[i - 1], eval[i]); 353| 3.34k| } 354| | 355| 108| vec256_inv(tmp, prod[31]); ------------------ | | 11| 108|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 108|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 356| | 357| 3.45k| for (i = 30; i >= 0; i--) { ------------------ | Branch (357:18): [True: 3.34k, False: 108] ------------------ 358| 3.34k| vec256_mul(prod[i + 1], prod[i], tmp); 359| 3.34k| vec256_mul(tmp, tmp, eval[i + 1]); 360| 3.34k| } 361| | 362| 108| vec256_copy(prod[0], tmp); 363| | 364| | // fill matrix 365| | 366| 108| de_bitslicing(list, prod); 367| | 368| 884k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 884k|#define GFBITS 13 ------------------ | Branch (368:17): [True: 884k, False: 108] ------------------ 369| 884k| list[i] <<= GFBITS; ------------------ | | 6| 884k|#define GFBITS 13 ------------------ 370| 884k| list[i] |= i; 371| 884k| list[i] |= ((uint64_t) perm[i]) << 31; 372| 884k| } 373| | 374| 108| uint64_sort(list, 1 << GFBITS); ------------------ | | 6| 108|#define GFBITS 13 ------------------ 375| | 376| 811k| for (i = 1; i < (1 << GFBITS); i++) { ------------------ | | 6| 811k|#define GFBITS 13 ------------------ | Branch (376:17): [True: 811k, False: 92] ------------------ 377| 811k| if (uint64_is_equal_declassify(list[i - 1] >> 31, list[i] >> 31)) { ------------------ | Branch (377:13): [True: 16, False: 811k] ------------------ 378| 16| return -1; 379| 16| } 380| 811k| } 381| | 382| 92| to_bitslicing_2x(consts, prod, list); 383| | 384| 753k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 753k|#define GFBITS 13 ------------------ | Branch (384:17): [True: 753k, False: 92] ------------------ 385| 753k| pi[i] = list[i] & GFMASK; ------------------ | | 19| 753k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 753k|#define GFBITS 13 | | ------------------ ------------------ 386| 753k| } 387| | 388| 552| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 32| 552|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 552|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 552|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 552|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (388:17): [True: 460, False: 92] ------------------ 389| 6.44k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 6.44k|#define GFBITS 13 ------------------ | Branch (389:21): [True: 5.98k, False: 460] ------------------ 390| 5.98k| mat.v[ k ][ j ] = prod[ j ][ k ]; 391| 5.98k| } 392| 460| } 393| | 394| 8.83k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 8.83k|#define SYS_T 96 ------------------ | Branch (394:17): [True: 8.74k, False: 92] ------------------ 395| 52.4k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 32| 52.4k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 52.4k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 52.4k|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 52.4k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (395:21): [True: 43.7k, False: 8.74k] ------------------ 396| 43.7k| vec256_mul(prod[j], prod[j], consts[j]); 397| | 398| 611k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 611k|#define GFBITS 13 ------------------ | Branch (398:25): [True: 568k, False: 43.7k] ------------------ 399| 568k| mat.v[ i * GFBITS + k ][ j ] = prod[ j ][ k ]; ------------------ | | 6| 568k|#define GFBITS 13 ------------------ 400| 568k| } 401| 43.7k| } 402| 8.74k| } 403| | 404| | // gaussian elimination to obtain L, U, and P such that LP M = U 405| | // L and U are stored in the space of M 406| | // P is stored in ind 407| | 408| 114k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 114k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 114k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 114k|#define GFBITS 13 | | ------------------ ------------------ | Branch (408:17): [True: 114k, False: 92] ------------------ 409| 114k| ind_inv[i] = ind[ i ] = i; 410| 114k| } 411| | 412| 114k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 114k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 114k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 114k|#define GFBITS 13 | | ------------------ ------------------ | Branch (412:19): [True: 114k, False: 92] ------------------ 413| 114k| i = row >> 6; 414| 114k| j = row & 63; 415| | 416| 114k| if (row == PK_NROWS - 32) { ------------------ | | 13| 114k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 114k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 114k|#define GFBITS 13 | | ------------------ ------------------ | Branch (416:13): [True: 92, False: 114k] ------------------ 417| 92| if (mov_columns(mat.w, pi, pivots)) { ------------------ | Branch (417:17): [True: 0, False: 92] ------------------ 418| 0| return -1; 419| 0| } 420| 92| } 421| | 422| 71.7M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 71.7M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 71.7M|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 71.7M|#define GFBITS 13 | | ------------------ ------------------ | Branch (422:27): [True: 71.5M, False: 114k] ------------------ 423| 71.5M| extract_01_masks(&m, mat.w[ row ], mat.w[ k ], row); 424| 71.5M| uint16_cswap(&ind[row], &ind[k], m); 425| | 426| 71.5M| mm = vec256_set1_16b(m); 427| 429M| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 32| 429M|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 429M|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 429M|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 429M|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (427:25): [True: 357M, False: 71.5M] ------------------ 428| 357M| vec256_cswap(&mat.v[ row ][ c ], &mat.v[ k ][ c ], mm); 429| 357M| } 430| 71.5M| } 431| | 432| 114k| if ( uint64_is_zero_declassify((mat.w[ row ][ i ] >> j) & 1) ) { // return if not systematic ------------------ | Branch (432:14): [True: 0, False: 114k] ------------------ 433| 0| return -1; 434| 0| } 435| | 436| 71.7M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 71.7M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 71.7M|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 71.7M|#define GFBITS 13 | | ------------------ ------------------ | Branch (436:27): [True: 71.5M, False: 114k] ------------------ 437| 71.5M| t = mat.w[ k ][ i ] & (one << j); 438| 71.5M| mm = extract_mask256(mat.w[k], row); 439| | 440| 429M| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 32| 429M|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 429M|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 429M|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 429M|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (440:25): [True: 357M, False: 71.5M] ------------------ 441| 357M| mat.v[ k ][ c ] ^= mat.v[ row ][ c ] & mm; 442| 357M| } 443| | 444| 71.5M| mat.w[ k ][ i ] |= t; 445| 71.5M| } 446| 114k| } 447| | 448| | // apply M^-1 to the remaining columns 449| | 450| 92| composeinv(PK_NROWS, ind_inv, ind_inv, ind); ------------------ | | 13| 92|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 92|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 92|#define GFBITS 13 | | ------------------ ------------------ 451| | 452| 276| for (j = 4; j < 18; j += par_width) { ------------------ | | 33| 184|#define par_width 7 ------------------ | Branch (452:17): [True: 184, False: 92] ------------------ 453| 2.57k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 2.57k|#define GFBITS 13 ------------------ | Branch (453:21): [True: 2.39k, False: 184] ------------------ 454| 19.1k| for (b = 0; b < par_width; b++) { ------------------ | | 33| 19.1k|#define par_width 7 ------------------ | Branch (454:25): [True: 16.7k, False: 2.39k] ------------------ 455| 16.7k| par.v[ k ][ b ] = prod[ j + b ][ k ]; 456| 16.7k| } 457| 2.39k| } 458| | 459| 17.6k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 17.6k|#define SYS_T 96 ------------------ | Branch (459:21): [True: 17.4k, False: 184] ------------------ 460| 139k| for (b = 0; b < par_width; b++) { ------------------ | | 33| 139k|#define par_width 7 ------------------ | Branch (460:25): [True: 122k, False: 17.4k] ------------------ 461| 122k| vec256_mul(prod[j + b], prod[j + b], consts[j + b]); 462| 122k| } 463| | 464| 244k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 244k|#define GFBITS 13 ------------------ | Branch (464:25): [True: 227k, False: 17.4k] ------------------ 465| 1.81M| for (b = 0; b < par_width; b++) { ------------------ | | 33| 1.81M|#define par_width 7 ------------------ | Branch (465:29): [True: 1.59M, False: 227k] ------------------ 466| 1.59M| par.v[ i * GFBITS + k ][ b ] = prod[ j + b ][ k ]; ------------------ | | 6| 1.59M|#define GFBITS 13 ------------------ 467| 1.59M| } 468| 227k| } 469| 17.4k| } 470| | 471| | // apply P 472| | 473| 229k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 229k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 229k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 229k|#define GFBITS 13 | | ------------------ ------------------ | Branch (473:21): [True: 229k, False: 184] ------------------ 474| 229k| ind[i] = ind_inv[i]; 475| 229k| } 476| | 477| 184| sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 6| 184|#define GFBITS 13 ------------------ sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 13| 184|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 184|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 184|#define GFBITS 13 | | ------------------ ------------------ 478| | 479| | // apply L 480| | 481| 229k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 184|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 184|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 184|#define GFBITS 13 | | ------------------ ------------------ | Branch (481:34): [True: 229k, False: 184] ------------------ 482| 143M| for (i = row - 1; i >= 0; i--) { ------------------ | Branch (482:31): [True: 143M, False: 229k] ------------------ 483| 143M| mm = extract_mask256(mat.w[row], i); 484| | 485| 1.14G| for (k = 0; k < par_width; k++) { ------------------ | | 33| 1.14G|#define par_width 7 ------------------ | Branch (485:29): [True: 1.00G, False: 143M] ------------------ 486| 1.00G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 487| 1.00G| } 488| 143M| } 489| 229k| } 490| | 491| | // apply U^-1 492| | 493| 184| if (j == 4) { ------------------ | Branch (493:13): [True: 92, False: 92] ------------------ 494| 114k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 114k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 114k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 114k|#define GFBITS 13 | | ------------------ ------------------ | Branch (494:25): [True: 114k, False: 92] ------------------ 495| 114k| par.v[i][0] = mat.v[i][ nBlocks_I - 1 ]; ------------------ | | 32| 114k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 114k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 114k|#define SYS_T 96 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 114k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 496| 114k| } 497| 92| } 498| | 499| 229k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 184|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 184|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 184|#define GFBITS 13 | | ------------------ ------------------ | Branch (499:34): [True: 229k, False: 184] ------------------ 500| 143M| for (i = PK_NROWS - 1; i > row; i--) { ------------------ | | 13| 229k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 229k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 229k|#define GFBITS 13 | | ------------------ ------------------ | Branch (500:36): [True: 143M, False: 229k] ------------------ 501| 143M| mm = extract_mask256(mat.w[row], i); 502| | 503| 1.14G| for (k = 0; k < par_width; k++) { ------------------ | | 33| 1.14G|#define par_width 7 ------------------ | Branch (503:29): [True: 1.00G, False: 143M] ------------------ 504| 1.00G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 505| 1.00G| } 506| 143M| } 507| 229k| } 508| | 509| 184| if (j == 4) { ------------------ | Branch (509:13): [True: 92, False: 92] ------------------ 510| 114k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 114k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 114k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 114k|#define GFBITS 13 | | ------------------ ------------------ | Branch (510:27): [True: 114k, False: 92] ------------------ 511| 114k| k = 3; 512| 114k| store_i(pk + PK_ROW_BYTES * row + j * 32 + k * 8 + 4 - 13 * 12, par.w[row][k] >> 32, 4); ------------------ | | 15| 114k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 114k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 114k|#define SYS_N 4608 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 114k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 114k|#define SYS_T 96 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 114k|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 513| | 514| 2.87M| for (k = 4; k < 28; k++) { ------------------ | Branch (514:29): [True: 2.75M, False: 114k] ------------------ 515| 2.75M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 12, par.w[row][k]); ------------------ | | 15| 2.75M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 2.75M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 2.75M|#define SYS_N 4608 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 2.75M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 2.75M|#define SYS_T 96 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 2.75M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 516| 2.75M| } 517| 114k| } 518| 92| } else { 519| 114k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 114k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 114k|#define SYS_T 96 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 114k|#define GFBITS 13 | | ------------------ ------------------ | Branch (519:27): [True: 114k, False: 92] ------------------ 520| 3.32M| for (k = 0; k < 28; k++) { ------------------ | Branch (520:29): [True: 3.21M, False: 114k] ------------------ 521| 3.21M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 12, par.w[row][k]); ------------------ | | 15| 3.21M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 3.21M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 3.21M|#define SYS_N 4608 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 3.21M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 3.21M|#define SYS_T 96 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 3.21M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 522| 3.21M| } 523| 114k| } 524| 92| } 525| 184| } 526| | 527| | // 528| | 529| 92| return 0; 530| 92|} PQCLEAN_MCELIECE460896F_AVX2_genpoly_gen: 88| 108|int genpoly_gen(gf *out, gf *f) { 89| 108| int i, j, k; 90| | 91| 108| gf t, inv; 92| | 93| 108| uint64_t m; 94| 108| vec128 mask; 95| | 96| 108| union { 97| 108| uint64_t d[ GFBITS ][ 128 ][2]; 98| 108| vec128 v[ GFBITS ][ 128 ]; 99| 108| } buf; 100| | 101| 108| union { 102| 108| uint64_t d[GFBITS][2]; 103| 108| vec128 v[GFBITS]; 104| 108| } v; 105| | 106| 108| union { 107| 108| uint64_t d[SYS_T][GFBITS][2]; 108| 108| vec128 v[SYS_T][GFBITS]; 109| 108| } mat; 110| | 111| | // fill matrix 112| | 113| 108| buf.v[0][0] = vec128_set2x(1, 0); 114| 1.40k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.40k|#define GFBITS 13 ------------------ | Branch (114:17): [True: 1.29k, False: 108] ------------------ 115| 1.29k| buf.v[i][0] = vec128_setzero(); 116| 1.29k| } 117| | 118| 1.51k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 1.51k|#define GFBITS 13 ------------------ | Branch (118:17): [True: 1.40k, False: 108] ------------------ 119| 1.40k| v.v[j] = vec128_setzero(); 120| | 121| 136k| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 1.40k|#define SYS_T 96 ------------------ | Branch (121:29): [True: 134k, False: 1.40k] ------------------ 122| 134k| v.d[j][1] <<= 1; 123| 134k| v.d[j][1] |= v.d[j][0] >> 63; 124| 134k| v.d[j][0] <<= 1; 125| 134k| v.d[j][0] |= (f[i] >> j) & 1; 126| 134k| } 127| 1.40k| } 128| | 129| 1.51k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.51k|#define GFBITS 13 ------------------ | Branch (129:17): [True: 1.40k, False: 108] ------------------ 130| 1.40k| buf.v[i][1] = v.v[i]; 131| 1.40k| } 132| | 133| 10.3k| for (k = 2; k <= SYS_T; k++) { ------------------ | | 8| 10.3k|#define SYS_T 96 ------------------ | Branch (133:17): [True: 10.2k, False: 108] ------------------ 134| 10.2k| vec128_mul_GF(v.v, v.v, f); ------------------ | | 11| 10.2k|#define vec128_mul_GF CRYPTO_NAMESPACE(vec128_mul_GF) | | ------------------ | | | | 4| 10.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 135| | 136| 10.2k| if (k < SYS_T) { ------------------ | | 8| 10.2k|#define SYS_T 96 ------------------ | Branch (136:13): [True: 10.1k, False: 108] ------------------ 137| 142k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 142k|#define GFBITS 13 ------------------ | Branch (137:25): [True: 131k, False: 10.1k] ------------------ 138| 131k| buf.v[i][k] = v.v[i]; 139| 131k| } 140| 10.1k| } else { 141| 10.4k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 10.4k|#define SYS_T 96 ------------------ | Branch (141:25): [True: 10.3k, False: 108] ------------------ 142| 10.3k| out[i] = extract_gf(v.d, i); 143| 10.3k| } 144| 108| } 145| 10.2k| } 146| | 147| 1.51k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.51k|#define GFBITS 13 ------------------ | Branch (147:17): [True: 1.40k, False: 108] ------------------ 148| 1.40k| transpose_128x128(buf.d[i]); 149| 1.40k| } 150| | 151| 10.4k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 10.4k|#define SYS_T 96 ------------------ | Branch (151:17): [True: 10.3k, False: 108] ------------------ 152| 145k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 145k|#define GFBITS 13 ------------------ | Branch (152:21): [True: 134k, False: 10.3k] ------------------ 153| 134k| mat.v[j][i] = buf.v[i][j]; 154| 134k| } 155| 10.3k| } 156| | 157| | // gaussian 158| | 159| 10.4k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 10.4k|#define SYS_T 96 ------------------ | Branch (159:17): [True: 10.3k, False: 108] ------------------ 160| 502k| for (j = i + 1; j < SYS_T; j++) { ------------------ | | 8| 502k|#define SYS_T 96 ------------------ | Branch (160:25): [True: 492k, False: 10.3k] ------------------ 161| 492k| m = extract_bit(mat.d[i], i); 162| 492k| m -= 1; 163| 492k| mask = vec128_set2x(m, m); 164| | 165| 6.89M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 6.89M|#define GFBITS 13 ------------------ | Branch (165:25): [True: 6.40M, False: 492k] ------------------ 166| 6.40M| mat.v[i][k] ^= mat.v[j][k] & mask; 167| 6.40M| } 168| | 169| 492k| out[i] ^= out[j] & m; 170| 492k| } 171| | 172| | // 173| | 174| 10.3k| t = extract_gf(mat.d[i], i); 175| | 176| 10.3k| if (gf_is_zero_declassify(t)) { ------------------ | Branch (176:13): [True: 0, False: 10.3k] ------------------ 177| 0| return -1; // return if not systematic 178| 0| } 179| | 180| | // 181| | 182| 10.3k| inv = gf_inv(t); ------------------ | | 11| 10.3k|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 10.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 183| 10.3k| vec128_mul_gf(mat.v[i], mat.v[i], inv); 184| | 185| 10.3k| out[i] = gf_mul(out[i], inv); ------------------ | | 14| 10.3k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 10.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 186| | 187| 1.00M| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 1.00M|#define SYS_T 96 ------------------ | Branch (187:21): [True: 995k, False: 10.3k] ------------------ 188| 995k| if (j != i) { ------------------ | Branch (188:17): [True: 984k, False: 10.3k] ------------------ 189| 984k| t = extract_gf(mat.d[j], i); 190| | 191| 984k| vec128_mul_gf(v.v, mat.v[i], t); 192| 984k| vec128_add(mat.v[j], mat.v[j], v.v); 193| | 194| 984k| out[j] ^= gf_mul(out[i], t); ------------------ | | 14| 984k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 984k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 195| 984k| } 196| 995k| } 197| 10.3k| } 198| | 199| 108| return 0; 200| 108|} PQCLEAN_MCELIECE460896F_AVX2_vec128_mul_GF: 6| 10.2k|void vec128_mul_GF(vec128 out[ GFBITS ], vec128 v[ GFBITS ], gf a[ SYS_T ]) { 7| 10.2k| int i, j; 8| 10.2k| uint64_t buf[GFBITS][3]; 9| 10.2k| vec128 prod[GFBITS]; 10| 10.2k| uint64_t p[GFBITS]; 11| | 12| 10.2k| const uint64_t allone = -1; 13| | 14| | // polynomial multiplication 15| | 16| 143k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 143k|#define GFBITS 13 ------------------ | Branch (16:17): [True: 133k, False: 10.2k] ------------------ 17| 133k| buf[i][0] = 0; 18| 133k| buf[i][1] = 0; 19| 133k| buf[i][2] = 0; 20| 133k| } 21| | 22| 995k| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 10.2k|#define SYS_T 96 ------------------ | Branch (22:25): [True: 984k, False: 10.2k] ------------------ 23| 13.7M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 13.7M|#define GFBITS 13 ------------------ | Branch (23:21): [True: 12.8M, False: 984k] ------------------ 24| 12.8M| buf[j][2] <<= 1; 25| 12.8M| buf[j][2] |= buf[j][1] >> 63; 26| 12.8M| buf[j][1] <<= 1; 27| 12.8M| buf[j][1] |= buf[j][0] >> 63; 28| 12.8M| buf[j][0] <<= 1; 29| 12.8M| } 30| | 31| 984k| vec128_mul_gf(prod, v, a[i]); 32| | 33| 13.7M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 13.7M|#define GFBITS 13 ------------------ | Branch (33:21): [True: 12.8M, False: 984k] ------------------ 34| 12.8M| buf[j][0] ^= vec128_extract(prod[j], 0); ------------------ | | 29| 12.8M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 35| 12.8M| buf[j][1] ^= vec128_extract(prod[j], 1); ------------------ | | 29| 12.8M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 36| 12.8M| } 37| 984k| } 38| | 39| | // reduction modulo y^96+y^10+y^9+y^6+1 40| | 41| 143k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 143k|#define GFBITS 13 ------------------ | Branch (41:17): [True: 133k, False: 10.2k] ------------------ 42| 133k| p[i] = buf[i][2]; 43| | 44| 133k| buf[i][1] ^= p[i] >> (SYS_T - 10 - 64); ------------------ | | 8| 133k|#define SYS_T 96 ------------------ 45| 133k| buf[i][0] ^= p[i] << (64 - (SYS_T - 10 - 64)); ------------------ | | 8| 133k|#define SYS_T 96 ------------------ 46| 133k| buf[i][1] ^= p[i] >> (SYS_T - 9 - 64); ------------------ | | 8| 133k|#define SYS_T 96 ------------------ 47| 133k| buf[i][0] ^= p[i] << (64 - (SYS_T - 9 - 64)); ------------------ | | 8| 133k|#define SYS_T 96 ------------------ 48| 133k| buf[i][1] ^= p[i] >> (SYS_T - 6 - 64); ------------------ | | 8| 133k|#define SYS_T 96 ------------------ 49| 133k| buf[i][0] ^= p[i] << (64 - (SYS_T - 6 - 64)); ------------------ | | 8| 133k|#define SYS_T 96 ------------------ 50| 133k| buf[i][1] ^= p[i] >> (SYS_T - 64); ------------------ | | 8| 133k|#define SYS_T 96 ------------------ 51| 133k| buf[i][0] ^= p[i] << (64 - (SYS_T - 64)); ------------------ | | 8| 133k|#define SYS_T 96 ------------------ 52| 133k| } 53| | 54| | // 55| | 56| 143k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 143k|#define GFBITS 13 ------------------ | Branch (56:17): [True: 133k, False: 10.2k] ------------------ 57| 133k| p[i] = buf[i][1] & (allone << 32); 58| | 59| 133k| buf[i][0] ^= p[i] >> (SYS_T - 10 - 64); ------------------ | | 8| 133k|#define SYS_T 96 ------------------ 60| 133k| buf[i][0] ^= p[i] >> (SYS_T - 9 - 64); ------------------ | | 8| 133k|#define SYS_T 96 ------------------ 61| 133k| buf[i][0] ^= p[i] >> (SYS_T - 6 - 64); ------------------ | | 8| 133k|#define SYS_T 96 ------------------ 62| 133k| buf[i][0] ^= p[i] >> (SYS_T - 64); ------------------ | | 8| 133k|#define SYS_T 96 ------------------ 63| 133k| } 64| | 65| | // 66| | 67| 143k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 143k|#define GFBITS 13 ------------------ | Branch (67:17): [True: 133k, False: 10.2k] ------------------ 68| 133k| out[i] = vec128_set2x(buf[i][0], buf[i][1] & 0xFFFFFFFF); 69| 133k| } 70| 10.2k|} PQCLEAN_MCELIECE460896F_AVX2_vec256_sq: 9| 5.34k|void vec256_sq(vec256 *out, vec256 *in) { 10| 5.34k| int i; 11| 5.34k| vec256 result[GFBITS], t; 12| | 13| 5.34k| t = vec256_xor(in[11], in[12]); 14| | 15| 5.34k| result[0] = vec256_xor(in[0], in[11]); 16| 5.34k| result[1] = vec256_xor(in[7], t); 17| 5.34k| result[2] = vec256_xor(in[1], in[7]); 18| 5.34k| result[3] = vec256_xor(in[8], t); 19| 5.34k| result[4] = vec256_xor(in[2], in[7]); 20| 5.34k| result[4] = vec256_xor(result[4], in[8]); 21| 5.34k| result[4] = vec256_xor(result[4], t); 22| 5.34k| result[5] = vec256_xor(in[7], in[9]); 23| 5.34k| result[6] = vec256_xor(in[3], in[8]); 24| 5.34k| result[6] = vec256_xor(result[6], in[9]); 25| 5.34k| result[6] = vec256_xor(result[6], in[12]); 26| 5.34k| result[7] = vec256_xor(in[8], in[10]); 27| 5.34k| result[8] = vec256_xor(in[4], in[9]); 28| 5.34k| result[8] = vec256_xor(result[8], in[10]); 29| 5.34k| result[9] = vec256_xor(in[9], in[11]); 30| 5.34k| result[10] = vec256_xor(in[5], in[10]); 31| 5.34k| result[10] = vec256_xor(result[10], in[11]); 32| 5.34k| result[11] = vec256_xor(in[10], in[12]); 33| 5.34k| result[12] = vec256_xor(in[6], t); 34| | 35| 74.8k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 74.8k|#define GFBITS 13 ------------------ | Branch (35:17): [True: 69.4k, False: 5.34k] ------------------ 36| 69.4k| out[i] = result[i]; 37| 69.4k| } 38| 5.34k|} PQCLEAN_MCELIECE460896F_AVX2_vec256_inv: 41| 200|void vec256_inv(vec256 *out, vec256 *in) { 42| 200| vec256 tmp_11[ GFBITS ]; 43| 200| vec256 tmp_1111[ GFBITS ]; 44| | 45| 200| vec256_copy(out, in); 46| | 47| 200| vec256_sq(out, out); ------------------ | | 14| 200|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 200|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 48| 200| vec256_mul(tmp_11, out, in); // ^11 49| | 50| 200| vec256_sq(out, tmp_11); ------------------ | | 14| 200|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 200|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 51| 200| vec256_sq(out, out); ------------------ | | 14| 200|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 200|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 52| 200| vec256_mul(tmp_1111, out, tmp_11); // ^1111 53| | 54| 200| vec256_sq(out, tmp_1111); ------------------ | | 14| 200|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 200|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 55| 200| vec256_sq(out, out); ------------------ | | 14| 200|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 200|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 56| 200| vec256_sq(out, out); ------------------ | | 14| 200|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 200|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 57| 200| vec256_sq(out, out); ------------------ | | 14| 200|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 200|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 58| 200| vec256_mul(out, out, tmp_1111); // ^11111111 59| | 60| 200| vec256_sq(out, out); ------------------ | | 14| 200|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 200|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 61| 200| vec256_sq(out, out); ------------------ | | 14| 200|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 200|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 62| 200| vec256_sq(out, out); ------------------ | | 14| 200|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 200|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 63| 200| vec256_sq(out, out); ------------------ | | 14| 200|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 200|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 64| 200| vec256_mul(out, out, tmp_1111); // ^111111111111 65| | 66| 200| vec256_sq(out, out); // ^1111111111110 ------------------ | | 14| 200|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 200|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE460896F_AVX2_ ## fun | | ------------------ ------------------ 67| 200|} PQCLEAN_MCELIECE6688128_AVX2_load_bits: 188| 102|void load_bits(vec128 bits_int[][32], const unsigned char *bits) { 189| 102| int i, j; 190| 102| const unsigned char *ptr = bits; 191| | 192| 102| vec128 buf[64]; 193| | 194| 408| for (i = 0; i <= 5; i += 2) { ------------------ | Branch (194:17): [True: 306, False: 102] ------------------ 195| 19.8k| for (j = 0; j < 64; j++) { ------------------ | Branch (195:21): [True: 19.5k, False: 306] ------------------ 196| 19.5k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 197| 19.5k| ptr += 8; 198| 19.5k| } 199| | 200| 306| transpose_64x128_sp( buf ); 201| | 202| 10.0k| for (j = 0; j < 32; j++) { ------------------ | Branch (202:21): [True: 9.79k, False: 306] ------------------ 203| 9.79k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 204| 9.79k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 205| 9.79k| } 206| | 207| 306| ptr += 512; 208| 306| } 209| | 210| 1.42k| for (i = 6; i <= 18; i++) { ------------------ | Branch (210:17): [True: 1.32k, False: 102] ------------------ 211| 43.7k| for (j = 0; j < 32; j++) { ------------------ | Branch (211:21): [True: 42.4k, False: 1.32k] ------------------ 212| 42.4k| bits_int[i][j] = load16(ptr); 213| 42.4k| ptr += 16; 214| 42.4k| } 215| 1.32k| } 216| | 217| 408| for (i = 19; i < 25; i += 2) { ------------------ | Branch (217:18): [True: 306, False: 102] ------------------ 218| 19.8k| for (j = 0; j < 64; j++) { ------------------ | Branch (218:21): [True: 19.5k, False: 306] ------------------ 219| 19.5k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 220| 19.5k| ptr += 8; 221| 19.5k| } 222| | 223| 306| transpose_64x128_sp( buf ); 224| | 225| 10.0k| for (j = 0; j < 32; j++) { ------------------ | Branch (225:21): [True: 9.79k, False: 306] ------------------ 226| 9.79k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 227| 9.79k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 228| 9.79k| } 229| | 230| 306| ptr += 512; 231| 306| } 232| 102|} PQCLEAN_MCELIECE6688128_AVX2_benes: 238| 204|void benes(vec128 *r, vec128 b[][32], int rev) { 239| 204| int inc; 240| | 241| 204| vec128 *b_ptr; 242| | 243| 204| if (rev == 0) { ------------------ | Branch (243:9): [True: 102, False: 102] ------------------ 244| 102| inc = 32; 245| 102| b_ptr = b[ 0]; 246| 102| } else { 247| 102| inc = -32; 248| 102| b_ptr = b[24]; 249| 102| } 250| | 251| | // 252| | 253| 204| transpose_64x128_sp( r ); 254| | 255| 204| layer_0(r, b_ptr); 256| 204| b_ptr += inc; 257| 204| layer_1(r, b_ptr); 258| 204| b_ptr += inc; 259| 204| layer_2(r, b_ptr); 260| 204| b_ptr += inc; 261| 204| layer_3(r, b_ptr); 262| 204| b_ptr += inc; 263| 204| layer_4(r, b_ptr); 264| 204| b_ptr += inc; 265| 204| layer_5(r, b_ptr); 266| 204| b_ptr += inc; 267| | 268| 204| transpose_64x128_sp( r ); 269| | 270| 204| layer_x(r, b_ptr); 271| 204| b_ptr += inc; 272| 204| layer_0(r, b_ptr); 273| 204| b_ptr += inc; 274| 204| layer_1(r, b_ptr); 275| 204| b_ptr += inc; 276| 204| layer_2(r, b_ptr); 277| 204| b_ptr += inc; 278| 204| layer_3(r, b_ptr); 279| 204| b_ptr += inc; 280| 204| layer_4(r, b_ptr); 281| 204| b_ptr += inc; 282| 204| layer_5(r, b_ptr); 283| 204| b_ptr += inc; 284| 204| layer_4(r, b_ptr); 285| 204| b_ptr += inc; 286| 204| layer_3(r, b_ptr); 287| 204| b_ptr += inc; 288| 204| layer_2(r, b_ptr); 289| 204| b_ptr += inc; 290| 204| layer_1(r, b_ptr); 291| 204| b_ptr += inc; 292| 204| layer_0(r, b_ptr); 293| 204| b_ptr += inc; 294| 204| layer_x(r, b_ptr); 295| 204| b_ptr += inc; 296| | 297| 204| transpose_64x128_sp( r ); 298| | 299| 204| layer_5(r, b_ptr); 300| 204| b_ptr += inc; 301| 204| layer_4(r, b_ptr); 302| 204| b_ptr += inc; 303| 204| layer_3(r, b_ptr); 304| 204| b_ptr += inc; 305| 204| layer_2(r, b_ptr); 306| 204| b_ptr += inc; 307| 204| layer_1(r, b_ptr); 308| 204| b_ptr += inc; 309| 204| layer_0(r, b_ptr); 310| | 311| 204| transpose_64x128_sp( r ); 312| 204|} PQCLEAN_MCELIECE6688128_AVX2_bm: 147| 102|void bm(vec128 *out, vec256 *in) { 148| 102| int i; 149| 102| uint16_t N, L; 150| 102| uint16_t mask; 151| 102| uint64_t one = 1, t; 152| | 153| 102| vec128 prod[ GFBITS ]; 154| 102| vec128 interval[GFBITS]; 155| | 156| 102| typedef union { 157| 102| vec128 v[GFBITS][2]; 158| 102| vec256 V[GFBITS]; 159| 102| } db_t; 160| | 161| 102| db_t db; 162| 102| db_t BC_tmp; 163| 102| db_t BC; 164| | 165| 102| gf d, b, c0 = 1; 166| 102| gf coefs[256]; 167| | 168| | // initialization 169| | 170| 102| get_coefs(coefs, in); 171| | 172| 102| BC.v[0][0] = vec128_set2x(0, one << 63); 173| 102| BC.v[0][1] = vec128_setzero(); 174| | 175| 1.32k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.32k|#define GFBITS 13 ------------------ | Branch (175:17): [True: 1.22k, False: 102] ------------------ 176| 1.22k| BC.v[i][0] = BC.v[i][1] = vec128_setzero(); 177| 1.22k| } 178| | 179| 102| b = 1; 180| 102| L = 0; 181| | 182| | // 183| | 184| 1.42k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.42k|#define GFBITS 13 ------------------ | Branch (184:17): [True: 1.32k, False: 102] ------------------ 185| 1.32k| interval[i] = vec128_setzero(); 186| 1.32k| } 187| | 188| 26.2k| for (N = 0; N < 256; N++) { ------------------ | Branch (188:17): [True: 26.1k, False: 102] ------------------ 189| 26.1k| vec128_mul_asm(prod, interval, BC.v[0] + 1, 32); ------------------ | | 10| 26.1k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 26.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 190| 26.1k| update_asm(interval, coefs[N], 16); ------------------ | | 1| 26.1k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 26.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 191| | 192| 26.1k| d = vec_reduce_asm(prod); ------------------ | | 3| 26.1k|#define vec_reduce_asm CRYPTO_NAMESPACE(vec_reduce_asm) | | ------------------ | | | | 4| 26.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 193| | 194| 26.1k| t = gf_mul2(c0, coefs[N], b); ------------------ | | 13| 26.1k|#define gf_mul2 CRYPTO_NAMESPACE(gf_mul2) | | ------------------ | | | | 4| 26.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 195| 26.1k| d ^= t & 0xFFFFFFFF; 196| | 197| 26.1k| mask = mask_nonzero(d) & mask_leq(L * 2, N); 198| | 199| 365k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 365k|#define GFBITS 13 ------------------ | Branch (199:21): [True: 339k, False: 26.1k] ------------------ 200| 339k| db.v[i][0] = vec128_setbits((d >> i) & 1); 201| 339k| db.v[i][1] = vec128_setbits((b >> i) & 1); 202| 339k| } 203| | 204| 26.1k| vec256_mul((vec256 *) BC_tmp.V, (vec256 *) db.V, (vec256 *) BC.V); 205| | 206| 26.1k| vec128_cmov(BC.v, mask); 207| 26.1k| update_asm(BC.v, c0 & mask, 32); ------------------ | | 1| 26.1k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 26.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| 365k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 365k|#define GFBITS 13 ------------------ | Branch (209:21): [True: 339k, False: 26.1k] ------------------ 210| 339k| BC.v[i][1] = vec128_xor(BC_tmp.v[i][0], BC_tmp.v[i][1]); 211| 339k| } 212| | 213| 26.1k| c0 = t >> 32; 214| 26.1k| b = (d & mask) | (b & ~mask); 215| 26.1k| L = ((N + 1 - L) & mask) | (L & ~mask); 216| 26.1k| } 217| | 218| 102| c0 = gf_inv(c0); ------------------ | | 11| 102|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 219| | 220| 1.42k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.42k|#define GFBITS 13 ------------------ | Branch (220:17): [True: 1.32k, False: 102] ------------------ 221| 1.32k| prod[i] = vec128_setbits((c0 >> i) & 1); 222| 1.32k| } 223| | 224| 102| vec128_mul_asm(out, prod, BC.v[0] + 1, 32); ------------------ | | 10| 102|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 225| 102|} PQCLEAN_MCELIECE6688128_AVX2_controlbitsfrompermutation: 205| 102|void controlbitsfrompermutation(unsigned char *out, const int16 *pi, long long w, long long n) { 206| 102| PQCLEAN_VLA(int32, temp, (size_t)(2 * n)); ------------------ | | 57| 102|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 207| 102| PQCLEAN_VLA(int16, pi_test, (size_t)n); ------------------ | | 57| 102|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 208| 102| int16 diff; 209| 102| int i; 210| 102| unsigned char *ptr; 211| | 212| 102| OQS_MEM_cleanse(temp, (size_t)n * 2); 213| 102| OQS_MEM_cleanse(pi_test, (size_t)n); 214| | 215| 102| while (1) { ------------------ | Branch (215:12): [True: 102, Folded] ------------------ 216| 102| OQS_MEM_cleanse(out, (size_t)((((2 * w - 1)*n / 2) + 7) / 8)); 217| 102| cbrecursion(out, 0, 1, pi, w, n, temp); 218| | 219| | // check for correctness 220| | 221| 835k| for (i = 0; i < n; i++) { ------------------ | Branch (221:21): [True: 835k, False: 102] ------------------ 222| 835k| pi_test[i] = (int16)i; 223| 835k| } 224| | 225| 102| ptr = out; 226| 1.42k| for (i = 0; i < w; i++) { ------------------ | Branch (226:21): [True: 1.32k, False: 102] ------------------ 227| 1.32k| layer(pi_test, ptr, i, (int32)n); 228| 1.32k| ptr += n >> 4; 229| 1.32k| } 230| | 231| 1.32k| for (i = (int)(w - 2); i >= 0; i--) { ------------------ | Branch (231:32): [True: 1.22k, False: 102] ------------------ 232| 1.22k| layer(pi_test, ptr, i, (int32)n); 233| 1.22k| ptr += n >> 4; 234| 1.22k| } 235| | 236| 102| diff = 0; 237| 835k| for (i = 0; i < n; i++) { ------------------ | Branch (237:21): [True: 835k, False: 102] ------------------ 238| 835k| diff |= pi[i] ^ pi_test[i]; 239| 835k| } 240| | 241| 102| diff = crypto_int16_nonzero_mask(diff); ------------------ | | 12| 102|#define crypto_int16_nonzero_mask CRYPTO_NAMESPACE(crypto_int16_nonzero_mask) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 242| 102| crypto_declassify(&diff, sizeof diff); 243| 102| if (diff == 0) { ------------------ | Branch (243:13): [True: 102, False: 0] ------------------ 244| 102| break; 245| 102| } 246| 102| } 247| 102|} PQCLEAN_MCELIECE6688128_AVX2_crypto_int16_negative_mask: 3| 204|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 4| 204| return crypto_int16_x >> 15; 5| 204|} PQCLEAN_MCELIECE6688128_AVX2_crypto_int16_nonzero_mask: 7| 102|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 8| 102| return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 102|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 102|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 9| 102|} PQCLEAN_MCELIECE6688128_AVX2_crypto_int32_negative_mask: 3| 65.1M|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 4| 65.1M| return crypto_int32_x >> 31; 5| 65.1M|} PQCLEAN_MCELIECE6688128_AVX2_crypto_int32_min: 37| 65.1M|crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x, crypto_int32 crypto_int32_y) { 38| 65.1M| crypto_int32 crypto_int32_xy = crypto_int32_y ^ crypto_int32_x; 39| 65.1M| crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x; 40| 65.1M| crypto_int32_z ^= crypto_int32_xy & (crypto_int32_z ^ crypto_int32_y); 41| 65.1M| crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); ------------------ | | 9| 65.1M|#define crypto_int32_negative_mask CRYPTO_NAMESPACE(crypto_int32_negative_mask) | | ------------------ | | | | 4| 65.1M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 42| 65.1M| crypto_int32_z &= crypto_int32_xy; 43| 65.1M| return crypto_int32_x ^ crypto_int32_z; 44| 65.1M|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint16_signed_negative_mask: 3| 342k|crypto_uint16_signed crypto_uint16_signed_negative_mask(crypto_uint16_signed crypto_uint16_signed_x) { 4| 342k| return crypto_uint16_signed_x >> 15; 5| 342k|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint16_nonzero_mask: 7| 114k|crypto_uint16 crypto_uint16_nonzero_mask(crypto_uint16 crypto_uint16_x) { 8| 114k| return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 114k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 114k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 114k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 114k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 9| 114k|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint16_zero_mask: 11| 114k|crypto_uint16 crypto_uint16_zero_mask(crypto_uint16 crypto_uint16_x) { 12| 114k| return ~crypto_uint16_nonzero_mask(crypto_uint16_x); ------------------ | | 13| 114k|#define crypto_uint16_nonzero_mask CRYPTO_NAMESPACE(crypto_uint16_nonzero_mask) | | ------------------ | | | | 4| 114k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 13| 114k|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint16_smaller_mask: 24| 113k|crypto_uint16 crypto_uint16_smaller_mask(crypto_uint16 crypto_uint16_x, crypto_uint16 crypto_uint16_y) { 25| 113k| crypto_uint16 crypto_uint16_xy = crypto_uint16_x ^ crypto_uint16_y; 26| 113k| crypto_uint16 crypto_uint16_z = crypto_uint16_x - crypto_uint16_y; 27| 113k| crypto_uint16_z ^= crypto_uint16_xy & (crypto_uint16_z ^ crypto_uint16_x ^ (((crypto_uint16) 1) << 15)); 28| 113k| return crypto_uint16_signed_negative_mask(crypto_uint16_z); ------------------ | | 11| 113k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 113k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 29| 113k|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint32_signed_negative_mask: 3| 183k|crypto_uint32_signed crypto_uint32_signed_negative_mask(crypto_uint32_signed crypto_uint32_signed_x) { 4| 183k| return crypto_uint32_signed_x >> 31; 5| 183k|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint32_nonzero_mask: 7| 91.8k|crypto_uint32 crypto_uint32_nonzero_mask(crypto_uint32 crypto_uint32_x) { 8| 91.8k| return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 91.8k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 91.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 91.8k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 91.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 9| 91.8k|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint32_unequal_mask: 15| 91.8k|crypto_uint32 crypto_uint32_unequal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 16| 91.8k| crypto_uint32 crypto_uint32_xy = crypto_uint32_x ^ crypto_uint32_y; 17| 91.8k| return crypto_uint32_nonzero_mask(crypto_uint32_xy); ------------------ | | 13| 91.8k|#define crypto_uint32_nonzero_mask CRYPTO_NAMESPACE(crypto_uint32_nonzero_mask) | | ------------------ | | | | 4| 91.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 18| 91.8k|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint32_equal_mask: 20| 91.8k|crypto_uint32 crypto_uint32_equal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 21| 91.8k| return ~crypto_uint32_unequal_mask(crypto_uint32_x, crypto_uint32_y); ------------------ | | 17| 91.8k|#define crypto_uint32_unequal_mask CRYPTO_NAMESPACE(crypto_uint32_unequal_mask) | | ------------------ | | | | 4| 91.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 22| 91.8k|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint64_signed_negative_mask: 3| 17.2M|crypto_uint64_signed crypto_uint64_signed_negative_mask(crypto_uint64_signed crypto_uint64_signed_x) { 4| 17.2M| return crypto_uint64_signed_x >> 63; 5| 17.2M|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint64_nonzero_mask: 7| 8.60M|crypto_uint64 crypto_uint64_nonzero_mask(crypto_uint64 crypto_uint64_x) { 8| 8.60M| return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 8.60M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 8.60M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 8.60M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 8.60M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 9| 8.60M|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint64_zero_mask: 11| 1.42M|crypto_uint64 crypto_uint64_zero_mask(crypto_uint64 crypto_uint64_x) { 12| 1.42M| return ~crypto_uint64_nonzero_mask(crypto_uint64_x); ------------------ | | 13| 1.42M|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 1.42M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 13| 1.42M|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint64_unequal_mask: 15| 7.18M|crypto_uint64 crypto_uint64_unequal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 16| 7.18M| crypto_uint64 crypto_uint64_xy = crypto_uint64_x ^ crypto_uint64_y; 17| 7.18M| return crypto_uint64_nonzero_mask(crypto_uint64_xy); ------------------ | | 13| 7.18M|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 7.18M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 18| 7.18M|} PQCLEAN_MCELIECE6688128_AVX2_crypto_uint64_equal_mask: 20| 7.18M|crypto_uint64 crypto_uint64_equal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 21| 7.18M| return ~crypto_uint64_unequal_mask(crypto_uint64_x, crypto_uint64_y); ------------------ | | 17| 7.18M|#define crypto_uint64_unequal_mask CRYPTO_NAMESPACE(crypto_uint64_unequal_mask) | | ------------------ | | | | 4| 7.18M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 22| 7.18M|} PQCLEAN_MCELIECE6688128_AVX2_decrypt: 171| 102|int decrypt(unsigned char *e, const unsigned char *sk, const unsigned char *s) { 172| 102| int i; 173| | 174| 102| uint16_t check_synd; 175| 102| uint16_t check_weight; 176| | 177| 102| vec256 inv[ 32 ][ GFBITS ]; 178| 102| vec256 scaled[ 32 ][ GFBITS ]; 179| 102| vec256 eval[32][ GFBITS ]; 180| | 181| 102| vec128 error128[ 64 ]; 182| 102| vec256 error256[ 32 ]; 183| | 184| 102| vec256 s_priv[ GFBITS ]; 185| 102| vec256 s_priv_cmp[ GFBITS ]; 186| 102| vec128 locator[ GFBITS ]; 187| | 188| 102| vec128 recv128[ 64 ]; 189| 102| vec256 recv256[ 32 ]; 190| 102| vec256 allone; 191| | 192| 102| vec128 bits_int[25][32]; 193| | 194| | // Berlekamp decoder 195| | 196| 102| preprocess(recv128, s); 197| | 198| 102| load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 10| 102|#define load_bits CRYPTO_NAMESPACE(load_bits) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 11| 102|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 102|#define SYS_T 128 | | ------------------ ------------------ 199| 102| benes(recv128, bits_int, 1); ------------------ | | 9| 102|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 200| | 201| 102| reformat_128to256(recv256, recv128); 202| | 203| 102| scaling(scaled, inv, sk, recv256); 204| 102| fft_tr(s_priv, scaled); ------------------ | | 9| 102|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 205| 102| bm(locator, s_priv); ------------------ | | 10| 102|#define bm CRYPTO_NAMESPACE(bm) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 102| fft(eval, locator); ------------------ | | 10| 102|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| | // reencryption and weight check 210| | 211| 102| allone = vec256_set1_16b(0xFFFF); 212| | 213| 3.36k| for (i = 0; i < 32; i++) { ------------------ | Branch (213:17): [True: 3.26k, False: 102] ------------------ 214| 3.26k| error256[i] = vec256_or_reduce(eval[i]); 215| 3.26k| error256[i] = vec256_xor(error256[i], allone); 216| 3.26k| } 217| | 218| 102| scaling_inv(scaled, inv, error256); 219| 102| fft_tr(s_priv_cmp, scaled); ------------------ | | 9| 102|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 220| | 221| 102| check_synd = synd_cmp(s_priv, s_priv_cmp); 222| | 223| | // 224| | 225| 102| reformat_256to128(error128, error256); 226| 102| benes(error128, bits_int, 0); ------------------ | | 9| 102|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 227| | 228| 102| postprocess(e, error128); 229| | 230| 102| check_weight = weight_check(e, error128); 231| | 232| 102| return 1 - (check_synd & check_weight); 233| 102|} PQCLEAN_MCELIECE6688128_AVX2_encrypt: 116| 102|void encrypt(unsigned char *s, const unsigned char *pk, unsigned char *e) { 117| 102| gen_e(e); 118| | 119| 102| syndrome_asm(s, pk, e); ------------------ | | 1| 102|#define syndrome_asm CRYPTO_NAMESPACE(syndrome_asm) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 120| 102|} PQCLEAN_MCELIECE6688128_AVX2_fft: 277| 1.09k|void fft(vec256 out[][GFBITS], vec128 *in) { 278| 1.09k| radix_conversions(in); 279| 1.09k| butterflies(out, in); 280| 1.09k|} PQCLEAN_MCELIECE6688128_AVX2_fft_tr: 380| 204|void fft_tr(vec256 *out, vec256 in[][ GFBITS ]) { 381| 204| butterflies_tr(out, in); 382| 204| radix_conversions_tr(out); 383| 204|} PQCLEAN_MCELIECE6688128_AVX2_gf_mul: 12| 14.6M|gf gf_mul(gf in0, gf in1) { 13| 14.6M| int i; 14| | 15| 14.6M| uint64_t tmp; 16| 14.6M| uint64_t t0; 17| 14.6M| uint64_t t1; 18| 14.6M| uint64_t t; 19| | 20| 14.6M| t0 = in0; 21| 14.6M| t1 = in1; 22| | 23| 14.6M| tmp = t0 * (t1 & 1); 24| | 25| 190M| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 190M|#define GFBITS 13 ------------------ | Branch (25:17): [True: 175M, False: 14.6M] ------------------ 26| 175M| tmp ^= (t0 * (t1 & (1 << i))); 27| 175M| } 28| | 29| | // 30| | 31| 14.6M| t = tmp & 0x1FF0000; 32| 14.6M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 33| | 34| 14.6M| t = tmp & 0x000E000; 35| 14.6M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 36| | 37| 14.6M| return tmp & GFMASK; ------------------ | | 19| 14.6M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 14.6M|#define GFBITS 13 | | ------------------ ------------------ 38| 14.6M|} PQCLEAN_MCELIECE6688128_AVX2_gf_mul2: 41| 26.1k|uint64_t gf_mul2(gf a, gf b0, gf b1) { 42| 26.1k| int i; 43| | 44| 26.1k| uint64_t tmp = 0; 45| 26.1k| uint64_t t0; 46| 26.1k| uint64_t t1; 47| 26.1k| uint64_t t; 48| 26.1k| uint64_t mask = 0x0000000100000001; 49| | 50| 26.1k| t0 = a; 51| 26.1k| t1 = b1; 52| 26.1k| t1 = (t1 << 32) | b0; 53| | 54| 365k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 365k|#define GFBITS 13 ------------------ | Branch (54:17): [True: 339k, False: 26.1k] ------------------ 55| 339k| tmp ^= t0 * (t1 & mask); 56| 339k| mask += mask; 57| 339k| } 58| | 59| | // 60| | 61| 26.1k| t = tmp & 0x01FF000001FF0000; 62| 26.1k| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 63| | 64| 26.1k| t = tmp & 0x0000E0000000E000; 65| 26.1k| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 66| | 67| 26.1k| return tmp & 0x00001FFF00001FFF; 68| 26.1k|} PQCLEAN_MCELIECE6688128_AVX2_gf_frac: 178| 114k|gf gf_frac(gf den, gf num) { 179| 114k| gf tmp_11; 180| 114k| gf tmp_1111; 181| 114k| gf out; 182| | 183| 114k| tmp_11 = gf_sqmul(den, den); // 11 184| 114k| tmp_1111 = gf_sq2mul(tmp_11, tmp_11); // 1111 185| 114k| out = gf_sq2(tmp_1111); 186| 114k| out = gf_sq2mul(out, tmp_1111); // 11111111 187| 114k| out = gf_sq2(out); 188| 114k| out = gf_sq2mul(out, tmp_1111); // 111111111111 189| | 190| 114k| return gf_sqmul(out, num); // 1111111111110 191| 114k|} PQCLEAN_MCELIECE6688128_AVX2_gf_inv: 194| 114k|gf gf_inv(gf den) { 195| 114k| return gf_frac(den, ((gf) 1)); ------------------ | | 10| 114k|#define gf_frac CRYPTO_NAMESPACE(gf_frac) | | ------------------ | | | | 4| 114k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 196| 114k|} pk_gen.c:PQCLEAN_MCELIECE6688128_AVX2_int32_sort: 21| 102|static void int32_sort(int32_t *x, long long n) { 22| 102| long long top, p, q, r, i; 23| | 24| 102| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 102] ------------------ 25| 0| return; 26| 0| } 27| 102| top = 1; 28| 1.12k| while (top < n - top) { ------------------ | Branch (28:12): [True: 1.02k, False: 102] ------------------ 29| 1.02k| top += top; 30| 1.02k| } 31| | 32| 1.22k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 1.12k, False: 102] ------------------ 33| 1.65M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.65M, False: 1.12k] ------------------ 34| 1.65M| if (!(i & p)) { ------------------ | Branch (34:17): [True: 881k, False: 776k] ------------------ 35| 881k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 881k| do { \ | | 12| 881k| int32_t ab = (b) ^ (a); \ | | 13| 881k| int32_t c = (b) - (a); \ | | 14| 881k| c ^= ab & ((c) ^ (b)); \ | | 15| 881k| c >>= 31; \ | | 16| 881k| c &= ab; \ | | 17| 881k| (a) ^= c; \ | | 18| 881k| (b) ^= c; \ | | 19| 881k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 881k] | | ------------------ ------------------ 36| 881k| } 37| 1.65M| } 38| 1.12k| i = 0; 39| 6.73k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 5.61k, False: 1.12k] ------------------ 40| 1.49M| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.48M, False: 5.61k] ------------------ 41| 1.48M| if (!(i & p)) { ------------------ | Branch (41:21): [True: 776k, False: 711k] ------------------ 42| 776k| int32_t a = x[i + p]; 43| 4.55M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 3.77M, False: 776k] ------------------ 44| 3.77M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 3.77M| do { \ | | 12| 3.77M| int32_t ab = (b) ^ (a); \ | | 13| 3.77M| int32_t c = (b) - (a); \ | | 14| 3.77M| c ^= ab & ((c) ^ (b)); \ | | 15| 3.77M| c >>= 31; \ | | 16| 3.77M| c &= ab; \ | | 17| 3.77M| (a) ^= c; \ | | 18| 3.77M| (b) ^= c; \ | | 19| 3.77M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.77M] | | ------------------ ------------------ 45| 3.77M| } 46| 776k| x[i + p] = a; 47| 776k| } 48| 1.48M| } 49| 5.61k| } 50| 1.12k| } 51| 102|} controlbits.c:PQCLEAN_MCELIECE6688128_AVX2_int32_sort: 21| 3.34M|static void int32_sort(int32_t *x, long long n) { 22| 3.34M| long long top, p, q, r, i; 23| | 24| 3.34M| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 3.34M] ------------------ 25| 0| return; 26| 0| } 27| 3.34M| top = 1; 28| 11.7M| while (top < n - top) { ------------------ | Branch (28:12): [True: 8.37M, False: 3.34M] ------------------ 29| 8.37M| top += top; 30| 8.37M| } 31| | 32| 15.0M| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 11.7M, False: 3.34M] ------------------ 33| 1.61G| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.60G, False: 11.7M] ------------------ 34| 1.60G| if (!(i & p)) { ------------------ | Branch (34:17): [True: 894M, False: 705M] ------------------ 35| 894M| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 894M| do { \ | | 12| 894M| int32_t ab = (b) ^ (a); \ | | 13| 894M| int32_t c = (b) - (a); \ | | 14| 894M| c ^= ab & ((c) ^ (b)); \ | | 15| 894M| c >>= 31; \ | | 16| 894M| c &= ab; \ | | 17| 894M| (a) ^= c; \ | | 18| 894M| (b) ^= c; \ | | 19| 894M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 894M] | | ------------------ ------------------ 36| 894M| } 37| 1.60G| } 38| 11.7M| i = 0; 39| 31.8M| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 20.0M, False: 11.7M] ------------------ 40| 1.43G| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.41G, False: 20.0M] ------------------ 41| 1.41G| if (!(i & p)) { ------------------ | Branch (41:21): [True: 705M, False: 705M] ------------------ 42| 705M| int32_t a = x[i + p]; 43| 4.17G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 3.47G, False: 705M] ------------------ 44| 3.47G| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 3.47G| do { \ | | 12| 3.47G| int32_t ab = (b) ^ (a); \ | | 13| 3.47G| int32_t c = (b) - (a); \ | | 14| 3.47G| c ^= ab & ((c) ^ (b)); \ | | 15| 3.47G| c >>= 31; \ | | 16| 3.47G| c &= ab; \ | | 17| 3.47G| (a) ^= c; \ | | 18| 3.47G| (b) ^= c; \ | | 19| 3.47G| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.47G] | | ------------------ ------------------ 45| 3.47G| } 46| 705M| x[i + p] = a; 47| 705M| } 48| 1.41G| } 49| 20.0M| } 50| 11.7M| } 51| 3.34M|} encrypt.c:PQCLEAN_MCELIECE6688128_AVX2_int32_sort: 21| 723|static void int32_sort(int32_t *x, long long n) { 22| 723| long long top, p, q, r, i; 23| | 24| 723| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 723] ------------------ 25| 0| return; 26| 0| } 27| 723| top = 1; 28| 5.06k| while (top < n - top) { ------------------ | Branch (28:12): [True: 4.33k, False: 723] ------------------ 29| 4.33k| top += top; 30| 4.33k| } 31| | 32| 5.78k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 5.06k, False: 723] ------------------ 33| 561k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 555k, False: 5.06k] ------------------ 34| 555k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 323k, False: 232k] ------------------ 35| 323k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 323k| do { \ | | 12| 323k| int32_t ab = (b) ^ (a); \ | | 13| 323k| int32_t c = (b) - (a); \ | | 14| 323k| c ^= ab & ((c) ^ (b)); \ | | 15| 323k| c >>= 31; \ | | 16| 323k| c &= ab; \ | | 17| 323k| (a) ^= c; \ | | 18| 323k| (b) ^= c; \ | | 19| 323k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 323k] | | ------------------ ------------------ 36| 323k| } 37| 555k| } 38| 5.06k| i = 0; 39| 20.2k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 15.1k, False: 5.06k] ------------------ 40| 479k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 464k, False: 15.1k] ------------------ 41| 464k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 232k, False: 232k] ------------------ 42| 232k| int32_t a = x[i + p]; 43| 971k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 739k, False: 232k] ------------------ 44| 739k| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 739k| do { \ | | 12| 739k| int32_t ab = (b) ^ (a); \ | | 13| 739k| int32_t c = (b) - (a); \ | | 14| 739k| c ^= ab & ((c) ^ (b)); \ | | 15| 739k| c >>= 31; \ | | 16| 739k| c &= ab; \ | | 17| 739k| (a) ^= c; \ | | 18| 739k| (b) ^= c; \ | | 19| 739k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 739k] | | ------------------ ------------------ 45| 739k| } 46| 232k| x[i + p] = a; 47| 232k| } 48| 464k| } 49| 15.1k| } 50| 5.06k| } 51| 723|} PQCLEAN_MCELIECE6688128_AVX2_crypto_kem_enc: 22| 102|) { 23| 102| unsigned char e[ SYS_N / 8 ]; 24| 102| unsigned char one_ec[ 1 + SYS_N / 8 + SYND_BYTES ] = {1}; 25| | 26| | // 27| | 28| 102| encrypt(c, pk, e); ------------------ | | 9| 102|#define encrypt CRYPTO_NAMESPACE(encrypt) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 29| | 30| 102| memcpy(one_ec + 1, e, SYS_N / 8); ------------------ | | 7| 102|#define SYS_N 6688 ------------------ 31| 102| memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 7| 102|#define SYS_N 6688 ------------------ memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 17| 102|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 102|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 102|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 102|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 32| | 33| 102| crypto_hash_32b(key, one_ec, sizeof(one_ec)); ------------------ | | 7| 102| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 102|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 34| | 35| 102| return 0; 36| 102|} PQCLEAN_MCELIECE6688128_AVX2_crypto_kem_dec: 42| 102|) { 43| 102| int i; 44| | 45| 102| unsigned char ret_decrypt = 0; 46| | 47| 102| uint16_t m; 48| | 49| 102| unsigned char e[ SYS_N / 8 ]; 50| 102| unsigned char preimage[ 1 + SYS_N / 8 + SYND_BYTES ]; 51| 102| unsigned char *x = preimage; 52| 102| const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 11| 102|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 102|#define SYS_T 128 | | ------------------ ------------------ const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 10| 102|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 102|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 102|#define GFBITS 13 | | ------------------ ------------------ 53| | 54| | // 55| | 56| 102| ret_decrypt = (unsigned char)decrypt(e, sk + 40, c); ------------------ | | 9| 102|#define decrypt CRYPTO_NAMESPACE(decrypt) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 57| | 58| 102| m = ret_decrypt; 59| 102| m -= 1; 60| 102| m >>= 8; 61| | 62| 102| *x++ = m & 1; 63| 85.3k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 85.3k|#define SYS_N 6688 ------------------ | Branch (63:17): [True: 85.2k, False: 102] ------------------ 64| 85.2k| *x++ = (~m & s[i]) | (m & e[i]); 65| 85.2k| } 66| | 67| 21.3k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 21.3k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 21.3k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 21.3k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 21.3k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (67:17): [True: 21.2k, False: 102] ------------------ 68| 21.2k| *x++ = c[i]; 69| 21.2k| } 70| | 71| 102| crypto_hash_32b(key, preimage, sizeof(preimage)); ------------------ | | 7| 102| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 102|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 72| | 73| 102| return 0; 74| 102|} PQCLEAN_MCELIECE6688128_AVX2_crypto_kem_keypair: 80| 102|) { 81| 102| int i; 82| 102| unsigned char seed[ 33 ] = {64}; 83| 102| unsigned char r[ SYS_N / 8 + (1 << GFBITS)*sizeof(uint32_t) + SYS_T * 2 + 32 ]; 84| 102| unsigned char *rp, *skp; 85| | 86| 102| gf f[ SYS_T ]; // element in GF(2^mt) 87| 102| gf irr[ SYS_T ]; // Goppa polynomial 88| 102| uint32_t perm[ 1 << GFBITS ]; // random permutation as 32-bit integers 89| 102| int16_t pi[ 1 << GFBITS ]; // random permutation 90| | 91| 102| randombytes(seed + 1, 32); ------------------ | | 8| 102|#define randombytes OQS_randombytes ------------------ 92| | 93| 894| while (1) { ------------------ | Branch (93:12): [True: 894, Folded] ------------------ 94| 894| rp = &r[ sizeof(r) - 32 ]; 95| 894| skp = sk; 96| | 97| | // expanding and updating the seed 98| | 99| 894| shake(r, sizeof(r), seed, 33); ------------------ | | 10| 894| shake256(out, outlen, in, inlen) | | ------------------ | | | | 12| 894|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 100| 894| memcpy(skp, seed + 1, 32); 101| 894| skp += 32 + 8; 102| 894| memcpy(seed + 1, &r[ sizeof(r) - 32 ], 32); 103| | 104| | // generating irreducible polynomial 105| | 106| 894| rp -= sizeof(f); 107| | 108| 115k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 115k|#define SYS_T 128 ------------------ | Branch (108:21): [True: 114k, False: 894] ------------------ 109| 114k| f[i] = load_gf(rp + i * 2); 110| 114k| } 111| | 112| 894| if (genpoly_gen(irr, f)) { ------------------ | | 9| 894|#define genpoly_gen CRYPTO_NAMESPACE(genpoly_gen) | | ------------------ | | | | 4| 894|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ | Branch (112:13): [True: 0, False: 894] ------------------ 113| 0| continue; 114| 0| } 115| | 116| 115k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 115k|#define SYS_T 128 ------------------ | Branch (116:21): [True: 114k, False: 894] ------------------ 117| 114k| store_gf(skp + i * 2, irr[i]); 118| 114k| } 119| | 120| 894| skp += IRR_BYTES; ------------------ | | 11| 894|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 894|#define SYS_T 128 | | ------------------ ------------------ 121| | 122| | // generating permutation 123| | 124| 894| rp -= sizeof(perm); 125| | 126| 7.32M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 7.32M|#define GFBITS 13 ------------------ | Branch (126:21): [True: 7.32M, False: 894] ------------------ 127| 7.32M| perm[i] = load4(rp + i * 4); 128| 7.32M| } 129| | 130| 894| if (pk_gen(pk, skp - IRR_BYTES, perm, pi)) { ------------------ | | 9| 894|#define pk_gen CRYPTO_NAMESPACE(pk_gen) | | ------------------ | | | | 4| 894|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ if (pk_gen(pk, skp - IRR_BYTES, perm, pi)) { ------------------ | | 11| 894|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 894|#define SYS_T 128 | | ------------------ ------------------ | Branch (130:13): [True: 792, False: 102] ------------------ 131| 792| continue; 132| 792| } 133| | 134| 102| controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 10| 102|#define controlbitsfrompermutation CRYPTO_NAMESPACE(controlbitsfrompermutation) | | ------------------ | | | | 4| 102|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 102|#define GFBITS 13 ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 102|#define GFBITS 13 ------------------ 135| 102| skp += COND_BYTES; ------------------ | | 10| 102|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 102|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 102|#define GFBITS 13 | | ------------------ ------------------ 136| | 137| | // storing the random string s 138| | 139| 102| rp -= SYS_N / 8; ------------------ | | 7| 102|#define SYS_N 6688 ------------------ 140| 102| memcpy(skp, rp, SYS_N / 8); ------------------ | | 7| 102|#define SYS_N 6688 ------------------ 141| | 142| | // storing positions of the 32 pivots 143| | 144| 102| store8(sk + 32, 0xFFFFFFFF); 145| | 146| 102| break; 147| 894| } 148| | 149| 102| return 0; 150| 102|} PQCLEAN_MCELIECE6688128_AVX2_pk_gen: 199| 894|int pk_gen(unsigned char *pk, const unsigned char *irr, const uint32_t *perm, int16_t *pi) { 200| 894|#define nBlocks_I ((PK_NROWS + 255) / 256) 201| | 202| 894| int i, j, k, b; 203| 894| int row, c; 204| | 205| 894| union { 206| 894| uint64_t w[ PK_NROWS ][ nBlocks_I * 4 ]; 207| 894| vec256 v[ PK_NROWS ][ nBlocks_I ]; 208| 894| } mat; 209| | 210| 894| union { 211| 894| uint64_t w[ PK_NROWS ][ 28 ]; 212| 894| vec256 v[ PK_NROWS ][ 7 ]; 213| 894| } par; 214| | 215| 894| uint16_t m; 216| 894| vec256 mm; 217| | 218| 894| vec128 sk_int[ GFBITS ]; 219| | 220| 894| vec256 consts[ 32 ][ GFBITS ]; 221| 894| vec256 eval[ 32 ][ GFBITS ]; 222| 894| vec256 prod[ 32 ][ GFBITS ]; 223| 894| vec256 tmp[ GFBITS ]; 224| | 225| 894| uint64_t list[1 << GFBITS]; 226| 894| uint64_t one = 1; 227| 894| uint64_t t; 228| | 229| 894| uint16_t ind[ PK_NROWS ]; 230| 894| uint16_t ind_inv[ PK_NROWS ]; 231| | 232| | // compute the inverses 233| | 234| 894| irr_load(sk_int, irr); 235| | 236| 894| fft(eval, sk_int); ------------------ | | 10| 894|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 894|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 237| | 238| 894| vec256_copy(prod[0], eval[0]); 239| | 240| 28.6k| for (i = 1; i < 32; i++) { ------------------ | Branch (240:17): [True: 27.7k, False: 894] ------------------ 241| 27.7k| vec256_mul(prod[i], prod[i - 1], eval[i]); 242| 27.7k| } 243| | 244| 894| vec256_inv(tmp, prod[31]); ------------------ | | 11| 894|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 894|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 245| | 246| 28.6k| for (i = 30; i >= 0; i--) { ------------------ | Branch (246:18): [True: 27.7k, False: 894] ------------------ 247| 27.7k| vec256_mul(prod[i + 1], prod[i], tmp); 248| 27.7k| vec256_mul(tmp, tmp, eval[i + 1]); 249| 27.7k| } 250| | 251| 894| vec256_copy(prod[0], tmp); 252| | 253| | // fill matrix 254| | 255| 894| de_bitslicing(list, prod); 256| | 257| 7.32M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 7.32M|#define GFBITS 13 ------------------ | Branch (257:17): [True: 7.32M, False: 894] ------------------ 258| 7.32M| list[i] <<= GFBITS; ------------------ | | 6| 7.32M|#define GFBITS 13 ------------------ 259| 7.32M| list[i] |= i; 260| 7.32M| list[i] |= ((uint64_t) perm[i]) << 31; 261| 7.32M| } 262| | 263| 894| uint64_sort(list, 1 << GFBITS); ------------------ | | 6| 894|#define GFBITS 13 ------------------ 264| | 265| 7.18M| for (i = 1; i < (1 << GFBITS); i++) { ------------------ | | 6| 7.18M|#define GFBITS 13 ------------------ | Branch (265:17): [True: 7.18M, False: 856] ------------------ 266| 7.18M| if (uint64_is_equal_declassify(list[i - 1] >> 31, list[i] >> 31)) { ------------------ | Branch (266:13): [True: 38, False: 7.18M] ------------------ 267| 38| return -1; 268| 38| } 269| 7.18M| } 270| | 271| 856| to_bitslicing_2x(consts, prod, list); 272| | 273| 7.01M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 7.01M|#define GFBITS 13 ------------------ | Branch (273:17): [True: 7.01M, False: 856] ------------------ 274| 7.01M| pi[i] = list[i] & GFMASK; ------------------ | | 19| 7.01M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 7.01M|#define GFBITS 13 | | ------------------ ------------------ 275| 7.01M| } 276| | 277| 6.84k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 200| 6.84k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 6.84k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 6.84k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 6.84k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (277:17): [True: 5.99k, False: 856] ------------------ 278| 83.8k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 83.8k|#define GFBITS 13 ------------------ | Branch (278:21): [True: 77.8k, False: 5.99k] ------------------ 279| 77.8k| mat.v[ k ][ j ] = prod[ j ][ k ]; 280| 77.8k| } 281| 5.99k| } 282| | 283| 109k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 109k|#define SYS_T 128 ------------------ | Branch (283:17): [True: 108k, False: 856] ------------------ 284| 869k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 200| 869k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 869k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 869k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 869k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (284:21): [True: 760k, False: 108k] ------------------ 285| 760k| vec256_mul(prod[j], prod[j], consts[j]); 286| | 287| 10.6M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 10.6M|#define GFBITS 13 ------------------ | Branch (287:25): [True: 9.89M, False: 760k] ------------------ 288| 9.89M| mat.v[ i * GFBITS + k ][ j ] = prod[ j ][ k ]; ------------------ | | 6| 9.89M|#define GFBITS 13 ------------------ 289| 9.89M| } 290| 760k| } 291| 108k| } 292| | 293| | // gaussian elimination to obtain L, U, and P such that LP M = U 294| | // L and U are stored in the space of M 295| | // P is stored in ind 296| | 297| 1.42M| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 1.42M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.42M|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.42M|#define GFBITS 13 | | ------------------ ------------------ | Branch (297:17): [True: 1.42M, False: 856] ------------------ 298| 1.42M| ind_inv[i] = ind[ i ] = i; 299| 1.42M| } 300| | 301| 1.42M| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 1.42M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.42M|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.42M|#define GFBITS 13 | | ------------------ ------------------ | Branch (301:19): [True: 1.42M, False: 102] ------------------ 302| 1.42M| i = row >> 6; 303| 1.42M| j = row & 63; 304| | 305| 1.18G| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 1.18G|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.18G|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.18G|#define GFBITS 13 | | ------------------ ------------------ | Branch (305:27): [True: 1.18G, False: 1.42M] ------------------ 306| 1.18G| extract_01_masks(&m, mat.w[ row ], mat.w[ k ], row); 307| 1.18G| uint16_cswap(&ind[row], &ind[k], m); 308| | 309| 1.18G| mm = vec256_set1_16b(m); 310| 9.47G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 200| 9.47G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 9.47G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 9.47G|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 9.47G|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (310:25): [True: 8.29G, False: 1.18G] ------------------ 311| 8.29G| vec256_cswap(&mat.v[ row ][ c ], &mat.v[ k ][ c ], mm); 312| 8.29G| } 313| 1.18G| } 314| | 315| 1.42M| if ( uint64_is_zero_declassify((mat.w[ row ][ i ] >> j) & 1) ) { // return if not systematic ------------------ | Branch (315:14): [True: 754, False: 1.42M] ------------------ 316| 754| return -1; 317| 754| } 318| | 319| 1.18G| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 1.18G|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.18G|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.18G|#define GFBITS 13 | | ------------------ ------------------ | Branch (319:27): [True: 1.18G, False: 1.42M] ------------------ 320| 1.18G| t = mat.w[ k ][ i ] & (one << j); 321| 1.18G| mm = extract_mask256(mat.w[k], row); 322| | 323| 9.47G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 200| 9.47G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 9.47G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 9.47G|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 9.47G|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (323:25): [True: 8.29G, False: 1.18G] ------------------ 324| 8.29G| mat.v[ k ][ c ] ^= mat.v[ row ][ c ] & mm; 325| 8.29G| } 326| | 327| 1.18G| mat.w[ k ][ i ] |= t; 328| 1.18G| } 329| 1.42M| } 330| | 331| | // apply M^-1 to the remaining columns 332| | 333| 102| composeinv(PK_NROWS, ind_inv, ind_inv, ind); ------------------ | | 13| 102|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 102|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 102|#define GFBITS 13 | | ------------------ ------------------ 334| | 335| 408| for (j = 6; j < 27; j += par_width) { ------------------ | | 30| 306|#define par_width 7 ------------------ | Branch (335:17): [True: 306, False: 102] ------------------ 336| 4.28k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 4.28k|#define GFBITS 13 ------------------ | Branch (336:21): [True: 3.97k, False: 306] ------------------ 337| 31.8k| for (b = 0; b < par_width; b++) { ------------------ | | 30| 31.8k|#define par_width 7 ------------------ | Branch (337:25): [True: 27.8k, False: 3.97k] ------------------ 338| 27.8k| par.v[ k ][ b ] = prod[ j + b ][ k ]; 339| 27.8k| } 340| 3.97k| } 341| | 342| 39.1k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 39.1k|#define SYS_T 128 ------------------ | Branch (342:21): [True: 38.8k, False: 306] ------------------ 343| 310k| for (b = 0; b < par_width; b++) { ------------------ | | 30| 310k|#define par_width 7 ------------------ | Branch (343:25): [True: 272k, False: 38.8k] ------------------ 344| 272k| vec256_mul(prod[ j + b ], prod[ j + b ], consts[ j + b ]); 345| 272k| } 346| | 347| 544k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 544k|#define GFBITS 13 ------------------ | Branch (347:25): [True: 505k, False: 38.8k] ------------------ 348| 4.04M| for (b = 0; b < par_width; b++) { ------------------ | | 30| 4.04M|#define par_width 7 ------------------ | Branch (348:29): [True: 3.53M, False: 505k] ------------------ 349| 3.53M| par.v[ i * GFBITS + k ][ b ] = prod[ j + b ][ k ]; ------------------ | | 6| 3.53M|#define GFBITS 13 ------------------ 350| 3.53M| } 351| 505k| } 352| 38.8k| } 353| | 354| | // apply P 355| | 356| 509k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 509k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 509k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 509k|#define GFBITS 13 | | ------------------ ------------------ | Branch (356:21): [True: 509k, False: 306] ------------------ 357| 509k| ind[i] = ind_inv[i]; 358| 509k| } 359| | 360| 306| sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 6| 306|#define GFBITS 13 ------------------ sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 13| 306|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 306|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 306|#define GFBITS 13 | | ------------------ ------------------ 361| | 362| | // apply L 363| | 364| 509k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 306|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 306|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 306|#define GFBITS 13 | | ------------------ ------------------ | Branch (364:34): [True: 509k, False: 306] ------------------ 365| 423M| for (i = row - 1; i >= 0; i--) { ------------------ | Branch (365:31): [True: 423M, False: 509k] ------------------ 366| 423M| mm = extract_mask256(mat.w[row], i); 367| | 368| 3.38G| for (k = 0; k < par_width; k++) { ------------------ | | 30| 3.38G|#define par_width 7 ------------------ | Branch (368:29): [True: 2.96G, False: 423M] ------------------ 369| 2.96G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 370| 2.96G| } 371| 423M| } 372| 509k| } 373| | 374| | // apply U^-1 375| | 376| 306| if (j == 6) { ------------------ | Branch (376:13): [True: 102, False: 204] ------------------ 377| 169k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 169k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 169k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 169k|#define GFBITS 13 | | ------------------ ------------------ | Branch (377:25): [True: 169k, False: 102] ------------------ 378| 169k| par.v[i][0] = mat.v[i][nBlocks_I - 1]; ------------------ | | 200| 169k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 169k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 169k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 169k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 379| 169k| } 380| 102| } 381| | 382| 509k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 306|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 306|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 306|#define GFBITS 13 | | ------------------ ------------------ | Branch (382:34): [True: 509k, False: 306] ------------------ 383| 423M| for (i = PK_NROWS - 1; i > row; i--) { ------------------ | | 13| 509k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 509k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 509k|#define GFBITS 13 | | ------------------ ------------------ | Branch (383:36): [True: 423M, False: 509k] ------------------ 384| 423M| mm = extract_mask256(mat.w[row], i); 385| | 386| 3.38G| for (k = 0; k < par_width; k++) { ------------------ | | 30| 3.38G|#define par_width 7 ------------------ | Branch (386:29): [True: 2.96G, False: 423M] ------------------ 387| 2.96G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 388| 2.96G| } 389| 423M| } 390| 509k| } 391| | 392| 306| if (j + par_width < 27) { ------------------ | | 30| 306|#define par_width 7 ------------------ | Branch (392:13): [True: 204, False: 102] ------------------ 393| 339k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 339k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 339k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 339k|#define GFBITS 13 | | ------------------ ------------------ | Branch (393:27): [True: 339k, False: 204] ------------------ 394| 339k| if (j == 6) { ------------------ | Branch (394:21): [True: 169k, False: 169k] ------------------ 395| 169k| k = 2; 396| 169k| } else { 397| 169k| k = 0; 398| 169k| } 399| 9.50M| for (; k < 28; k++) { ------------------ | Branch (399:24): [True: 9.16M, False: 339k] ------------------ 400| 9.16M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 16, par.w[row][k]); ------------------ | | 15| 9.16M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 9.16M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 9.16M|#define SYS_N 6688 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 9.16M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 9.16M|#define SYS_T 128 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 9.16M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 401| 9.16M| } 402| 339k| } 403| 204| } else { 404| 169k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 169k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 169k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 169k|#define GFBITS 13 | | ------------------ ------------------ | Branch (404:27): [True: 169k, False: 102] ------------------ 405| 4.24M| for (k = 0; k < 24; k++) { ------------------ | Branch (405:29): [True: 4.07M, False: 169k] ------------------ 406| 4.07M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 16, par.w[row][k]); ------------------ | | 15| 4.07M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 4.07M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 4.07M|#define SYS_N 6688 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 4.07M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 4.07M|#define SYS_T 128 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 4.07M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 407| 4.07M| } 408| | 409| 169k| store_i(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 16, par.w[row][k], 4); ------------------ | | 15| 169k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 169k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 169k|#define SYS_N 6688 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 169k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 169k|#define SYS_T 128 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 169k|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 410| 169k| } 411| 102| } 412| 306| } 413| | 414| | // 415| | 416| 102| return 0; 417| 856|} PQCLEAN_MCELIECE6688128_AVX2_genpoly_gen: 88| 894|int genpoly_gen(gf *out, gf *f) { 89| 894| int i, j, k; 90| | 91| 894| gf t, inv; 92| | 93| 894| uint64_t m; 94| 894| vec128 mask; 95| | 96| 894| union { 97| 894| uint64_t d[ GFBITS ][ 128 ][2]; 98| 894| vec128 v[ GFBITS ][ 128 ]; 99| 894| } buf; 100| | 101| 894| union { 102| 894| uint64_t d[GFBITS][2]; 103| 894| vec128 v[GFBITS]; 104| 894| } v; 105| | 106| 894| union { 107| 894| uint64_t d[SYS_T][GFBITS][2]; 108| 894| vec128 v[SYS_T][GFBITS]; 109| 894| } mat; 110| | 111| | // fill matrix 112| | 113| 894| buf.v[0][0] = vec128_set2x(1, 0); 114| 11.6k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 11.6k|#define GFBITS 13 ------------------ | Branch (114:17): [True: 10.7k, False: 894] ------------------ 115| 10.7k| buf.v[i][0] = vec128_setzero(); 116| 10.7k| } 117| | 118| 12.5k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 12.5k|#define GFBITS 13 ------------------ | Branch (118:17): [True: 11.6k, False: 894] ------------------ 119| 11.6k| v.v[j] = vec128_setzero(); 120| | 121| 1.49M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 11.6k|#define SYS_T 128 ------------------ | Branch (121:29): [True: 1.48M, False: 11.6k] ------------------ 122| 1.48M| v.d[j][1] <<= 1; 123| 1.48M| v.d[j][1] |= v.d[j][0] >> 63; 124| 1.48M| v.d[j][0] <<= 1; 125| 1.48M| v.d[j][0] |= (f[i] >> j) & 1; 126| 1.48M| } 127| 11.6k| } 128| | 129| 12.5k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 12.5k|#define GFBITS 13 ------------------ | Branch (129:17): [True: 11.6k, False: 894] ------------------ 130| 11.6k| buf.v[i][1] = v.v[i]; 131| 11.6k| } 132| | 133| 114k| for (k = 2; k <= SYS_T; k++) { ------------------ | | 8| 114k|#define SYS_T 128 ------------------ | Branch (133:17): [True: 113k, False: 894] ------------------ 134| 113k| vec128_mul_GF(v.v, v.v, f); ------------------ | | 11| 113k|#define vec128_mul_GF CRYPTO_NAMESPACE(vec128_mul_GF) | | ------------------ | | | | 4| 113k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 135| | 136| 113k| if (k < SYS_T) { ------------------ | | 8| 113k|#define SYS_T 128 ------------------ | Branch (136:13): [True: 112k, False: 894] ------------------ 137| 1.57M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.57M|#define GFBITS 13 ------------------ | Branch (137:25): [True: 1.46M, False: 112k] ------------------ 138| 1.46M| buf.v[i][k] = v.v[i]; 139| 1.46M| } 140| 112k| } else { 141| 115k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 115k|#define SYS_T 128 ------------------ | Branch (141:25): [True: 114k, False: 894] ------------------ 142| 114k| out[i] = extract_gf(v.d, i); 143| 114k| } 144| 894| } 145| 113k| } 146| | 147| 12.5k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 12.5k|#define GFBITS 13 ------------------ | Branch (147:17): [True: 11.6k, False: 894] ------------------ 148| 11.6k| transpose_128x128(buf.d[i]); 149| 11.6k| } 150| | 151| 115k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 115k|#define SYS_T 128 ------------------ | Branch (151:17): [True: 114k, False: 894] ------------------ 152| 1.60M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.60M|#define GFBITS 13 ------------------ | Branch (152:21): [True: 1.48M, False: 114k] ------------------ 153| 1.48M| mat.v[j][i] = buf.v[i][j]; 154| 1.48M| } 155| 114k| } 156| | 157| | // gaussian 158| | 159| 115k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 115k|#define SYS_T 128 ------------------ | Branch (159:17): [True: 114k, False: 894] ------------------ 160| 7.38M| for (j = i + 1; j < SYS_T; j++) { ------------------ | | 8| 7.38M|#define SYS_T 128 ------------------ | Branch (160:25): [True: 7.26M, False: 114k] ------------------ 161| 7.26M| m = extract_bit(mat.d[i], i); 162| 7.26M| m -= 1; 163| 7.26M| mask = vec128_set2x(m, m); 164| | 165| 101M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 101M|#define GFBITS 13 ------------------ | Branch (165:25): [True: 94.4M, False: 7.26M] ------------------ 166| 94.4M| mat.v[i][k] ^= mat.v[j][k] & mask; 167| 94.4M| } 168| | 169| 7.26M| out[i] ^= out[j] & m; 170| 7.26M| } 171| | 172| | // 173| | 174| 114k| t = extract_gf(mat.d[i], i); 175| | 176| 114k| if (gf_is_zero_declassify(t)) { ------------------ | Branch (176:13): [True: 0, False: 114k] ------------------ 177| 0| return -1; // return if not systematic 178| 0| } 179| | 180| | // 181| | 182| 114k| inv = gf_inv(t); ------------------ | | 11| 114k|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 114k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 183| 114k| vec128_mul_gf(mat.v[i], mat.v[i], inv); 184| | 185| 114k| out[i] = gf_mul(out[i], inv); ------------------ | | 14| 114k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 114k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 186| | 187| 14.7M| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 14.7M|#define SYS_T 128 ------------------ | Branch (187:21): [True: 14.6M, False: 114k] ------------------ 188| 14.6M| if (j != i) { ------------------ | Branch (188:17): [True: 14.5M, False: 114k] ------------------ 189| 14.5M| t = extract_gf(mat.d[j], i); 190| | 191| 14.5M| vec128_mul_gf(v.v, mat.v[i], t); 192| 14.5M| vec128_add(mat.v[j], mat.v[j], v.v); 193| | 194| 14.5M| out[j] ^= gf_mul(out[i], t); ------------------ | | 14| 14.5M|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 14.5M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 195| 14.5M| } 196| 14.6M| } 197| 114k| } 198| | 199| 894| return 0; 200| 894|} PQCLEAN_MCELIECE6688128_AVX2_vec128_mul_GF: 6| 113k|void vec128_mul_GF(vec128 out[ GFBITS ], vec128 v[ GFBITS ], gf a[ SYS_T ]) { 7| 113k| int i, j; 8| 113k| uint64_t buf[GFBITS][4]; 9| 113k| vec128 prod[GFBITS]; 10| 113k| uint64_t p[GFBITS]; 11| | 12| | // polynomial multiplication 13| | 14| 1.58M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.58M|#define GFBITS 13 ------------------ | Branch (14:17): [True: 1.47M, False: 113k] ------------------ 15| 1.47M| buf[i][0] = 0; 16| 1.47M| buf[i][1] = 0; 17| 1.47M| buf[i][2] = 0; 18| 1.47M| buf[i][3] = 0; 19| 1.47M| } 20| | 21| 14.6M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 113k|#define SYS_T 128 ------------------ | Branch (21:25): [True: 14.5M, False: 113k] ------------------ 22| 203M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 203M|#define GFBITS 13 ------------------ | Branch (22:21): [True: 188M, False: 14.5M] ------------------ 23| 188M| buf[j][3] <<= 1; 24| 188M| buf[j][3] |= buf[j][2] >> 63; 25| 188M| buf[j][2] <<= 1; 26| 188M| buf[j][2] |= buf[j][1] >> 63; 27| 188M| buf[j][1] <<= 1; 28| 188M| buf[j][1] |= buf[j][0] >> 63; 29| 188M| buf[j][0] <<= 1; 30| 188M| } 31| | 32| 14.5M| vec128_mul_gf(prod, v, a[i]); 33| | 34| 203M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 203M|#define GFBITS 13 ------------------ | Branch (34:21): [True: 188M, False: 14.5M] ------------------ 35| 188M| buf[j][0] ^= vec128_extract(prod[j], 0); ------------------ | | 29| 188M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 36| 188M| buf[j][1] ^= vec128_extract(prod[j], 1); ------------------ | | 29| 188M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 37| 188M| } 38| 14.5M| } 39| | 40| | // reduction modulo y^128+y^7+y^2+y+1 41| | 42| 1.58M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.58M|#define GFBITS 13 ------------------ | Branch (42:17): [True: 1.47M, False: 113k] ------------------ 43| 1.47M| p[i] = buf[i][3]; 44| | 45| 1.47M| buf[i][2] ^= p[i] >> (SYS_T - 7 - 64); ------------------ | | 8| 1.47M|#define SYS_T 128 ------------------ 46| 1.47M| buf[i][1] ^= p[i] << (64 - (SYS_T - 7 - 64)); ------------------ | | 8| 1.47M|#define SYS_T 128 ------------------ 47| 1.47M| buf[i][2] ^= p[i] >> (SYS_T - 2 - 64); ------------------ | | 8| 1.47M|#define SYS_T 128 ------------------ 48| 1.47M| buf[i][1] ^= p[i] << (64 - (SYS_T - 2 - 64)); ------------------ | | 8| 1.47M|#define SYS_T 128 ------------------ 49| 1.47M| buf[i][2] ^= p[i] >> (SYS_T - 1 - 64); ------------------ | | 8| 1.47M|#define SYS_T 128 ------------------ 50| 1.47M| buf[i][1] ^= p[i] << (64 - (SYS_T - 1 - 64)); ------------------ | | 8| 1.47M|#define SYS_T 128 ------------------ 51| 1.47M| buf[i][1] ^= p[i]; 52| 1.47M| } 53| | 54| | // 55| | 56| 1.58M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.58M|#define GFBITS 13 ------------------ | Branch (56:17): [True: 1.47M, False: 113k] ------------------ 57| 1.47M| p[i] = buf[i][2]; 58| | 59| 1.47M| buf[i][1] ^= p[i] >> (SYS_T - 7 - 64); ------------------ | | 8| 1.47M|#define SYS_T 128 ------------------ 60| 1.47M| buf[i][0] ^= p[i] << (64 - (SYS_T - 7 - 64)); ------------------ | | 8| 1.47M|#define SYS_T 128 ------------------ 61| 1.47M| buf[i][1] ^= p[i] >> (SYS_T - 2 - 64); ------------------ | | 8| 1.47M|#define SYS_T 128 ------------------ 62| 1.47M| buf[i][0] ^= p[i] << (64 - (SYS_T - 2 - 64)); ------------------ | | 8| 1.47M|#define SYS_T 128 ------------------ 63| 1.47M| buf[i][1] ^= p[i] >> (SYS_T - 1 - 64); ------------------ | | 8| 1.47M|#define SYS_T 128 ------------------ 64| 1.47M| buf[i][0] ^= p[i] << (64 - (SYS_T - 1 - 64)); ------------------ | | 8| 1.47M|#define SYS_T 128 ------------------ 65| 1.47M| buf[i][0] ^= p[i]; 66| 1.47M| } 67| | 68| | // 69| | 70| 1.58M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.58M|#define GFBITS 13 ------------------ | Branch (70:17): [True: 1.47M, False: 113k] ------------------ 71| 1.47M| out[i] = vec128_set2x(buf[i][0], buf[i][1]); 72| 1.47M| } 73| 113k|} PQCLEAN_MCELIECE6688128_AVX2_vec256_sq: 9| 15.2k|void vec256_sq(vec256 *out, vec256 *in) { 10| 15.2k| int i; 11| 15.2k| vec256 result[GFBITS], t; 12| | 13| 15.2k| t = vec256_xor(in[11], in[12]); 14| | 15| 15.2k| result[0] = vec256_xor(in[0], in[11]); 16| 15.2k| result[1] = vec256_xor(in[7], t); 17| 15.2k| result[2] = vec256_xor(in[1], in[7]); 18| 15.2k| result[3] = vec256_xor(in[8], t); 19| 15.2k| result[4] = vec256_xor(in[2], in[7]); 20| 15.2k| result[4] = vec256_xor(result[4], in[8]); 21| 15.2k| result[4] = vec256_xor(result[4], t); 22| 15.2k| result[5] = vec256_xor(in[7], in[9]); 23| 15.2k| result[6] = vec256_xor(in[3], in[8]); 24| 15.2k| result[6] = vec256_xor(result[6], in[9]); 25| 15.2k| result[6] = vec256_xor(result[6], in[12]); 26| 15.2k| result[7] = vec256_xor(in[8], in[10]); 27| 15.2k| result[8] = vec256_xor(in[4], in[9]); 28| 15.2k| result[8] = vec256_xor(result[8], in[10]); 29| 15.2k| result[9] = vec256_xor(in[9], in[11]); 30| 15.2k| result[10] = vec256_xor(in[5], in[10]); 31| 15.2k| result[10] = vec256_xor(result[10], in[11]); 32| 15.2k| result[11] = vec256_xor(in[10], in[12]); 33| 15.2k| result[12] = vec256_xor(in[6], t); 34| | 35| 213k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 213k|#define GFBITS 13 ------------------ | Branch (35:17): [True: 197k, False: 15.2k] ------------------ 36| 197k| out[i] = result[i]; 37| 197k| } 38| 15.2k|} PQCLEAN_MCELIECE6688128_AVX2_vec256_inv: 41| 996|void vec256_inv(vec256 *out, vec256 *in) { 42| 996| vec256 tmp_11[ GFBITS ]; 43| 996| vec256 tmp_1111[ GFBITS ]; 44| | 45| 996| vec256_copy(out, in); 46| | 47| 996| vec256_sq(out, out); ------------------ | | 14| 996|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 996|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 48| 996| vec256_mul(tmp_11, out, in); // ^11 49| | 50| 996| vec256_sq(out, tmp_11); ------------------ | | 14| 996|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 996|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 51| 996| vec256_sq(out, out); ------------------ | | 14| 996|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 996|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 52| 996| vec256_mul(tmp_1111, out, tmp_11); // ^1111 53| | 54| 996| vec256_sq(out, tmp_1111); ------------------ | | 14| 996|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 996|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 55| 996| vec256_sq(out, out); ------------------ | | 14| 996|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 996|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 56| 996| vec256_sq(out, out); ------------------ | | 14| 996|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 996|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 57| 996| vec256_sq(out, out); ------------------ | | 14| 996|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 996|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 58| 996| vec256_mul(out, out, tmp_1111); // ^11111111 59| | 60| 996| vec256_sq(out, out); ------------------ | | 14| 996|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 996|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 61| 996| vec256_sq(out, out); ------------------ | | 14| 996|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 996|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 62| 996| vec256_sq(out, out); ------------------ | | 14| 996|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 996|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 63| 996| vec256_sq(out, out); ------------------ | | 14| 996|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 996|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 64| 996| vec256_mul(out, out, tmp_1111); // ^111111111111 65| | 66| 996| vec256_sq(out, out); // ^1111111111110 ------------------ | | 14| 996|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 996|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128_AVX2_ ## fun | | ------------------ ------------------ 67| 996|} PQCLEAN_MCELIECE6688128F_AVX2_load_bits: 188| 90|void load_bits(vec128 bits_int[][32], const unsigned char *bits) { 189| 90| int i, j; 190| 90| const unsigned char *ptr = bits; 191| | 192| 90| vec128 buf[64]; 193| | 194| 360| for (i = 0; i <= 5; i += 2) { ------------------ | Branch (194:17): [True: 270, False: 90] ------------------ 195| 17.5k| for (j = 0; j < 64; j++) { ------------------ | Branch (195:21): [True: 17.2k, False: 270] ------------------ 196| 17.2k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 197| 17.2k| ptr += 8; 198| 17.2k| } 199| | 200| 270| transpose_64x128_sp( buf ); 201| | 202| 8.91k| for (j = 0; j < 32; j++) { ------------------ | Branch (202:21): [True: 8.64k, False: 270] ------------------ 203| 8.64k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 204| 8.64k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 205| 8.64k| } 206| | 207| 270| ptr += 512; 208| 270| } 209| | 210| 1.26k| for (i = 6; i <= 18; i++) { ------------------ | Branch (210:17): [True: 1.17k, False: 90] ------------------ 211| 38.6k| for (j = 0; j < 32; j++) { ------------------ | Branch (211:21): [True: 37.4k, False: 1.17k] ------------------ 212| 37.4k| bits_int[i][j] = load16(ptr); 213| 37.4k| ptr += 16; 214| 37.4k| } 215| 1.17k| } 216| | 217| 360| for (i = 19; i < 25; i += 2) { ------------------ | Branch (217:18): [True: 270, False: 90] ------------------ 218| 17.5k| for (j = 0; j < 64; j++) { ------------------ | Branch (218:21): [True: 17.2k, False: 270] ------------------ 219| 17.2k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 220| 17.2k| ptr += 8; 221| 17.2k| } 222| | 223| 270| transpose_64x128_sp( buf ); 224| | 225| 8.91k| for (j = 0; j < 32; j++) { ------------------ | Branch (225:21): [True: 8.64k, False: 270] ------------------ 226| 8.64k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 227| 8.64k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 228| 8.64k| } 229| | 230| 270| ptr += 512; 231| 270| } 232| 90|} PQCLEAN_MCELIECE6688128F_AVX2_benes: 238| 180|void benes(vec128 *r, vec128 b[][32], int rev) { 239| 180| int inc; 240| | 241| 180| vec128 *b_ptr; 242| | 243| 180| if (rev == 0) { ------------------ | Branch (243:9): [True: 90, False: 90] ------------------ 244| 90| inc = 32; 245| 90| b_ptr = b[ 0]; 246| 90| } else { 247| 90| inc = -32; 248| 90| b_ptr = b[24]; 249| 90| } 250| | 251| | // 252| | 253| 180| transpose_64x128_sp( r ); 254| | 255| 180| layer_0(r, b_ptr); 256| 180| b_ptr += inc; 257| 180| layer_1(r, b_ptr); 258| 180| b_ptr += inc; 259| 180| layer_2(r, b_ptr); 260| 180| b_ptr += inc; 261| 180| layer_3(r, b_ptr); 262| 180| b_ptr += inc; 263| 180| layer_4(r, b_ptr); 264| 180| b_ptr += inc; 265| 180| layer_5(r, b_ptr); 266| 180| b_ptr += inc; 267| | 268| 180| transpose_64x128_sp( r ); 269| | 270| 180| layer_x(r, b_ptr); 271| 180| b_ptr += inc; 272| 180| layer_0(r, b_ptr); 273| 180| b_ptr += inc; 274| 180| layer_1(r, b_ptr); 275| 180| b_ptr += inc; 276| 180| layer_2(r, b_ptr); 277| 180| b_ptr += inc; 278| 180| layer_3(r, b_ptr); 279| 180| b_ptr += inc; 280| 180| layer_4(r, b_ptr); 281| 180| b_ptr += inc; 282| 180| layer_5(r, b_ptr); 283| 180| b_ptr += inc; 284| 180| layer_4(r, b_ptr); 285| 180| b_ptr += inc; 286| 180| layer_3(r, b_ptr); 287| 180| b_ptr += inc; 288| 180| layer_2(r, b_ptr); 289| 180| b_ptr += inc; 290| 180| layer_1(r, b_ptr); 291| 180| b_ptr += inc; 292| 180| layer_0(r, b_ptr); 293| 180| b_ptr += inc; 294| 180| layer_x(r, b_ptr); 295| 180| b_ptr += inc; 296| | 297| 180| transpose_64x128_sp( r ); 298| | 299| 180| layer_5(r, b_ptr); 300| 180| b_ptr += inc; 301| 180| layer_4(r, b_ptr); 302| 180| b_ptr += inc; 303| 180| layer_3(r, b_ptr); 304| 180| b_ptr += inc; 305| 180| layer_2(r, b_ptr); 306| 180| b_ptr += inc; 307| 180| layer_1(r, b_ptr); 308| 180| b_ptr += inc; 309| 180| layer_0(r, b_ptr); 310| | 311| 180| transpose_64x128_sp( r ); 312| 180|} PQCLEAN_MCELIECE6688128F_AVX2_bm: 147| 90|void bm(vec128 *out, vec256 *in) { 148| 90| int i; 149| 90| uint16_t N, L; 150| 90| uint16_t mask; 151| 90| uint64_t one = 1, t; 152| | 153| 90| vec128 prod[ GFBITS ]; 154| 90| vec128 interval[GFBITS]; 155| | 156| 90| typedef union { 157| 90| vec128 v[GFBITS][2]; 158| 90| vec256 V[GFBITS]; 159| 90| } db_t; 160| | 161| 90| db_t db; 162| 90| db_t BC_tmp; 163| 90| db_t BC; 164| | 165| 90| gf d, b, c0 = 1; 166| 90| gf coefs[256]; 167| | 168| | // initialization 169| | 170| 90| get_coefs(coefs, in); 171| | 172| 90| BC.v[0][0] = vec128_set2x(0, one << 63); 173| 90| BC.v[0][1] = vec128_setzero(); 174| | 175| 1.17k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.17k|#define GFBITS 13 ------------------ | Branch (175:17): [True: 1.08k, False: 90] ------------------ 176| 1.08k| BC.v[i][0] = BC.v[i][1] = vec128_setzero(); 177| 1.08k| } 178| | 179| 90| b = 1; 180| 90| L = 0; 181| | 182| | // 183| | 184| 1.26k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.26k|#define GFBITS 13 ------------------ | Branch (184:17): [True: 1.17k, False: 90] ------------------ 185| 1.17k| interval[i] = vec128_setzero(); 186| 1.17k| } 187| | 188| 23.1k| for (N = 0; N < 256; N++) { ------------------ | Branch (188:17): [True: 23.0k, False: 90] ------------------ 189| 23.0k| vec128_mul_asm(prod, interval, BC.v[0] + 1, 32); ------------------ | | 10| 23.0k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 23.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 190| 23.0k| update_asm(interval, coefs[N], 16); ------------------ | | 1| 23.0k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 23.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 191| | 192| 23.0k| d = vec_reduce_asm(prod); ------------------ | | 3| 23.0k|#define vec_reduce_asm CRYPTO_NAMESPACE(vec_reduce_asm) | | ------------------ | | | | 4| 23.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 193| | 194| 23.0k| t = gf_mul2(c0, coefs[N], b); ------------------ | | 13| 23.0k|#define gf_mul2 CRYPTO_NAMESPACE(gf_mul2) | | ------------------ | | | | 4| 23.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 195| 23.0k| d ^= t & 0xFFFFFFFF; 196| | 197| 23.0k| mask = mask_nonzero(d) & mask_leq(L * 2, N); 198| | 199| 322k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 322k|#define GFBITS 13 ------------------ | Branch (199:21): [True: 299k, False: 23.0k] ------------------ 200| 299k| db.v[i][0] = vec128_setbits((d >> i) & 1); 201| 299k| db.v[i][1] = vec128_setbits((b >> i) & 1); 202| 299k| } 203| | 204| 23.0k| vec256_mul((vec256 *) BC_tmp.V, (vec256 *) db.V, (vec256 *) BC.V); 205| | 206| 23.0k| vec128_cmov(BC.v, mask); 207| 23.0k| update_asm(BC.v, c0 & mask, 32); ------------------ | | 1| 23.0k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 23.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| 322k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 322k|#define GFBITS 13 ------------------ | Branch (209:21): [True: 299k, False: 23.0k] ------------------ 210| 299k| BC.v[i][1] = vec128_xor(BC_tmp.v[i][0], BC_tmp.v[i][1]); 211| 299k| } 212| | 213| 23.0k| c0 = t >> 32; 214| 23.0k| b = (d & mask) | (b & ~mask); 215| 23.0k| L = ((N + 1 - L) & mask) | (L & ~mask); 216| 23.0k| } 217| | 218| 90| c0 = gf_inv(c0); ------------------ | | 11| 90|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 90|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 219| | 220| 1.26k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.26k|#define GFBITS 13 ------------------ | Branch (220:17): [True: 1.17k, False: 90] ------------------ 221| 1.17k| prod[i] = vec128_setbits((c0 >> i) & 1); 222| 1.17k| } 223| | 224| 90| vec128_mul_asm(out, prod, BC.v[0] + 1, 32); ------------------ | | 10| 90|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 90|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 225| 90|} PQCLEAN_MCELIECE6688128F_AVX2_controlbitsfrompermutation: 205| 90|void controlbitsfrompermutation(unsigned char *out, const int16 *pi, long long w, long long n) { 206| 90| PQCLEAN_VLA(int32, temp, (size_t)(2 * n)); ------------------ | | 57| 90|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 207| 90| PQCLEAN_VLA(int16, pi_test, (size_t)n); ------------------ | | 57| 90|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 208| 90| int16 diff; 209| 90| int i; 210| 90| unsigned char *ptr; 211| | 212| 90| OQS_MEM_cleanse(temp, (size_t)n * 2); 213| 90| OQS_MEM_cleanse(pi_test, (size_t)n); 214| | 215| 90| while (1) { ------------------ | Branch (215:12): [True: 90, Folded] ------------------ 216| 90| OQS_MEM_cleanse(out, (size_t)((((2 * w - 1)*n / 2) + 7) / 8)); 217| 90| cbrecursion(out, 0, 1, pi, w, n, temp); 218| | 219| | // check for correctness 220| | 221| 737k| for (i = 0; i < n; i++) { ------------------ | Branch (221:21): [True: 737k, False: 90] ------------------ 222| 737k| pi_test[i] = (int16)i; 223| 737k| } 224| | 225| 90| ptr = out; 226| 1.26k| for (i = 0; i < w; i++) { ------------------ | Branch (226:21): [True: 1.17k, False: 90] ------------------ 227| 1.17k| layer(pi_test, ptr, i, (int32)n); 228| 1.17k| ptr += n >> 4; 229| 1.17k| } 230| | 231| 1.17k| for (i = (int)(w - 2); i >= 0; i--) { ------------------ | Branch (231:32): [True: 1.08k, False: 90] ------------------ 232| 1.08k| layer(pi_test, ptr, i, (int32)n); 233| 1.08k| ptr += n >> 4; 234| 1.08k| } 235| | 236| 90| diff = 0; 237| 737k| for (i = 0; i < n; i++) { ------------------ | Branch (237:21): [True: 737k, False: 90] ------------------ 238| 737k| diff |= pi[i] ^ pi_test[i]; 239| 737k| } 240| | 241| 90| diff = crypto_int16_nonzero_mask(diff); ------------------ | | 12| 90|#define crypto_int16_nonzero_mask CRYPTO_NAMESPACE(crypto_int16_nonzero_mask) | | ------------------ | | | | 4| 90|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 242| 90| crypto_declassify(&diff, sizeof diff); 243| 90| if (diff == 0) { ------------------ | Branch (243:13): [True: 90, False: 0] ------------------ 244| 90| break; 245| 90| } 246| 90| } 247| 90|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_int16_negative_mask: 3| 180|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 4| 180| return crypto_int16_x >> 15; 5| 180|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_int16_nonzero_mask: 7| 90|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 8| 90| return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 90|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 90|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 90|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 90|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 9| 90|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_int32_negative_mask: 3| 57.5M|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 4| 57.5M| return crypto_int32_x >> 31; 5| 57.5M|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_int32_min: 37| 57.5M|crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x, crypto_int32 crypto_int32_y) { 38| 57.5M| crypto_int32 crypto_int32_xy = crypto_int32_y ^ crypto_int32_x; 39| 57.5M| crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x; 40| 57.5M| crypto_int32_z ^= crypto_int32_xy & (crypto_int32_z ^ crypto_int32_y); 41| 57.5M| crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); ------------------ | | 9| 57.5M|#define crypto_int32_negative_mask CRYPTO_NAMESPACE(crypto_int32_negative_mask) | | ------------------ | | | | 4| 57.5M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 42| 57.5M| crypto_int32_z &= crypto_int32_xy; 43| 57.5M| return crypto_int32_x ^ crypto_int32_z; 44| 57.5M|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint16_signed_negative_mask: 3| 128k|crypto_uint16_signed crypto_uint16_signed_negative_mask(crypto_uint16_signed crypto_uint16_signed_x) { 4| 128k| return crypto_uint16_signed_x >> 15; 5| 128k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint16_nonzero_mask: 7| 15.3k|crypto_uint16 crypto_uint16_nonzero_mask(crypto_uint16 crypto_uint16_x) { 8| 15.3k| return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 15.3k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 15.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 15.3k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 15.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 9| 15.3k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint16_zero_mask: 11| 15.3k|crypto_uint16 crypto_uint16_zero_mask(crypto_uint16 crypto_uint16_x) { 12| 15.3k| return ~crypto_uint16_nonzero_mask(crypto_uint16_x); ------------------ | | 13| 15.3k|#define crypto_uint16_nonzero_mask CRYPTO_NAMESPACE(crypto_uint16_nonzero_mask) | | ------------------ | | | | 4| 15.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 13| 15.3k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint16_smaller_mask: 24| 97.9k|crypto_uint16 crypto_uint16_smaller_mask(crypto_uint16 crypto_uint16_x, crypto_uint16 crypto_uint16_y) { 25| 97.9k| crypto_uint16 crypto_uint16_xy = crypto_uint16_x ^ crypto_uint16_y; 26| 97.9k| crypto_uint16 crypto_uint16_z = crypto_uint16_x - crypto_uint16_y; 27| 97.9k| crypto_uint16_z ^= crypto_uint16_xy & (crypto_uint16_z ^ crypto_uint16_x ^ (((crypto_uint16) 1) << 15)); 28| 97.9k| return crypto_uint16_signed_negative_mask(crypto_uint16_z); ------------------ | | 11| 97.9k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 97.9k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 29| 97.9k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint32_signed_negative_mask: 3| 158k|crypto_uint32_signed crypto_uint32_signed_negative_mask(crypto_uint32_signed crypto_uint32_signed_x) { 4| 158k| return crypto_uint32_signed_x >> 31; 5| 158k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint32_nonzero_mask: 7| 79.2k|crypto_uint32 crypto_uint32_nonzero_mask(crypto_uint32 crypto_uint32_x) { 8| 79.2k| return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 79.2k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 79.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 79.2k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 79.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 9| 79.2k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint32_unequal_mask: 15| 79.2k|crypto_uint32 crypto_uint32_unequal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 16| 79.2k| crypto_uint32 crypto_uint32_xy = crypto_uint32_x ^ crypto_uint32_y; 17| 79.2k| return crypto_uint32_nonzero_mask(crypto_uint32_xy); ------------------ | | 13| 79.2k|#define crypto_uint32_nonzero_mask CRYPTO_NAMESPACE(crypto_uint32_nonzero_mask) | | ------------------ | | | | 4| 79.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 18| 79.2k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint32_equal_mask: 20| 79.2k|crypto_uint32 crypto_uint32_equal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 21| 79.2k| return ~crypto_uint32_unequal_mask(crypto_uint32_x, crypto_uint32_y); ------------------ | | 17| 79.2k|#define crypto_uint32_unequal_mask CRYPTO_NAMESPACE(crypto_uint32_unequal_mask) | | ------------------ | | | | 4| 79.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 22| 79.2k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint64_signed_negative_mask: 3| 2.02M|crypto_uint64_signed crypto_uint64_signed_negative_mask(crypto_uint64_signed crypto_uint64_signed_x) { 4| 2.02M| return crypto_uint64_signed_x >> 63; 5| 2.02M|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint64_nonzero_mask: 7| 1.01M|crypto_uint64 crypto_uint64_nonzero_mask(crypto_uint64 crypto_uint64_x) { 8| 1.01M| return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 1.01M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 1.01M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 1.01M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 1.01M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 9| 1.01M|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint64_zero_mask: 11| 152k|crypto_uint64 crypto_uint64_zero_mask(crypto_uint64 crypto_uint64_x) { 12| 152k| return ~crypto_uint64_nonzero_mask(crypto_uint64_x); ------------------ | | 13| 152k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 152k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 13| 152k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint64_unequal_mask: 15| 859k|crypto_uint64 crypto_uint64_unequal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 16| 859k| crypto_uint64 crypto_uint64_xy = crypto_uint64_x ^ crypto_uint64_y; 17| 859k| return crypto_uint64_nonzero_mask(crypto_uint64_xy); ------------------ | | 13| 859k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 859k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 18| 859k|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_uint64_equal_mask: 20| 859k|crypto_uint64 crypto_uint64_equal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 21| 859k| return ~crypto_uint64_unequal_mask(crypto_uint64_x, crypto_uint64_y); ------------------ | | 17| 859k|#define crypto_uint64_unequal_mask CRYPTO_NAMESPACE(crypto_uint64_unequal_mask) | | ------------------ | | | | 4| 859k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 22| 859k|} PQCLEAN_MCELIECE6688128F_AVX2_decrypt: 171| 90|int decrypt(unsigned char *e, const unsigned char *sk, const unsigned char *s) { 172| 90| int i; 173| | 174| 90| uint16_t check_synd; 175| 90| uint16_t check_weight; 176| | 177| 90| vec256 inv[ 32 ][ GFBITS ]; 178| 90| vec256 scaled[ 32 ][ GFBITS ]; 179| 90| vec256 eval[32][ GFBITS ]; 180| | 181| 90| vec128 error128[ 64 ]; 182| 90| vec256 error256[ 32 ]; 183| | 184| 90| vec256 s_priv[ GFBITS ]; 185| 90| vec256 s_priv_cmp[ GFBITS ]; 186| 90| vec128 locator[ GFBITS ]; 187| | 188| 90| vec128 recv128[ 64 ]; 189| 90| vec256 recv256[ 32 ]; 190| 90| vec256 allone; 191| | 192| 90| vec128 bits_int[25][32]; 193| | 194| | // Berlekamp decoder 195| | 196| 90| preprocess(recv128, s); 197| | 198| 90| load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 10| 90|#define load_bits CRYPTO_NAMESPACE(load_bits) | | ------------------ | | | | 4| 90|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 11| 90|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 90|#define SYS_T 128 | | ------------------ ------------------ 199| 90| benes(recv128, bits_int, 1); ------------------ | | 9| 90|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 90|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 200| | 201| 90| reformat_128to256(recv256, recv128); 202| | 203| 90| scaling(scaled, inv, sk, recv256); 204| 90| fft_tr(s_priv, scaled); ------------------ | | 9| 90|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 90|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 205| 90| bm(locator, s_priv); ------------------ | | 10| 90|#define bm CRYPTO_NAMESPACE(bm) | | ------------------ | | | | 4| 90|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 90| fft(eval, locator); ------------------ | | 10| 90|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 90|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| | // reencryption and weight check 210| | 211| 90| allone = vec256_set1_16b(0xFFFF); 212| | 213| 2.97k| for (i = 0; i < 32; i++) { ------------------ | Branch (213:17): [True: 2.88k, False: 90] ------------------ 214| 2.88k| error256[i] = vec256_or_reduce(eval[i]); 215| 2.88k| error256[i] = vec256_xor(error256[i], allone); 216| 2.88k| } 217| | 218| 90| scaling_inv(scaled, inv, error256); 219| 90| fft_tr(s_priv_cmp, scaled); ------------------ | | 9| 90|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 90|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 220| | 221| 90| check_synd = synd_cmp(s_priv, s_priv_cmp); 222| | 223| | // 224| | 225| 90| reformat_256to128(error128, error256); 226| 90| benes(error128, bits_int, 0); ------------------ | | 9| 90|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 90|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 227| | 228| 90| postprocess(e, error128); 229| | 230| 90| check_weight = weight_check(e, error128); 231| | 232| 90| return 1 - (check_synd & check_weight); 233| 90|} PQCLEAN_MCELIECE6688128F_AVX2_encrypt: 116| 90|void encrypt(unsigned char *s, const unsigned char *pk, unsigned char *e) { 117| 90| gen_e(e); 118| | 119| 90| syndrome_asm(s, pk, e); ------------------ | | 1| 90|#define syndrome_asm CRYPTO_NAMESPACE(syndrome_asm) | | ------------------ | | | | 4| 90|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 120| 90|} PQCLEAN_MCELIECE6688128F_AVX2_fft: 277| 300|void fft(vec256 out[][GFBITS], vec128 *in) { 278| 300| radix_conversions(in); 279| 300| butterflies(out, in); 280| 300|} PQCLEAN_MCELIECE6688128F_AVX2_fft_tr: 380| 180|void fft_tr(vec256 *out, vec256 in[][ GFBITS ]) { 381| 180| butterflies_tr(out, in); 382| 180| radix_conversions_tr(out); 383| 180|} PQCLEAN_MCELIECE6688128F_AVX2_gf_mul: 12| 1.96M|gf gf_mul(gf in0, gf in1) { 13| 1.96M| int i; 14| | 15| 1.96M| uint64_t tmp; 16| 1.96M| uint64_t t0; 17| 1.96M| uint64_t t1; 18| 1.96M| uint64_t t; 19| | 20| 1.96M| t0 = in0; 21| 1.96M| t1 = in1; 22| | 23| 1.96M| tmp = t0 * (t1 & 1); 24| | 25| 25.5M| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 25.5M|#define GFBITS 13 ------------------ | Branch (25:17): [True: 23.5M, False: 1.96M] ------------------ 26| 23.5M| tmp ^= (t0 * (t1 & (1 << i))); 27| 23.5M| } 28| | 29| | // 30| | 31| 1.96M| t = tmp & 0x1FF0000; 32| 1.96M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 33| | 34| 1.96M| t = tmp & 0x000E000; 35| 1.96M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 36| | 37| 1.96M| return tmp & GFMASK; ------------------ | | 19| 1.96M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 1.96M|#define GFBITS 13 | | ------------------ ------------------ 38| 1.96M|} PQCLEAN_MCELIECE6688128F_AVX2_gf_mul2: 41| 23.0k|uint64_t gf_mul2(gf a, gf b0, gf b1) { 42| 23.0k| int i; 43| | 44| 23.0k| uint64_t tmp = 0; 45| 23.0k| uint64_t t0; 46| 23.0k| uint64_t t1; 47| 23.0k| uint64_t t; 48| 23.0k| uint64_t mask = 0x0000000100000001; 49| | 50| 23.0k| t0 = a; 51| 23.0k| t1 = b1; 52| 23.0k| t1 = (t1 << 32) | b0; 53| | 54| 322k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 322k|#define GFBITS 13 ------------------ | Branch (54:17): [True: 299k, False: 23.0k] ------------------ 55| 299k| tmp ^= t0 * (t1 & mask); 56| 299k| mask += mask; 57| 299k| } 58| | 59| | // 60| | 61| 23.0k| t = tmp & 0x01FF000001FF0000; 62| 23.0k| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 63| | 64| 23.0k| t = tmp & 0x0000E0000000E000; 65| 23.0k| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 66| | 67| 23.0k| return tmp & 0x00001FFF00001FFF; 68| 23.0k|} PQCLEAN_MCELIECE6688128F_AVX2_gf_frac: 178| 15.4k|gf gf_frac(gf den, gf num) { 179| 15.4k| gf tmp_11; 180| 15.4k| gf tmp_1111; 181| 15.4k| gf out; 182| | 183| 15.4k| tmp_11 = gf_sqmul(den, den); // 11 184| 15.4k| tmp_1111 = gf_sq2mul(tmp_11, tmp_11); // 1111 185| 15.4k| out = gf_sq2(tmp_1111); 186| 15.4k| out = gf_sq2mul(out, tmp_1111); // 11111111 187| 15.4k| out = gf_sq2(out); 188| 15.4k| out = gf_sq2mul(out, tmp_1111); // 111111111111 189| | 190| 15.4k| return gf_sqmul(out, num); // 1111111111110 191| 15.4k|} PQCLEAN_MCELIECE6688128F_AVX2_gf_inv: 194| 15.4k|gf gf_inv(gf den) { 195| 15.4k| return gf_frac(den, ((gf) 1)); ------------------ | | 10| 15.4k|#define gf_frac CRYPTO_NAMESPACE(gf_frac) | | ------------------ | | | | 4| 15.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 196| 15.4k|} pk_gen.c:PQCLEAN_MCELIECE6688128F_AVX2_int32_sort: 21| 90|static void int32_sort(int32_t *x, long long n) { 22| 90| long long top, p, q, r, i; 23| | 24| 90| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 90] ------------------ 25| 0| return; 26| 0| } 27| 90| top = 1; 28| 990| while (top < n - top) { ------------------ | Branch (28:12): [True: 900, False: 90] ------------------ 29| 900| top += top; 30| 900| } 31| | 32| 1.08k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 990, False: 90] ------------------ 33| 1.46M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.46M, False: 990] ------------------ 34| 1.46M| if (!(i & p)) { ------------------ | Branch (34:17): [True: 777k, False: 685k] ------------------ 35| 777k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 777k| do { \ | | 12| 777k| int32_t ab = (b) ^ (a); \ | | 13| 777k| int32_t c = (b) - (a); \ | | 14| 777k| c ^= ab & ((c) ^ (b)); \ | | 15| 777k| c >>= 31; \ | | 16| 777k| c &= ab; \ | | 17| 777k| (a) ^= c; \ | | 18| 777k| (b) ^= c; \ | | 19| 777k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 777k] | | ------------------ ------------------ 36| 777k| } 37| 1.46M| } 38| 990| i = 0; 39| 5.94k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 4.95k, False: 990] ------------------ 40| 1.31M| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.31M, False: 4.95k] ------------------ 41| 1.31M| if (!(i & p)) { ------------------ | Branch (41:21): [True: 685k, False: 627k] ------------------ 42| 685k| int32_t a = x[i + p]; 43| 4.02M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 3.33M, False: 685k] ------------------ 44| 3.33M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 3.33M| do { \ | | 12| 3.33M| int32_t ab = (b) ^ (a); \ | | 13| 3.33M| int32_t c = (b) - (a); \ | | 14| 3.33M| c ^= ab & ((c) ^ (b)); \ | | 15| 3.33M| c >>= 31; \ | | 16| 3.33M| c &= ab; \ | | 17| 3.33M| (a) ^= c; \ | | 18| 3.33M| (b) ^= c; \ | | 19| 3.33M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.33M] | | ------------------ ------------------ 45| 3.33M| } 46| 685k| x[i + p] = a; 47| 685k| } 48| 1.31M| } 49| 4.95k| } 50| 990| } 51| 90|} controlbits.c:PQCLEAN_MCELIECE6688128F_AVX2_int32_sort: 21| 2.95M|static void int32_sort(int32_t *x, long long n) { 22| 2.95M| long long top, p, q, r, i; 23| | 24| 2.95M| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 2.95M] ------------------ 25| 0| return; 26| 0| } 27| 2.95M| top = 1; 28| 10.3M| while (top < n - top) { ------------------ | Branch (28:12): [True: 7.38M, False: 2.95M] ------------------ 29| 7.38M| top += top; 30| 7.38M| } 31| | 32| 13.2M| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 10.3M, False: 2.95M] ------------------ 33| 1.42G| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.41G, False: 10.3M] ------------------ 34| 1.41G| if (!(i & p)) { ------------------ | Branch (34:17): [True: 789M, False: 622M] ------------------ 35| 789M| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 789M| do { \ | | 12| 789M| int32_t ab = (b) ^ (a); \ | | 13| 789M| int32_t c = (b) - (a); \ | | 14| 789M| c ^= ab & ((c) ^ (b)); \ | | 15| 789M| c >>= 31; \ | | 16| 789M| c &= ab; \ | | 17| 789M| (a) ^= c; \ | | 18| 789M| (b) ^= c; \ | | 19| 789M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 789M] | | ------------------ ------------------ 36| 789M| } 37| 1.41G| } 38| 10.3M| i = 0; 39| 28.0M| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 17.7M, False: 10.3M] ------------------ 40| 1.26G| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.24G, False: 17.7M] ------------------ 41| 1.24G| if (!(i & p)) { ------------------ | Branch (41:21): [True: 622M, False: 622M] ------------------ 42| 622M| int32_t a = x[i + p]; 43| 3.68G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 3.06G, False: 622M] ------------------ 44| 3.06G| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 3.06G| do { \ | | 12| 3.06G| int32_t ab = (b) ^ (a); \ | | 13| 3.06G| int32_t c = (b) - (a); \ | | 14| 3.06G| c ^= ab & ((c) ^ (b)); \ | | 15| 3.06G| c >>= 31; \ | | 16| 3.06G| c &= ab; \ | | 17| 3.06G| (a) ^= c; \ | | 18| 3.06G| (b) ^= c; \ | | 19| 3.06G| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.06G] | | ------------------ ------------------ 45| 3.06G| } 46| 622M| x[i + p] = a; 47| 622M| } 48| 1.24G| } 49| 17.7M| } 50| 10.3M| } 51| 2.95M|} encrypt.c:PQCLEAN_MCELIECE6688128F_AVX2_int32_sort: 21| 624|static void int32_sort(int32_t *x, long long n) { 22| 624| long long top, p, q, r, i; 23| | 24| 624| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 624] ------------------ 25| 0| return; 26| 0| } 27| 624| top = 1; 28| 4.36k| while (top < n - top) { ------------------ | Branch (28:12): [True: 3.74k, False: 624] ------------------ 29| 3.74k| top += top; 30| 3.74k| } 31| | 32| 4.99k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 4.36k, False: 624] ------------------ 33| 484k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 479k, False: 4.36k] ------------------ 34| 479k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 279k, False: 200k] ------------------ 35| 279k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 279k| do { \ | | 12| 279k| int32_t ab = (b) ^ (a); \ | | 13| 279k| int32_t c = (b) - (a); \ | | 14| 279k| c ^= ab & ((c) ^ (b)); \ | | 15| 279k| c >>= 31; \ | | 16| 279k| c &= ab; \ | | 17| 279k| (a) ^= c; \ | | 18| 279k| (b) ^= c; \ | | 19| 279k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 279k] | | ------------------ ------------------ 36| 279k| } 37| 479k| } 38| 4.36k| i = 0; 39| 17.4k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 13.1k, False: 4.36k] ------------------ 40| 413k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 400k, False: 13.1k] ------------------ 41| 400k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 200k, False: 200k] ------------------ 42| 200k| int32_t a = x[i + p]; 43| 838k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 638k, False: 200k] ------------------ 44| 638k| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 638k| do { \ | | 12| 638k| int32_t ab = (b) ^ (a); \ | | 13| 638k| int32_t c = (b) - (a); \ | | 14| 638k| c ^= ab & ((c) ^ (b)); \ | | 15| 638k| c >>= 31; \ | | 16| 638k| c &= ab; \ | | 17| 638k| (a) ^= c; \ | | 18| 638k| (b) ^= c; \ | | 19| 638k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 638k] | | ------------------ ------------------ 45| 638k| } 46| 200k| x[i + p] = a; 47| 200k| } 48| 400k| } 49| 13.1k| } 50| 4.36k| } 51| 624|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_kem_enc: 22| 90|) { 23| 90| unsigned char e[ SYS_N / 8 ]; 24| 90| unsigned char one_ec[ 1 + SYS_N / 8 + SYND_BYTES ] = {1}; 25| | 26| | // 27| | 28| 90| encrypt(c, pk, e); ------------------ | | 9| 90|#define encrypt CRYPTO_NAMESPACE(encrypt) | | ------------------ | | | | 4| 90|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 29| | 30| 90| memcpy(one_ec + 1, e, SYS_N / 8); ------------------ | | 7| 90|#define SYS_N 6688 ------------------ 31| 90| memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 7| 90|#define SYS_N 6688 ------------------ memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 17| 90|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 90|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 90|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 90|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 32| | 33| 90| crypto_hash_32b(key, one_ec, sizeof(one_ec)); ------------------ | | 7| 90| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 90|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 34| | 35| 90| return 0; 36| 90|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_kem_dec: 42| 90|) { 43| 90| int i; 44| | 45| 90| unsigned char ret_decrypt = 0; 46| | 47| 90| uint16_t m; 48| | 49| 90| unsigned char e[ SYS_N / 8 ]; 50| 90| unsigned char preimage[ 1 + SYS_N / 8 + SYND_BYTES ]; 51| 90| unsigned char *x = preimage; 52| 90| const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 11| 90|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 90|#define SYS_T 128 | | ------------------ ------------------ const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 10| 90|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 90|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 90|#define GFBITS 13 | | ------------------ ------------------ 53| | 54| | // 55| | 56| 90| ret_decrypt = (unsigned char)decrypt(e, sk + 40, c); ------------------ | | 9| 90|#define decrypt CRYPTO_NAMESPACE(decrypt) | | ------------------ | | | | 4| 90|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 57| | 58| 90| m = ret_decrypt; 59| 90| m -= 1; 60| 90| m >>= 8; 61| | 62| 90| *x++ = m & 1; 63| 75.3k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 75.3k|#define SYS_N 6688 ------------------ | Branch (63:17): [True: 75.2k, False: 90] ------------------ 64| 75.2k| *x++ = (~m & s[i]) | (m & e[i]); 65| 75.2k| } 66| | 67| 18.8k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 18.8k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 18.8k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 18.8k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 18.8k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (67:17): [True: 18.7k, False: 90] ------------------ 68| 18.7k| *x++ = c[i]; 69| 18.7k| } 70| | 71| 90| crypto_hash_32b(key, preimage, sizeof(preimage)); ------------------ | | 7| 90| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 90|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 72| | 73| 90| return 0; 74| 90|} PQCLEAN_MCELIECE6688128F_AVX2_crypto_kem_keypair: 80| 90|) { 81| 90| int i; 82| 90| unsigned char seed[ 33 ] = {64}; 83| 90| unsigned char r[ SYS_N / 8 + (1 << GFBITS)*sizeof(uint32_t) + SYS_T * 2 + 32 ]; 84| 90| unsigned char *rp, *skp; 85| 90| uint64_t pivots; 86| | 87| 90| gf f[ SYS_T ]; // element in GF(2^mt) 88| 90| gf irr[ SYS_T ]; // Goppa polynomial 89| 90| uint32_t perm[ 1 << GFBITS ]; // random permutation as 32-bit integers 90| 90| int16_t pi[ 1 << GFBITS ]; // random permutation 91| | 92| 90| randombytes(seed + 1, 32); ------------------ | | 8| 90|#define randombytes OQS_randombytes ------------------ 93| | 94| 120| while (1) { ------------------ | Branch (94:12): [True: 120, Folded] ------------------ 95| 120| rp = &r[ sizeof(r) - 32 ]; 96| 120| skp = sk; 97| | 98| | // expanding and updating the seed 99| | 100| 120| shake(r, sizeof(r), seed, 33); ------------------ | | 10| 120| shake256(out, outlen, in, inlen) | | ------------------ | | | | 12| 120|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 101| 120| memcpy(skp, seed + 1, 32); 102| 120| skp += 32 + 8; 103| 120| memcpy(seed + 1, &r[ sizeof(r) - 32 ], 32); 104| | 105| | // generating irreducible polynomial 106| | 107| 120| rp -= sizeof(f); 108| | 109| 15.4k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 15.4k|#define SYS_T 128 ------------------ | Branch (109:21): [True: 15.3k, False: 120] ------------------ 110| 15.3k| f[i] = load_gf(rp + i * 2); 111| 15.3k| } 112| | 113| 120| if (genpoly_gen(irr, f)) { ------------------ | | 9| 120|#define genpoly_gen CRYPTO_NAMESPACE(genpoly_gen) | | ------------------ | | | | 4| 120|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ | Branch (113:13): [True: 0, False: 120] ------------------ 114| 0| continue; 115| 0| } 116| | 117| 15.4k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 15.4k|#define SYS_T 128 ------------------ | Branch (117:21): [True: 15.3k, False: 120] ------------------ 118| 15.3k| store_gf(skp + i * 2, irr[i]); 119| 15.3k| } 120| | 121| 120| skp += IRR_BYTES; ------------------ | | 11| 120|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 120|#define SYS_T 128 | | ------------------ ------------------ 122| | 123| | // generating permutation 124| | 125| 120| rp -= sizeof(perm); 126| | 127| 983k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 983k|#define GFBITS 13 ------------------ | Branch (127:21): [True: 983k, False: 120] ------------------ 128| 983k| perm[i] = load4(rp + i * 4); 129| 983k| } 130| | 131| 120| if (pk_gen(pk, skp - IRR_BYTES, perm, pi, &pivots)) { ------------------ | | 9| 120|#define pk_gen CRYPTO_NAMESPACE(pk_gen) | | ------------------ | | | | 4| 120|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ if (pk_gen(pk, skp - IRR_BYTES, perm, pi, &pivots)) { ------------------ | | 11| 120|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 120|#define SYS_T 128 | | ------------------ ------------------ | Branch (131:13): [True: 30, False: 90] ------------------ 132| 30| continue; 133| 30| } 134| | 135| 90| controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 10| 90|#define controlbitsfrompermutation CRYPTO_NAMESPACE(controlbitsfrompermutation) | | ------------------ | | | | 4| 90|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 90|#define GFBITS 13 ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 90|#define GFBITS 13 ------------------ 136| 90| skp += COND_BYTES; ------------------ | | 10| 90|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 90|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 90|#define GFBITS 13 | | ------------------ ------------------ 137| | 138| | // storing the random string s 139| | 140| 90| rp -= SYS_N / 8; ------------------ | | 7| 90|#define SYS_N 6688 ------------------ 141| 90| memcpy(skp, rp, SYS_N / 8); ------------------ | | 7| 90|#define SYS_N 6688 ------------------ 142| | 143| | // storing positions of the 32 pivots 144| | 145| 90| store8(sk + 32, pivots); 146| | 147| 90| break; 148| 120| } 149| | 150| 90| return 0; 151| 90|} PQCLEAN_MCELIECE6688128F_AVX2_pk_gen: 315| 120|int pk_gen(unsigned char *pk, const unsigned char *irr, const uint32_t *perm, int16_t *pi, uint64_t *pivots) { 316| 120| int i, j, k, b; 317| 120| int row, c; 318| | 319| 120| union { 320| 120| uint64_t w[ PK_NROWS ][ nBlocks_I * 4 ]; 321| 120| vec256 v[ PK_NROWS ][ nBlocks_I ]; 322| 120| } mat; 323| | 324| 120| union { 325| 120| uint64_t w[ PK_NROWS ][ 28 ]; 326| 120| vec256 v[ PK_NROWS ][ 7 ]; 327| 120| } par; 328| | 329| 120| uint16_t m; 330| 120| vec256 mm; 331| | 332| 120| vec128 sk_int[ GFBITS ]; 333| | 334| 120| vec256 consts[ 32 ][ GFBITS ]; 335| 120| vec256 eval[ 32 ][ GFBITS ]; 336| 120| vec256 prod[ 32 ][ GFBITS ]; 337| 120| vec256 tmp[ GFBITS ]; 338| | 339| 120| uint64_t list[1 << GFBITS]; 340| 120| uint64_t one = 1; 341| 120| uint64_t t; 342| | 343| 120| uint16_t ind[ PK_NROWS ]; 344| 120| uint16_t ind_inv[ PK_NROWS ]; 345| | 346| | // compute the inverses 347| | 348| 120| irr_load(sk_int, irr); 349| | 350| 120| fft(eval, sk_int); ------------------ | | 10| 120|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 120|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 351| | 352| 120| vec256_copy(prod[0], eval[0]); 353| | 354| 3.84k| for (i = 1; i < 32; i++) { ------------------ | Branch (354:17): [True: 3.72k, False: 120] ------------------ 355| 3.72k| vec256_mul(prod[i], prod[i - 1], eval[i]); 356| 3.72k| } 357| | 358| 120| vec256_inv(tmp, prod[31]); ------------------ | | 11| 120|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 120|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 359| | 360| 3.84k| for (i = 30; i >= 0; i--) { ------------------ | Branch (360:18): [True: 3.72k, False: 120] ------------------ 361| 3.72k| vec256_mul(prod[i + 1], prod[i], tmp); 362| 3.72k| vec256_mul(tmp, tmp, eval[i + 1]); 363| 3.72k| } 364| | 365| 120| vec256_copy(prod[0], tmp); 366| | 367| | // fill matrix 368| | 369| 120| de_bitslicing(list, prod); 370| | 371| 983k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 983k|#define GFBITS 13 ------------------ | Branch (371:17): [True: 983k, False: 120] ------------------ 372| 983k| list[i] <<= GFBITS; ------------------ | | 6| 983k|#define GFBITS 13 ------------------ 373| 983k| list[i] |= i; 374| 983k| list[i] |= ((uint64_t) perm[i]) << 31; 375| 983k| } 376| | 377| 120| uint64_sort(list, 1 << GFBITS); ------------------ | | 6| 120|#define GFBITS 13 ------------------ 378| | 379| 859k| for (i = 1; i < (1 << GFBITS); i++) { ------------------ | | 6| 859k|#define GFBITS 13 ------------------ | Branch (379:17): [True: 859k, False: 90] ------------------ 380| 859k| if (uint64_is_equal_declassify(list[i - 1] >> 31, list[i] >> 31)) { ------------------ | Branch (380:13): [True: 30, False: 859k] ------------------ 381| 30| return -1; 382| 30| } 383| 859k| } 384| | 385| 90| to_bitslicing_2x(consts, prod, list); 386| | 387| 737k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 737k|#define GFBITS 13 ------------------ | Branch (387:17): [True: 737k, False: 90] ------------------ 388| 737k| pi[i] = list[i] & GFMASK; ------------------ | | 19| 737k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 737k|#define GFBITS 13 | | ------------------ ------------------ 389| 737k| } 390| | 391| 720| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 32| 720|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 720|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 720|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 720|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (391:17): [True: 630, False: 90] ------------------ 392| 8.82k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 8.82k|#define GFBITS 13 ------------------ | Branch (392:21): [True: 8.19k, False: 630] ------------------ 393| 8.19k| mat.v[ k ][ j ] = prod[ j ][ k ]; 394| 8.19k| } 395| 630| } 396| | 397| 11.5k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 11.5k|#define SYS_T 128 ------------------ | Branch (397:17): [True: 11.4k, False: 90] ------------------ 398| 91.4k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 32| 91.4k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 91.4k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 91.4k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 91.4k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (398:21): [True: 80.0k, False: 11.4k] ------------------ 399| 80.0k| vec256_mul(prod[j], prod[j], consts[j]); 400| | 401| 1.12M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 1.12M|#define GFBITS 13 ------------------ | Branch (401:25): [True: 1.04M, False: 80.0k] ------------------ 402| 1.04M| mat.v[ i * GFBITS + k ][ j ] = prod[ j ][ k ]; ------------------ | | 6| 1.04M|#define GFBITS 13 ------------------ 403| 1.04M| } 404| 80.0k| } 405| 11.4k| } 406| | 407| | // gaussian elimination to obtain L, U, and P such that LP M = U 408| | // L and U are stored in the space of M 409| | // P is stored in ind 410| | 411| 149k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 149k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 149k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 149k|#define GFBITS 13 | | ------------------ ------------------ | Branch (411:17): [True: 149k, False: 90] ------------------ 412| 149k| ind_inv[i] = ind[ i ] = i; 413| 149k| } 414| | 415| 149k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 149k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 149k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 149k|#define GFBITS 13 | | ------------------ ------------------ | Branch (415:19): [True: 149k, False: 90] ------------------ 416| 149k| i = row >> 6; 417| 149k| j = row & 63; 418| | 419| 149k| if (row == PK_NROWS - 32) { ------------------ | | 13| 149k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 149k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 149k|#define GFBITS 13 | | ------------------ ------------------ | Branch (419:13): [True: 90, False: 149k] ------------------ 420| 90| if (mov_columns(mat.w, pi, pivots)) { ------------------ | Branch (420:17): [True: 0, False: 90] ------------------ 421| 0| return -1; 422| 0| } 423| 90| } 424| | 425| 124M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 124M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 124M|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 124M|#define GFBITS 13 | | ------------------ ------------------ | Branch (425:27): [True: 124M, False: 149k] ------------------ 426| 124M| extract_01_masks(&m, mat.w[ row ], mat.w[ k ], row); 427| 124M| uint16_cswap(&ind[row], &ind[k], m); 428| | 429| 124M| mm = vec256_set1_16b(m); 430| 996M| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 32| 996M|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 996M|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 996M|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 996M|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (430:25): [True: 871M, False: 124M] ------------------ 431| 871M| vec256_cswap(&mat.v[ row ][ c ], &mat.v[ k ][ c ], mm); 432| 871M| } 433| 124M| } 434| | 435| 149k| if ( uint64_is_zero_declassify((mat.w[ row ][ i ] >> j) & 1) ) { // return if not systematic ------------------ | Branch (435:14): [True: 0, False: 149k] ------------------ 436| 0| return -1; 437| 0| } 438| | 439| 124M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 124M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 124M|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 124M|#define GFBITS 13 | | ------------------ ------------------ | Branch (439:27): [True: 124M, False: 149k] ------------------ 440| 124M| t = mat.w[ k ][ i ] & (one << j); 441| 124M| mm = extract_mask256(mat.w[k], row); 442| | 443| 996M| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 32| 996M|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 996M|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 996M|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 996M|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (443:25): [True: 871M, False: 124M] ------------------ 444| 871M| mat.v[ k ][ c ] ^= mat.v[ row ][ c ] & mm; 445| 871M| } 446| | 447| 124M| mat.w[ k ][ i ] |= t; 448| 124M| } 449| 149k| } 450| | 451| | // apply M^-1 to the remaining columns 452| | 453| 90| composeinv(PK_NROWS, ind_inv, ind_inv, ind); ------------------ | | 13| 90|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 90|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 90|#define GFBITS 13 | | ------------------ ------------------ 454| | 455| 360| for (j = 6; j < 27; j += par_width) { ------------------ | | 33| 270|#define par_width 7 ------------------ | Branch (455:17): [True: 270, False: 90] ------------------ 456| 3.78k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 3.78k|#define GFBITS 13 ------------------ | Branch (456:21): [True: 3.51k, False: 270] ------------------ 457| 28.0k| for (b = 0; b < par_width; b++) { ------------------ | | 33| 28.0k|#define par_width 7 ------------------ | Branch (457:25): [True: 24.5k, False: 3.51k] ------------------ 458| 24.5k| par.v[ k ][ b ] = prod[ j + b ][ k ]; 459| 24.5k| } 460| 3.51k| } 461| | 462| 34.5k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 34.5k|#define SYS_T 128 ------------------ | Branch (462:21): [True: 34.2k, False: 270] ------------------ 463| 274k| for (b = 0; b < par_width; b++) { ------------------ | | 33| 274k|#define par_width 7 ------------------ | Branch (463:25): [True: 240k, False: 34.2k] ------------------ 464| 240k| vec256_mul(prod[ j + b ], prod[ j + b ], consts[ j + b ]); 465| 240k| } 466| | 467| 480k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 480k|#define GFBITS 13 ------------------ | Branch (467:25): [True: 445k, False: 34.2k] ------------------ 468| 3.56M| for (b = 0; b < par_width; b++) { ------------------ | | 33| 3.56M|#define par_width 7 ------------------ | Branch (468:29): [True: 3.12M, False: 445k] ------------------ 469| 3.12M| par.v[ i * GFBITS + k ][ b ] = prod[ j + b ][ k ]; ------------------ | | 6| 3.12M|#define GFBITS 13 ------------------ 470| 3.12M| } 471| 445k| } 472| 34.2k| } 473| | 474| | // apply P 475| | 476| 449k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 449k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 449k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 449k|#define GFBITS 13 | | ------------------ ------------------ | Branch (476:21): [True: 449k, False: 270] ------------------ 477| 449k| ind[i] = ind_inv[i]; 478| 449k| } 479| | 480| 270| sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 6| 270|#define GFBITS 13 ------------------ sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 13| 270|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 270|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 270|#define GFBITS 13 | | ------------------ ------------------ 481| | 482| | // apply L 483| | 484| 449k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 270|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 270|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 270|#define GFBITS 13 | | ------------------ ------------------ | Branch (484:34): [True: 449k, False: 270] ------------------ 485| 374M| for (i = row - 1; i >= 0; i--) { ------------------ | Branch (485:31): [True: 373M, False: 449k] ------------------ 486| 373M| mm = extract_mask256(mat.w[row], i); 487| | 488| 2.98G| for (k = 0; k < par_width; k++) { ------------------ | | 33| 2.98G|#define par_width 7 ------------------ | Branch (488:29): [True: 2.61G, False: 373M] ------------------ 489| 2.61G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 490| 2.61G| } 491| 373M| } 492| 449k| } 493| | 494| | // apply U^-1 495| | 496| 270| if (j == 6) { ------------------ | Branch (496:13): [True: 90, False: 180] ------------------ 497| 149k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 149k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 149k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 149k|#define GFBITS 13 | | ------------------ ------------------ | Branch (497:25): [True: 149k, False: 90] ------------------ 498| 149k| par.v[i][0] = mat.v[i][ nBlocks_I - 1 ]; ------------------ | | 32| 149k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 149k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 149k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 149k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 499| 149k| } 500| 90| } 501| | 502| 449k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 270|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 270|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 270|#define GFBITS 13 | | ------------------ ------------------ | Branch (502:34): [True: 449k, False: 270] ------------------ 503| 374M| for (i = PK_NROWS - 1; i > row; i--) { ------------------ | | 13| 449k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 449k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 449k|#define GFBITS 13 | | ------------------ ------------------ | Branch (503:36): [True: 373M, False: 449k] ------------------ 504| 373M| mm = extract_mask256(mat.w[row], i); 505| | 506| 2.98G| for (k = 0; k < par_width; k++) { ------------------ | | 33| 2.98G|#define par_width 7 ------------------ | Branch (506:29): [True: 2.61G, False: 373M] ------------------ 507| 2.61G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 508| 2.61G| } 509| 373M| } 510| 449k| } 511| | 512| | // 513| | 514| 270| if (j + par_width < 27) { ------------------ | | 33| 270|#define par_width 7 ------------------ | Branch (514:13): [True: 180, False: 90] ------------------ 515| 299k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 299k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 299k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 299k|#define GFBITS 13 | | ------------------ ------------------ | Branch (515:27): [True: 299k, False: 180] ------------------ 516| 299k| if (j == 6) { ------------------ | Branch (516:21): [True: 149k, False: 149k] ------------------ 517| 149k| k = 2; 518| 149k| } else { 519| 149k| k = 0; 520| 149k| } 521| 8.38M| for (; k < 28; k++) { ------------------ | Branch (521:24): [True: 8.08M, False: 299k] ------------------ 522| 8.08M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 16, par.w[row][k]); ------------------ | | 15| 8.08M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 8.08M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 8.08M|#define SYS_N 6688 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 8.08M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 8.08M|#define SYS_T 128 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 8.08M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 523| 8.08M| } 524| 299k| } 525| 180| } else { 526| 149k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 149k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 149k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 149k|#define GFBITS 13 | | ------------------ ------------------ | Branch (526:27): [True: 149k, False: 90] ------------------ 527| 3.74M| for (k = 0; k < 24; k++) { ------------------ | Branch (527:29): [True: 3.59M, False: 149k] ------------------ 528| 3.59M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 16, par.w[row][k]); ------------------ | | 15| 3.59M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 3.59M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 3.59M|#define SYS_N 6688 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 3.59M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 3.59M|#define SYS_T 128 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 3.59M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 529| 3.59M| } 530| | 531| 149k| store_i(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 16, par.w[row][k], 4); ------------------ | | 15| 149k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 149k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 149k|#define SYS_N 6688 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 149k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 149k|#define SYS_T 128 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 149k|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 532| 149k| } 533| 90| } 534| 270| } 535| | 536| | // 537| | 538| 90| return 0; 539| 90|} PQCLEAN_MCELIECE6688128F_AVX2_genpoly_gen: 88| 120|int genpoly_gen(gf *out, gf *f) { 89| 120| int i, j, k; 90| | 91| 120| gf t, inv; 92| | 93| 120| uint64_t m; 94| 120| vec128 mask; 95| | 96| 120| union { 97| 120| uint64_t d[ GFBITS ][ 128 ][2]; 98| 120| vec128 v[ GFBITS ][ 128 ]; 99| 120| } buf; 100| | 101| 120| union { 102| 120| uint64_t d[GFBITS][2]; 103| 120| vec128 v[GFBITS]; 104| 120| } v; 105| | 106| 120| union { 107| 120| uint64_t d[SYS_T][GFBITS][2]; 108| 120| vec128 v[SYS_T][GFBITS]; 109| 120| } mat; 110| | 111| | // fill matrix 112| | 113| 120| buf.v[0][0] = vec128_set2x(1, 0); 114| 1.56k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.56k|#define GFBITS 13 ------------------ | Branch (114:17): [True: 1.44k, False: 120] ------------------ 115| 1.44k| buf.v[i][0] = vec128_setzero(); 116| 1.44k| } 117| | 118| 1.68k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 1.68k|#define GFBITS 13 ------------------ | Branch (118:17): [True: 1.56k, False: 120] ------------------ 119| 1.56k| v.v[j] = vec128_setzero(); 120| | 121| 201k| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 1.56k|#define SYS_T 128 ------------------ | Branch (121:29): [True: 199k, False: 1.56k] ------------------ 122| 199k| v.d[j][1] <<= 1; 123| 199k| v.d[j][1] |= v.d[j][0] >> 63; 124| 199k| v.d[j][0] <<= 1; 125| 199k| v.d[j][0] |= (f[i] >> j) & 1; 126| 199k| } 127| 1.56k| } 128| | 129| 1.68k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.68k|#define GFBITS 13 ------------------ | Branch (129:17): [True: 1.56k, False: 120] ------------------ 130| 1.56k| buf.v[i][1] = v.v[i]; 131| 1.56k| } 132| | 133| 15.3k| for (k = 2; k <= SYS_T; k++) { ------------------ | | 8| 15.3k|#define SYS_T 128 ------------------ | Branch (133:17): [True: 15.2k, False: 120] ------------------ 134| 15.2k| vec128_mul_GF(v.v, v.v, f); ------------------ | | 11| 15.2k|#define vec128_mul_GF CRYPTO_NAMESPACE(vec128_mul_GF) | | ------------------ | | | | 4| 15.2k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 135| | 136| 15.2k| if (k < SYS_T) { ------------------ | | 8| 15.2k|#define SYS_T 128 ------------------ | Branch (136:13): [True: 15.1k, False: 120] ------------------ 137| 211k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 211k|#define GFBITS 13 ------------------ | Branch (137:25): [True: 196k, False: 15.1k] ------------------ 138| 196k| buf.v[i][k] = v.v[i]; 139| 196k| } 140| 15.1k| } else { 141| 15.4k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 15.4k|#define SYS_T 128 ------------------ | Branch (141:25): [True: 15.3k, False: 120] ------------------ 142| 15.3k| out[i] = extract_gf(v.d, i); 143| 15.3k| } 144| 120| } 145| 15.2k| } 146| | 147| 1.68k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.68k|#define GFBITS 13 ------------------ | Branch (147:17): [True: 1.56k, False: 120] ------------------ 148| 1.56k| transpose_128x128(buf.d[i]); 149| 1.56k| } 150| | 151| 15.4k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 15.4k|#define SYS_T 128 ------------------ | Branch (151:17): [True: 15.3k, False: 120] ------------------ 152| 215k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 215k|#define GFBITS 13 ------------------ | Branch (152:21): [True: 199k, False: 15.3k] ------------------ 153| 199k| mat.v[j][i] = buf.v[i][j]; 154| 199k| } 155| 15.3k| } 156| | 157| | // gaussian 158| | 159| 15.4k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 15.4k|#define SYS_T 128 ------------------ | Branch (159:17): [True: 15.3k, False: 120] ------------------ 160| 990k| for (j = i + 1; j < SYS_T; j++) { ------------------ | | 8| 990k|#define SYS_T 128 ------------------ | Branch (160:25): [True: 975k, False: 15.3k] ------------------ 161| 975k| m = extract_bit(mat.d[i], i); 162| 975k| m -= 1; 163| 975k| mask = vec128_set2x(m, m); 164| | 165| 13.6M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 13.6M|#define GFBITS 13 ------------------ | Branch (165:25): [True: 12.6M, False: 975k] ------------------ 166| 12.6M| mat.v[i][k] ^= mat.v[j][k] & mask; 167| 12.6M| } 168| | 169| 975k| out[i] ^= out[j] & m; 170| 975k| } 171| | 172| | // 173| | 174| 15.3k| t = extract_gf(mat.d[i], i); 175| | 176| 15.3k| if (gf_is_zero_declassify(t)) { ------------------ | Branch (176:13): [True: 0, False: 15.3k] ------------------ 177| 0| return -1; // return if not systematic 178| 0| } 179| | 180| | // 181| | 182| 15.3k| inv = gf_inv(t); ------------------ | | 11| 15.3k|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 15.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 183| 15.3k| vec128_mul_gf(mat.v[i], mat.v[i], inv); 184| | 185| 15.3k| out[i] = gf_mul(out[i], inv); ------------------ | | 14| 15.3k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 15.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 186| | 187| 1.98M| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 1.98M|#define SYS_T 128 ------------------ | Branch (187:21): [True: 1.96M, False: 15.3k] ------------------ 188| 1.96M| if (j != i) { ------------------ | Branch (188:17): [True: 1.95M, False: 15.3k] ------------------ 189| 1.95M| t = extract_gf(mat.d[j], i); 190| | 191| 1.95M| vec128_mul_gf(v.v, mat.v[i], t); 192| 1.95M| vec128_add(mat.v[j], mat.v[j], v.v); 193| | 194| 1.95M| out[j] ^= gf_mul(out[i], t); ------------------ | | 14| 1.95M|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 1.95M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 195| 1.95M| } 196| 1.96M| } 197| 15.3k| } 198| | 199| 120| return 0; 200| 120|} PQCLEAN_MCELIECE6688128F_AVX2_vec128_mul_GF: 6| 15.2k|void vec128_mul_GF(vec128 out[ GFBITS ], vec128 v[ GFBITS ], gf a[ SYS_T ]) { 7| 15.2k| int i, j; 8| 15.2k| uint64_t buf[GFBITS][4]; 9| 15.2k| vec128 prod[GFBITS]; 10| 15.2k| uint64_t p[GFBITS]; 11| | 12| | // polynomial multiplication 13| | 14| 213k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 213k|#define GFBITS 13 ------------------ | Branch (14:17): [True: 198k, False: 15.2k] ------------------ 15| 198k| buf[i][0] = 0; 16| 198k| buf[i][1] = 0; 17| 198k| buf[i][2] = 0; 18| 198k| buf[i][3] = 0; 19| 198k| } 20| | 21| 1.96M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 15.2k|#define SYS_T 128 ------------------ | Branch (21:25): [True: 1.95M, False: 15.2k] ------------------ 22| 27.3M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 27.3M|#define GFBITS 13 ------------------ | Branch (22:21): [True: 25.3M, False: 1.95M] ------------------ 23| 25.3M| buf[j][3] <<= 1; 24| 25.3M| buf[j][3] |= buf[j][2] >> 63; 25| 25.3M| buf[j][2] <<= 1; 26| 25.3M| buf[j][2] |= buf[j][1] >> 63; 27| 25.3M| buf[j][1] <<= 1; 28| 25.3M| buf[j][1] |= buf[j][0] >> 63; 29| 25.3M| buf[j][0] <<= 1; 30| 25.3M| } 31| | 32| 1.95M| vec128_mul_gf(prod, v, a[i]); 33| | 34| 27.3M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 27.3M|#define GFBITS 13 ------------------ | Branch (34:21): [True: 25.3M, False: 1.95M] ------------------ 35| 25.3M| buf[j][0] ^= vec128_extract(prod[j], 0); ------------------ | | 29| 25.3M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 36| 25.3M| buf[j][1] ^= vec128_extract(prod[j], 1); ------------------ | | 29| 25.3M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 37| 25.3M| } 38| 1.95M| } 39| | 40| | // reduction modulo y^128+y^7+y^2+y+1 41| | 42| 213k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 213k|#define GFBITS 13 ------------------ | Branch (42:17): [True: 198k, False: 15.2k] ------------------ 43| 198k| p[i] = buf[i][3]; 44| | 45| 198k| buf[i][2] ^= p[i] >> (SYS_T - 7 - 64); ------------------ | | 8| 198k|#define SYS_T 128 ------------------ 46| 198k| buf[i][1] ^= p[i] << (64 - (SYS_T - 7 - 64)); ------------------ | | 8| 198k|#define SYS_T 128 ------------------ 47| 198k| buf[i][2] ^= p[i] >> (SYS_T - 2 - 64); ------------------ | | 8| 198k|#define SYS_T 128 ------------------ 48| 198k| buf[i][1] ^= p[i] << (64 - (SYS_T - 2 - 64)); ------------------ | | 8| 198k|#define SYS_T 128 ------------------ 49| 198k| buf[i][2] ^= p[i] >> (SYS_T - 1 - 64); ------------------ | | 8| 198k|#define SYS_T 128 ------------------ 50| 198k| buf[i][1] ^= p[i] << (64 - (SYS_T - 1 - 64)); ------------------ | | 8| 198k|#define SYS_T 128 ------------------ 51| 198k| buf[i][1] ^= p[i]; 52| 198k| } 53| | 54| | // 55| | 56| 213k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 213k|#define GFBITS 13 ------------------ | Branch (56:17): [True: 198k, False: 15.2k] ------------------ 57| 198k| p[i] = buf[i][2]; 58| | 59| 198k| buf[i][1] ^= p[i] >> (SYS_T - 7 - 64); ------------------ | | 8| 198k|#define SYS_T 128 ------------------ 60| 198k| buf[i][0] ^= p[i] << (64 - (SYS_T - 7 - 64)); ------------------ | | 8| 198k|#define SYS_T 128 ------------------ 61| 198k| buf[i][1] ^= p[i] >> (SYS_T - 2 - 64); ------------------ | | 8| 198k|#define SYS_T 128 ------------------ 62| 198k| buf[i][0] ^= p[i] << (64 - (SYS_T - 2 - 64)); ------------------ | | 8| 198k|#define SYS_T 128 ------------------ 63| 198k| buf[i][1] ^= p[i] >> (SYS_T - 1 - 64); ------------------ | | 8| 198k|#define SYS_T 128 ------------------ 64| 198k| buf[i][0] ^= p[i] << (64 - (SYS_T - 1 - 64)); ------------------ | | 8| 198k|#define SYS_T 128 ------------------ 65| 198k| buf[i][0] ^= p[i]; 66| 198k| } 67| | 68| | // 69| | 70| 213k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 213k|#define GFBITS 13 ------------------ | Branch (70:17): [True: 198k, False: 15.2k] ------------------ 71| 198k| out[i] = vec128_set2x(buf[i][0], buf[i][1]); 72| 198k| } 73| 15.2k|} PQCLEAN_MCELIECE6688128F_AVX2_vec256_sq: 9| 5.40k|void vec256_sq(vec256 *out, vec256 *in) { 10| 5.40k| int i; 11| 5.40k| vec256 result[GFBITS], t; 12| | 13| 5.40k| t = vec256_xor(in[11], in[12]); 14| | 15| 5.40k| result[0] = vec256_xor(in[0], in[11]); 16| 5.40k| result[1] = vec256_xor(in[7], t); 17| 5.40k| result[2] = vec256_xor(in[1], in[7]); 18| 5.40k| result[3] = vec256_xor(in[8], t); 19| 5.40k| result[4] = vec256_xor(in[2], in[7]); 20| 5.40k| result[4] = vec256_xor(result[4], in[8]); 21| 5.40k| result[4] = vec256_xor(result[4], t); 22| 5.40k| result[5] = vec256_xor(in[7], in[9]); 23| 5.40k| result[6] = vec256_xor(in[3], in[8]); 24| 5.40k| result[6] = vec256_xor(result[6], in[9]); 25| 5.40k| result[6] = vec256_xor(result[6], in[12]); 26| 5.40k| result[7] = vec256_xor(in[8], in[10]); 27| 5.40k| result[8] = vec256_xor(in[4], in[9]); 28| 5.40k| result[8] = vec256_xor(result[8], in[10]); 29| 5.40k| result[9] = vec256_xor(in[9], in[11]); 30| 5.40k| result[10] = vec256_xor(in[5], in[10]); 31| 5.40k| result[10] = vec256_xor(result[10], in[11]); 32| 5.40k| result[11] = vec256_xor(in[10], in[12]); 33| 5.40k| result[12] = vec256_xor(in[6], t); 34| | 35| 75.6k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 75.6k|#define GFBITS 13 ------------------ | Branch (35:17): [True: 70.2k, False: 5.40k] ------------------ 36| 70.2k| out[i] = result[i]; 37| 70.2k| } 38| 5.40k|} PQCLEAN_MCELIECE6688128F_AVX2_vec256_inv: 41| 210|void vec256_inv(vec256 *out, vec256 *in) { 42| 210| vec256 tmp_11[ GFBITS ]; 43| 210| vec256 tmp_1111[ GFBITS ]; 44| | 45| 210| vec256_copy(out, in); 46| | 47| 210| vec256_sq(out, out); ------------------ | | 14| 210|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 210|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 48| 210| vec256_mul(tmp_11, out, in); // ^11 49| | 50| 210| vec256_sq(out, tmp_11); ------------------ | | 14| 210|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 210|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 51| 210| vec256_sq(out, out); ------------------ | | 14| 210|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 210|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 52| 210| vec256_mul(tmp_1111, out, tmp_11); // ^1111 53| | 54| 210| vec256_sq(out, tmp_1111); ------------------ | | 14| 210|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 210|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 55| 210| vec256_sq(out, out); ------------------ | | 14| 210|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 210|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 56| 210| vec256_sq(out, out); ------------------ | | 14| 210|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 210|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 57| 210| vec256_sq(out, out); ------------------ | | 14| 210|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 210|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 58| 210| vec256_mul(out, out, tmp_1111); // ^11111111 59| | 60| 210| vec256_sq(out, out); ------------------ | | 14| 210|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 210|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 61| 210| vec256_sq(out, out); ------------------ | | 14| 210|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 210|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 62| 210| vec256_sq(out, out); ------------------ | | 14| 210|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 210|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 63| 210| vec256_sq(out, out); ------------------ | | 14| 210|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 210|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 64| 210| vec256_mul(out, out, tmp_1111); // ^111111111111 65| | 66| 210| vec256_sq(out, out); // ^1111111111110 ------------------ | | 14| 210|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 210|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6688128F_AVX2_ ## fun | | ------------------ ------------------ 67| 210|} PQCLEAN_MCELIECE6960119_AVX2_load_bits: 188| 114|void load_bits(vec128 bits_int[][32], const unsigned char *bits) { 189| 114| int i, j; 190| 114| const unsigned char *ptr = bits; 191| | 192| 114| vec128 buf[64]; 193| | 194| 456| for (i = 0; i <= 5; i += 2) { ------------------ | Branch (194:17): [True: 342, False: 114] ------------------ 195| 22.2k| for (j = 0; j < 64; j++) { ------------------ | Branch (195:21): [True: 21.8k, False: 342] ------------------ 196| 21.8k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 197| 21.8k| ptr += 8; 198| 21.8k| } 199| | 200| 342| transpose_64x128_sp( buf ); 201| | 202| 11.2k| for (j = 0; j < 32; j++) { ------------------ | Branch (202:21): [True: 10.9k, False: 342] ------------------ 203| 10.9k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 204| 10.9k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 205| 10.9k| } 206| | 207| 342| ptr += 512; 208| 342| } 209| | 210| 1.59k| for (i = 6; i <= 18; i++) { ------------------ | Branch (210:17): [True: 1.48k, False: 114] ------------------ 211| 48.9k| for (j = 0; j < 32; j++) { ------------------ | Branch (211:21): [True: 47.4k, False: 1.48k] ------------------ 212| 47.4k| bits_int[i][j] = load16(ptr); 213| 47.4k| ptr += 16; 214| 47.4k| } 215| 1.48k| } 216| | 217| 456| for (i = 19; i < 25; i += 2) { ------------------ | Branch (217:18): [True: 342, False: 114] ------------------ 218| 22.2k| for (j = 0; j < 64; j++) { ------------------ | Branch (218:21): [True: 21.8k, False: 342] ------------------ 219| 21.8k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 220| 21.8k| ptr += 8; 221| 21.8k| } 222| | 223| 342| transpose_64x128_sp( buf ); 224| | 225| 11.2k| for (j = 0; j < 32; j++) { ------------------ | Branch (225:21): [True: 10.9k, False: 342] ------------------ 226| 10.9k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 227| 10.9k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 228| 10.9k| } 229| | 230| 342| ptr += 512; 231| 342| } 232| 114|} PQCLEAN_MCELIECE6960119_AVX2_benes: 238| 228|void benes(vec128 *r, vec128 b[][32], int rev) { 239| 228| int inc; 240| | 241| 228| vec128 *b_ptr; 242| | 243| 228| if (rev == 0) { ------------------ | Branch (243:9): [True: 114, False: 114] ------------------ 244| 114| inc = 32; 245| 114| b_ptr = b[ 0]; 246| 114| } else { 247| 114| inc = -32; 248| 114| b_ptr = b[24]; 249| 114| } 250| | 251| | // 252| | 253| 228| transpose_64x128_sp( r ); 254| | 255| 228| layer_0(r, b_ptr); 256| 228| b_ptr += inc; 257| 228| layer_1(r, b_ptr); 258| 228| b_ptr += inc; 259| 228| layer_2(r, b_ptr); 260| 228| b_ptr += inc; 261| 228| layer_3(r, b_ptr); 262| 228| b_ptr += inc; 263| 228| layer_4(r, b_ptr); 264| 228| b_ptr += inc; 265| 228| layer_5(r, b_ptr); 266| 228| b_ptr += inc; 267| | 268| 228| transpose_64x128_sp( r ); 269| | 270| 228| layer_x(r, b_ptr); 271| 228| b_ptr += inc; 272| 228| layer_0(r, b_ptr); 273| 228| b_ptr += inc; 274| 228| layer_1(r, b_ptr); 275| 228| b_ptr += inc; 276| 228| layer_2(r, b_ptr); 277| 228| b_ptr += inc; 278| 228| layer_3(r, b_ptr); 279| 228| b_ptr += inc; 280| 228| layer_4(r, b_ptr); 281| 228| b_ptr += inc; 282| 228| layer_5(r, b_ptr); 283| 228| b_ptr += inc; 284| 228| layer_4(r, b_ptr); 285| 228| b_ptr += inc; 286| 228| layer_3(r, b_ptr); 287| 228| b_ptr += inc; 288| 228| layer_2(r, b_ptr); 289| 228| b_ptr += inc; 290| 228| layer_1(r, b_ptr); 291| 228| b_ptr += inc; 292| 228| layer_0(r, b_ptr); 293| 228| b_ptr += inc; 294| 228| layer_x(r, b_ptr); 295| 228| b_ptr += inc; 296| | 297| 228| transpose_64x128_sp( r ); 298| | 299| 228| layer_5(r, b_ptr); 300| 228| b_ptr += inc; 301| 228| layer_4(r, b_ptr); 302| 228| b_ptr += inc; 303| 228| layer_3(r, b_ptr); 304| 228| b_ptr += inc; 305| 228| layer_2(r, b_ptr); 306| 228| b_ptr += inc; 307| 228| layer_1(r, b_ptr); 308| 228| b_ptr += inc; 309| 228| layer_0(r, b_ptr); 310| | 311| 228| transpose_64x128_sp( r ); 312| 228|} PQCLEAN_MCELIECE6960119_AVX2_bm: 147| 114|void bm(vec128 *out, vec256 *in) { 148| 114| int i; 149| 114| uint16_t N, L; 150| 114| uint16_t mask; 151| 114| uint64_t one = 1; 152| 114| uint64_t v[2]; 153| | 154| 114| vec128 prod[ GFBITS ]; 155| 114| vec128 interval[GFBITS]; 156| | 157| 114| typedef union { 158| 114| vec128 v[GFBITS][2]; 159| 114| vec256 V[GFBITS]; 160| 114| } db_t; 161| | 162| 114| db_t db; 163| 114| db_t BC_tmp; 164| 114| db_t BC; 165| | 166| 114| gf d, b; 167| 114| gf coefs[256]; 168| | 169| | // initialization 170| | 171| 114| get_coefs(coefs, in); 172| | 173| 114| BC.v[0][0] = vec128_set2x(0, one << 62); 174| 114| BC.v[0][1] = vec128_set2x(0, one << 63); 175| | 176| 1.48k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.48k|#define GFBITS 13 ------------------ | Branch (176:17): [True: 1.36k, False: 114] ------------------ 177| 1.36k| BC.v[i][0] = BC.v[i][1] = vec128_setzero(); 178| 1.36k| } 179| | 180| 114| b = 1; 181| 114| L = 0; 182| | 183| | // 184| | 185| 1.59k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.59k|#define GFBITS 13 ------------------ | Branch (185:17): [True: 1.48k, False: 114] ------------------ 186| 1.48k| interval[i] = vec128_setzero(); 187| 1.48k| } 188| | 189| 27.2k| for (N = 0; N < SYS_T * 2; N++) { ------------------ | | 8| 27.2k|#define SYS_T 119 ------------------ | Branch (189:17): [True: 27.1k, False: 114] ------------------ 190| 27.1k| update_asm(interval, coefs[N], 16); ------------------ | | 1| 27.1k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 27.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 191| 27.1k| vec128_mul_asm(prod, interval, BC.v[0] + 1, 32); ------------------ | | 10| 27.1k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 27.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 192| | 193| 27.1k| d = vec_reduce_asm(prod); ------------------ | | 3| 27.1k|#define vec_reduce_asm CRYPTO_NAMESPACE(vec_reduce_asm) | | ------------------ | | | | 4| 27.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 194| | 195| 27.1k| mask = mask_nonzero(d) & mask_leq(L * 2, N); 196| | 197| 379k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 379k|#define GFBITS 13 ------------------ | Branch (197:21): [True: 352k, False: 27.1k] ------------------ 198| 352k| db.v[i][0] = vec128_setbits((d >> i) & 1); 199| 352k| db.v[i][1] = vec128_setbits((b >> i) & 1); 200| 352k| } 201| | 202| 27.1k| vec256_mul((vec256 *) BC_tmp.V, (vec256 *) db.V, (vec256 *) BC.V); 203| | 204| 27.1k| vec128_cmov(BC.v, mask); 205| 27.1k| update_asm(BC.v, 0, 32); ------------------ | | 1| 27.1k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 27.1k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 379k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 379k|#define GFBITS 13 ------------------ | Branch (207:21): [True: 352k, False: 27.1k] ------------------ 208| 352k| BC.v[i][1] = vec128_xor(BC_tmp.v[i][0], BC_tmp.v[i][1]); 209| 352k| } 210| | 211| 27.1k| b = (d & mask) | (b & ~mask); 212| 27.1k| L = ((N + 1 - L) & mask) | (L & ~mask); 213| 27.1k| } 214| | 215| 1.59k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.59k|#define GFBITS 13 ------------------ | Branch (215:17): [True: 1.48k, False: 114] ------------------ 216| 1.48k| v[0] = vec128_extract(BC.v[i][1], 0); ------------------ | | 29| 1.48k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 217| 1.48k| v[1] = vec128_extract(BC.v[i][1], 1); ------------------ | | 29| 1.48k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 218| | 219| 1.48k| out[i] = vec128_set2x((v[0] >> 8) | (v[1] << 56), v[1] >> 8); 220| 1.48k| } 221| 114|} PQCLEAN_MCELIECE6960119_AVX2_controlbitsfrompermutation: 205| 114|void controlbitsfrompermutation(unsigned char *out, const int16 *pi, long long w, long long n) { 206| 114| PQCLEAN_VLA(int32, temp, (size_t)(2 * n)); ------------------ | | 57| 114|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 207| 114| PQCLEAN_VLA(int16, pi_test, (size_t)n); ------------------ | | 57| 114|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 208| 114| int16 diff; 209| 114| int i; 210| 114| unsigned char *ptr; 211| | 212| 114| OQS_MEM_cleanse(temp, (size_t)n * 2); 213| 114| OQS_MEM_cleanse(pi_test, (size_t)n); 214| | 215| 114| while (1) { ------------------ | Branch (215:12): [True: 114, Folded] ------------------ 216| 114| OQS_MEM_cleanse(out, (size_t)((((2 * w - 1)*n / 2) + 7) / 8)); 217| 114| cbrecursion(out, 0, 1, pi, w, n, temp); 218| | 219| | // check for correctness 220| | 221| 934k| for (i = 0; i < n; i++) { ------------------ | Branch (221:21): [True: 933k, False: 114] ------------------ 222| 933k| pi_test[i] = (int16)i; 223| 933k| } 224| | 225| 114| ptr = out; 226| 1.59k| for (i = 0; i < w; i++) { ------------------ | Branch (226:21): [True: 1.48k, False: 114] ------------------ 227| 1.48k| layer(pi_test, ptr, i, (int32)n); 228| 1.48k| ptr += n >> 4; 229| 1.48k| } 230| | 231| 1.48k| for (i = (int)(w - 2); i >= 0; i--) { ------------------ | Branch (231:32): [True: 1.36k, False: 114] ------------------ 232| 1.36k| layer(pi_test, ptr, i, (int32)n); 233| 1.36k| ptr += n >> 4; 234| 1.36k| } 235| | 236| 114| diff = 0; 237| 934k| for (i = 0; i < n; i++) { ------------------ | Branch (237:21): [True: 933k, False: 114] ------------------ 238| 933k| diff |= pi[i] ^ pi_test[i]; 239| 933k| } 240| | 241| 114| diff = crypto_int16_nonzero_mask(diff); ------------------ | | 12| 114|#define crypto_int16_nonzero_mask CRYPTO_NAMESPACE(crypto_int16_nonzero_mask) | | ------------------ | | | | 4| 114|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 242| 114| crypto_declassify(&diff, sizeof diff); 243| 114| if (diff == 0) { ------------------ | Branch (243:13): [True: 114, False: 0] ------------------ 244| 114| break; 245| 114| } 246| 114| } 247| 114|} PQCLEAN_MCELIECE6960119_AVX2_crypto_int16_negative_mask: 3| 228|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 4| 228| return crypto_int16_x >> 15; 5| 228|} PQCLEAN_MCELIECE6960119_AVX2_crypto_int16_nonzero_mask: 7| 114|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 8| 114| return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 114|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 114|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 114|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 114|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 9| 114|} PQCLEAN_MCELIECE6960119_AVX2_crypto_int32_negative_mask: 3| 72.8M|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 4| 72.8M| return crypto_int32_x >> 31; 5| 72.8M|} PQCLEAN_MCELIECE6960119_AVX2_crypto_int32_min: 37| 72.8M|crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x, crypto_int32 crypto_int32_y) { 38| 72.8M| crypto_int32 crypto_int32_xy = crypto_int32_y ^ crypto_int32_x; 39| 72.8M| crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x; 40| 72.8M| crypto_int32_z ^= crypto_int32_xy & (crypto_int32_z ^ crypto_int32_y); 41| 72.8M| crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); ------------------ | | 9| 72.8M|#define crypto_int32_negative_mask CRYPTO_NAMESPACE(crypto_int32_negative_mask) | | ------------------ | | | | 4| 72.8M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 42| 72.8M| crypto_int32_z &= crypto_int32_xy; 43| 72.8M| return crypto_int32_x ^ crypto_int32_z; 44| 72.8M|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint16_signed_negative_mask: 3| 360k|crypto_uint16_signed crypto_uint16_signed_negative_mask(crypto_uint16_signed crypto_uint16_signed_x) { 4| 360k| return crypto_uint16_signed_x >> 15; 5| 360k|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint16_nonzero_mask: 7| 137k|crypto_uint16 crypto_uint16_nonzero_mask(crypto_uint16 crypto_uint16_x) { 8| 137k| return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 137k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 137k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 137k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 137k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 9| 137k|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint16_zero_mask: 11| 137k|crypto_uint16 crypto_uint16_zero_mask(crypto_uint16 crypto_uint16_x) { 12| 137k| return ~crypto_uint16_nonzero_mask(crypto_uint16_x); ------------------ | | 13| 137k|#define crypto_uint16_nonzero_mask CRYPTO_NAMESPACE(crypto_uint16_nonzero_mask) | | ------------------ | | | | 4| 137k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 13| 137k|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint16_smaller_mask: 24| 85.7k|crypto_uint16 crypto_uint16_smaller_mask(crypto_uint16 crypto_uint16_x, crypto_uint16 crypto_uint16_y) { 25| 85.7k| crypto_uint16 crypto_uint16_xy = crypto_uint16_x ^ crypto_uint16_y; 26| 85.7k| crypto_uint16 crypto_uint16_z = crypto_uint16_x - crypto_uint16_y; 27| 85.7k| crypto_uint16_z ^= crypto_uint16_xy & (crypto_uint16_z ^ crypto_uint16_x ^ (((crypto_uint16) 1) << 15)); 28| 85.7k| return crypto_uint16_signed_negative_mask(crypto_uint16_z); ------------------ | | 11| 85.7k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 85.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 29| 85.7k|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint32_signed_negative_mask: 3| 144k|crypto_uint32_signed crypto_uint32_signed_negative_mask(crypto_uint32_signed crypto_uint32_signed_x) { 4| 144k| return crypto_uint32_signed_x >> 31; 5| 144k|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint32_nonzero_mask: 7| 72.0k|crypto_uint32 crypto_uint32_nonzero_mask(crypto_uint32 crypto_uint32_x) { 8| 72.0k| return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 72.0k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 72.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 72.0k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 72.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 9| 72.0k|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint32_unequal_mask: 15| 72.0k|crypto_uint32 crypto_uint32_unequal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 16| 72.0k| crypto_uint32 crypto_uint32_xy = crypto_uint32_x ^ crypto_uint32_y; 17| 72.0k| return crypto_uint32_nonzero_mask(crypto_uint32_xy); ------------------ | | 13| 72.0k|#define crypto_uint32_nonzero_mask CRYPTO_NAMESPACE(crypto_uint32_nonzero_mask) | | ------------------ | | | | 4| 72.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 18| 72.0k|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint32_equal_mask: 20| 72.0k|crypto_uint32 crypto_uint32_equal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 21| 72.0k| return ~crypto_uint32_unequal_mask(crypto_uint32_x, crypto_uint32_y); ------------------ | | 17| 72.0k|#define crypto_uint32_unequal_mask CRYPTO_NAMESPACE(crypto_uint32_unequal_mask) | | ------------------ | | | | 4| 72.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 22| 72.0k|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint64_signed_negative_mask: 3| 22.0M|crypto_uint64_signed crypto_uint64_signed_negative_mask(crypto_uint64_signed crypto_uint64_signed_x) { 4| 22.0M| return crypto_uint64_signed_x >> 63; 5| 22.0M|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint64_nonzero_mask: 7| 11.0M|crypto_uint64 crypto_uint64_nonzero_mask(crypto_uint64 crypto_uint64_x) { 8| 11.0M| return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 11.0M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 11.0M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 11.0M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 11.0M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 9| 11.0M|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint64_zero_mask: 11| 1.72M|crypto_uint64 crypto_uint64_zero_mask(crypto_uint64 crypto_uint64_x) { 12| 1.72M| return ~crypto_uint64_nonzero_mask(crypto_uint64_x); ------------------ | | 13| 1.72M|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 1.72M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 13| 1.72M|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint64_unequal_mask: 15| 9.27M|crypto_uint64 crypto_uint64_unequal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 16| 9.27M| crypto_uint64 crypto_uint64_xy = crypto_uint64_x ^ crypto_uint64_y; 17| 9.27M| return crypto_uint64_nonzero_mask(crypto_uint64_xy); ------------------ | | 13| 9.27M|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 9.27M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 18| 9.27M|} PQCLEAN_MCELIECE6960119_AVX2_crypto_uint64_equal_mask: 20| 9.27M|crypto_uint64 crypto_uint64_equal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 21| 9.27M| return ~crypto_uint64_unequal_mask(crypto_uint64_x, crypto_uint64_y); ------------------ | | 17| 9.27M|#define crypto_uint64_unequal_mask CRYPTO_NAMESPACE(crypto_uint64_unequal_mask) | | ------------------ | | | | 4| 9.27M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 22| 9.27M|} PQCLEAN_MCELIECE6960119_AVX2_decrypt: 171| 114|int decrypt(unsigned char *e, const unsigned char *sk, const unsigned char *s) { 172| 114| int i; 173| | 174| 114| uint16_t check_synd; 175| 114| uint16_t check_weight; 176| | 177| 114| vec256 inv[ 32 ][ GFBITS ]; 178| 114| vec256 scaled[ 32 ][ GFBITS ]; 179| 114| vec256 eval[32][ GFBITS ]; 180| | 181| 114| vec128 error128[ 64 ]; 182| 114| vec256 error256[ 32 ]; 183| | 184| 114| vec256 s_priv[ GFBITS ]; 185| 114| vec256 s_priv_cmp[ GFBITS ]; 186| 114| vec128 locator[ GFBITS ]; 187| | 188| 114| vec128 recv128[ 64 ]; 189| 114| vec256 recv256[ 32 ]; 190| 114| vec256 allone; 191| | 192| 114| vec128 bits_int[25][32]; 193| | 194| | // Berlekamp decoder 195| | 196| 114| preprocess(recv128, s); 197| | 198| 114| load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 10| 114|#define load_bits CRYPTO_NAMESPACE(load_bits) | | ------------------ | | | | 4| 114|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 11| 114|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 114|#define SYS_T 119 | | ------------------ ------------------ 199| 114| benes(recv128, bits_int, 1); ------------------ | | 9| 114|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 114|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 200| | 201| 114| reformat_128to256(recv256, recv128); 202| | 203| 114| scaling(scaled, inv, sk, recv256); 204| 114| fft_tr(s_priv, scaled); ------------------ | | 9| 114|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 114|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 205| 114| bm(locator, s_priv); ------------------ | | 10| 114|#define bm CRYPTO_NAMESPACE(bm) | | ------------------ | | | | 4| 114|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 114| fft(eval, locator); ------------------ | | 10| 114|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 114|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| | // reencryption and weight check 210| | 211| 114| allone = vec256_set1_16b(0xFFFF); 212| | 213| 3.76k| for (i = 0; i < 32; i++) { ------------------ | Branch (213:17): [True: 3.64k, False: 114] ------------------ 214| 3.64k| error256[i] = vec256_or_reduce(eval[i]); 215| 3.64k| error256[i] = vec256_xor(error256[i], allone); 216| 3.64k| } 217| | 218| 114| scaling_inv(scaled, inv, error256); 219| 114| fft_tr(s_priv_cmp, scaled); ------------------ | | 9| 114|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 114|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 220| | 221| 114| check_synd = synd_cmp(s_priv, s_priv_cmp); 222| | 223| | // 224| | 225| 114| reformat_256to128(error128, error256); 226| 114| benes(error128, bits_int, 0); ------------------ | | 9| 114|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 114|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 227| | 228| 114| postprocess(e, error128); 229| | 230| 114| check_weight = weight_check(e, error128); 231| | 232| 114| return 1 - (check_synd & check_weight); 233| 114|} PQCLEAN_MCELIECE6960119_AVX2_encrypt: 116| 114|void encrypt(unsigned char *s, const unsigned char *pk, unsigned char *e) { 117| 114| gen_e(e); 118| | 119| 114| syndrome_asm(s, pk, e); ------------------ | | 1| 114|#define syndrome_asm CRYPTO_NAMESPACE(syndrome_asm) | | ------------------ | | | | 4| 114|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 120| 114|} PQCLEAN_MCELIECE6960119_AVX2_fft: 265| 1.38k|void fft(vec256 out[][GFBITS], vec128 *in) { 266| 1.38k| radix_conversions(in); 267| 1.38k| butterflies(out, in); 268| 1.38k|} PQCLEAN_MCELIECE6960119_AVX2_fft_tr: 398| 228|void fft_tr(vec256 *out, vec256 in[][ GFBITS ]) { 399| 228| butterflies_tr(out, in); 400| 228| radix_conversions_tr(out); 401| | 402| 228| postprocess(out); 403| 228|} PQCLEAN_MCELIECE6960119_AVX2_gf_mul: 20| 16.3M|gf gf_mul(gf in0, gf in1) { 21| 16.3M| int i; 22| | 23| 16.3M| uint64_t tmp; 24| 16.3M| uint64_t t0; 25| 16.3M| uint64_t t1; 26| 16.3M| uint64_t t; 27| | 28| 16.3M| t0 = in0; 29| 16.3M| t1 = in1; 30| | 31| 16.3M| tmp = t0 * (t1 & 1); 32| | 33| 212M| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 212M|#define GFBITS 13 ------------------ | Branch (33:17): [True: 195M, False: 16.3M] ------------------ 34| 195M| tmp ^= (t0 * (t1 & (1 << i))); 35| 195M| } 36| | 37| | // 38| | 39| 16.3M| t = tmp & 0x1FF0000; 40| 16.3M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 41| | 42| 16.3M| t = tmp & 0x000E000; 43| 16.3M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 44| | 45| 16.3M| return tmp & GFMASK; ------------------ | | 19| 16.3M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 16.3M|#define GFBITS 13 | | ------------------ ------------------ 46| 16.3M|} PQCLEAN_MCELIECE6960119_AVX2_gf_frac: 156| 137k|gf gf_frac(gf den, gf num) { 157| 137k| gf tmp_11; 158| 137k| gf tmp_1111; 159| 137k| gf out; 160| | 161| 137k| tmp_11 = gf_sqmul(den, den); // ^11 162| 137k| tmp_1111 = gf_sq2mul(tmp_11, tmp_11); // ^1111 163| 137k| out = gf_sq2(tmp_1111); 164| 137k| out = gf_sq2mul(out, tmp_1111); // ^11111111 165| 137k| out = gf_sq2(out); 166| 137k| out = gf_sq2mul(out, tmp_1111); // ^111111111111 167| | 168| 137k| return gf_sqmul(out, num); // ^1111111111110 = ^-1 169| 137k|} PQCLEAN_MCELIECE6960119_AVX2_gf_inv: 172| 137k|gf gf_inv(gf den) { 173| 137k| return gf_frac(den, ((gf) 1)); ------------------ | | 10| 137k|#define gf_frac CRYPTO_NAMESPACE(gf_frac) | | ------------------ | | | | 4| 137k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 174| 137k|} pk_gen.c:PQCLEAN_MCELIECE6960119_AVX2_int32_sort: 21| 114|static void int32_sort(int32_t *x, long long n) { 22| 114| long long top, p, q, r, i; 23| | 24| 114| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 114] ------------------ 25| 0| return; 26| 0| } 27| 114| top = 1; 28| 1.25k| while (top < n - top) { ------------------ | Branch (28:12): [True: 1.14k, False: 114] ------------------ 29| 1.14k| top += top; 30| 1.14k| } 31| | 32| 1.36k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 1.25k, False: 114] ------------------ 33| 1.70M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.70M, False: 1.25k] ------------------ 34| 1.70M| if (!(i & p)) { ------------------ | Branch (34:17): [True: 909k, False: 797k] ------------------ 35| 909k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 909k| do { \ | | 12| 909k| int32_t ab = (b) ^ (a); \ | | 13| 909k| int32_t c = (b) - (a); \ | | 14| 909k| c ^= ab & ((c) ^ (b)); \ | | 15| 909k| c >>= 31; \ | | 16| 909k| c &= ab; \ | | 17| 909k| (a) ^= c; \ | | 18| 909k| (b) ^= c; \ | | 19| 909k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 909k] | | ------------------ ------------------ 36| 909k| } 37| 1.70M| } 38| 1.25k| i = 0; 39| 7.52k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 6.27k, False: 1.25k] ------------------ 40| 1.53M| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.53M, False: 6.27k] ------------------ 41| 1.53M| if (!(i & p)) { ------------------ | Branch (41:21): [True: 797k, False: 732k] ------------------ 42| 797k| int32_t a = x[i + p]; 43| 4.64M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 3.84M, False: 797k] ------------------ 44| 3.84M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 3.84M| do { \ | | 12| 3.84M| int32_t ab = (b) ^ (a); \ | | 13| 3.84M| int32_t c = (b) - (a); \ | | 14| 3.84M| c ^= ab & ((c) ^ (b)); \ | | 15| 3.84M| c >>= 31; \ | | 16| 3.84M| c &= ab; \ | | 17| 3.84M| (a) ^= c; \ | | 18| 3.84M| (b) ^= c; \ | | 19| 3.84M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.84M] | | ------------------ ------------------ 45| 3.84M| } 46| 797k| x[i + p] = a; 47| 797k| } 48| 1.53M| } 49| 6.27k| } 50| 1.25k| } 51| 114|} controlbits.c:PQCLEAN_MCELIECE6960119_AVX2_int32_sort: 21| 3.73M|static void int32_sort(int32_t *x, long long n) { 22| 3.73M| long long top, p, q, r, i; 23| | 24| 3.73M| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 3.73M] ------------------ 25| 0| return; 26| 0| } 27| 3.73M| top = 1; 28| 13.0M| while (top < n - top) { ------------------ | Branch (28:12): [True: 9.36M, False: 3.73M] ------------------ 29| 9.36M| top += top; 30| 9.36M| } 31| | 32| 16.8M| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 13.0M, False: 3.73M] ------------------ 33| 1.80G| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.78G, False: 13.0M] ------------------ 34| 1.78G| if (!(i & p)) { ------------------ | Branch (34:17): [True: 1.00G, False: 788M] ------------------ 35| 1.00G| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 1.00G| do { \ | | 12| 1.00G| int32_t ab = (b) ^ (a); \ | | 13| 1.00G| int32_t c = (b) - (a); \ | | 14| 1.00G| c ^= ab & ((c) ^ (b)); \ | | 15| 1.00G| c >>= 31; \ | | 16| 1.00G| c &= ab; \ | | 17| 1.00G| (a) ^= c; \ | | 18| 1.00G| (b) ^= c; \ | | 19| 1.00G| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.00G] | | ------------------ ------------------ 36| 1.00G| } 37| 1.78G| } 38| 13.0M| i = 0; 39| 35.5M| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 22.4M, False: 13.0M] ------------------ 40| 1.59G| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.57G, False: 22.4M] ------------------ 41| 1.57G| if (!(i & p)) { ------------------ | Branch (41:21): [True: 788M, False: 788M] ------------------ 42| 788M| int32_t a = x[i + p]; 43| 4.67G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 3.88G, False: 788M] ------------------ 44| 3.88G| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 3.88G| do { \ | | 12| 3.88G| int32_t ab = (b) ^ (a); \ | | 13| 3.88G| int32_t c = (b) - (a); \ | | 14| 3.88G| c ^= ab & ((c) ^ (b)); \ | | 15| 3.88G| c >>= 31; \ | | 16| 3.88G| c &= ab; \ | | 17| 3.88G| (a) ^= c; \ | | 18| 3.88G| (b) ^= c; \ | | 19| 3.88G| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.88G] | | ------------------ ------------------ 45| 3.88G| } 46| 788M| x[i + p] = a; 47| 788M| } 48| 1.57G| } 49| 22.4M| } 50| 13.0M| } 51| 3.73M|} encrypt.c:PQCLEAN_MCELIECE6960119_AVX2_int32_sort: 21| 611|static void int32_sort(int32_t *x, long long n) { 22| 611| long long top, p, q, r, i; 23| | 24| 611| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 611] ------------------ 25| 0| return; 26| 0| } 27| 611| top = 1; 28| 4.27k| while (top < n - top) { ------------------ | Branch (28:12): [True: 3.66k, False: 611] ------------------ 29| 3.66k| top += top; 30| 3.66k| } 31| | 32| 4.88k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 4.27k, False: 611] ------------------ 33| 435k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 431k, False: 4.27k] ------------------ 34| 431k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 243k, False: 188k] ------------------ 35| 243k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 243k| do { \ | | 12| 243k| int32_t ab = (b) ^ (a); \ | | 13| 243k| int32_t c = (b) - (a); \ | | 14| 243k| c ^= ab & ((c) ^ (b)); \ | | 15| 243k| c >>= 31; \ | | 16| 243k| c &= ab; \ | | 17| 243k| (a) ^= c; \ | | 18| 243k| (b) ^= c; \ | | 19| 243k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 243k] | | ------------------ ------------------ 36| 243k| } 37| 431k| } 38| 4.27k| i = 0; 39| 17.1k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 12.8k, False: 4.27k] ------------------ 40| 372k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 359k, False: 12.8k] ------------------ 41| 359k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 188k, False: 171k] ------------------ 42| 188k| int32_t a = x[i + p]; 43| 774k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 586k, False: 188k] ------------------ 44| 586k| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 586k| do { \ | | 12| 586k| int32_t ab = (b) ^ (a); \ | | 13| 586k| int32_t c = (b) - (a); \ | | 14| 586k| c ^= ab & ((c) ^ (b)); \ | | 15| 586k| c >>= 31; \ | | 16| 586k| c &= ab; \ | | 17| 586k| (a) ^= c; \ | | 18| 586k| (b) ^= c; \ | | 19| 586k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 586k] | | ------------------ ------------------ 45| 586k| } 46| 188k| x[i + p] = a; 47| 188k| } 48| 359k| } 49| 12.8k| } 50| 4.27k| } 51| 611|} PQCLEAN_MCELIECE6960119_AVX2_crypto_kem_enc: 40| 114|) { 41| 114| unsigned char e[ SYS_N / 8 ]; 42| 114| unsigned char one_ec[ 1 + SYS_N / 8 + SYND_BYTES ] = {1}; 43| 114| unsigned char mask; 44| 114| int i, padding_ok; 45| | 46| | // 47| | 48| 114| padding_ok = check_pk_padding(pk); 49| | 50| 114| encrypt(c, pk, e); ------------------ | | 9| 114|#define encrypt CRYPTO_NAMESPACE(encrypt) | | ------------------ | | | | 4| 114|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 51| | 52| 114| memcpy(one_ec + 1, e, SYS_N / 8); ------------------ | | 7| 114|#define SYS_N 6960 ------------------ 53| 114| memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 7| 114|#define SYS_N 6960 ------------------ memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 17| 114|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 114|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 114|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 114|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 54| | 55| 114| crypto_hash_32b(key, one_ec, sizeof(one_ec)); ------------------ | | 7| 114| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 114|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 56| | 57| | // clear outputs (set to all 0's) if padding bits are not all zero 58| | 59| 114| mask = (unsigned char)padding_ok; 60| 114| mask ^= 0xFF; 61| | 62| 22.2k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 22.2k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 22.2k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 22.2k|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 22.2k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (62:17): [True: 22.1k, False: 114] ------------------ 63| 22.1k| c[i] &= mask; 64| 22.1k| } 65| | 66| 3.76k| for (i = 0; i < 32; i++) { ------------------ | Branch (66:17): [True: 3.64k, False: 114] ------------------ 67| 3.64k| key[i] &= mask; 68| 3.64k| } 69| | 70| 114| return padding_ok; 71| 114|} PQCLEAN_MCELIECE6960119_AVX2_crypto_kem_dec: 90| 114|) { 91| 114| int i, padding_ok; 92| | 93| 114| unsigned char mask; 94| 114| unsigned char ret_decrypt = 0; 95| | 96| 114| uint16_t m; 97| | 98| 114| unsigned char e[ SYS_N / 8 ]; 99| 114| unsigned char preimage[ 1 + SYS_N / 8 + SYND_BYTES ]; 100| 114| unsigned char *x = preimage; 101| 114| const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 11| 114|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 114|#define SYS_T 119 | | ------------------ ------------------ const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 10| 114|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 114|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 114|#define GFBITS 13 | | ------------------ ------------------ 102| | 103| | // 104| | 105| 114| padding_ok = check_c_padding(c); 106| | 107| 114| ret_decrypt = (unsigned char)decrypt(e, sk + 40, c); ------------------ | | 9| 114|#define decrypt CRYPTO_NAMESPACE(decrypt) | | ------------------ | | | | 4| 114|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 108| | 109| 114| m = ret_decrypt; 110| 114| m -= 1; 111| 114| m >>= 8; 112| | 113| 114| *x++ = m & 1; 114| 99.2k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 99.2k|#define SYS_N 6960 ------------------ | Branch (114:17): [True: 99.1k, False: 114] ------------------ 115| 99.1k| *x++ = (~m & s[i]) | (m & e[i]); 116| 99.1k| } 117| | 118| 22.2k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 22.2k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 22.2k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 22.2k|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 22.2k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (118:17): [True: 22.1k, False: 114] ------------------ 119| 22.1k| *x++ = c[i]; 120| 22.1k| } 121| | 122| 114| crypto_hash_32b(key, preimage, sizeof(preimage)); ------------------ | | 7| 114| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 114|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 123| | 124| | // clear outputs (set to all 1's) if padding bits are not all zero 125| | 126| 114| mask = (unsigned char)padding_ok; 127| | 128| 3.76k| for (i = 0; i < 32; i++) { ------------------ | Branch (128:17): [True: 3.64k, False: 114] ------------------ 129| 3.64k| key[i] |= mask; 130| 3.64k| } 131| | 132| 114| return padding_ok; 133| 114|} PQCLEAN_MCELIECE6960119_AVX2_crypto_kem_keypair: 139| 114|) { 140| 114| int i; 141| 114| unsigned char seed[ 33 ] = {64}; 142| 114| unsigned char r[ SYS_N / 8 + (1 << GFBITS)*sizeof(uint32_t) + SYS_T * 2 + 32 ]; 143| 114| unsigned char *rp, *skp; 144| | 145| 114| gf f[ SYS_T ]; // element in GF(2^mt) 146| 114| gf irr[ SYS_T ]; // Goppa polynomial 147| 114| uint32_t perm[ 1 << GFBITS ]; // random permutation as 32-bit integers 148| 114| int16_t pi[ 1 << GFBITS ]; // random permutation 149| | 150| 114| randombytes(seed + 1, 32); ------------------ | | 8| 114|#define randombytes OQS_randombytes ------------------ 151| | 152| 1.15k| while (1) { ------------------ | Branch (152:12): [True: 1.15k, Folded] ------------------ 153| 1.15k| rp = &r[ sizeof(r) - 32 ]; 154| 1.15k| skp = sk; 155| | 156| | // expanding and updating the seed 157| | 158| 1.15k| shake(r, sizeof(r), seed, 33); ------------------ | | 10| 1.15k| shake256(out, outlen, in, inlen) | | ------------------ | | | | 12| 1.15k|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 159| 1.15k| memcpy(skp, seed + 1, 32); 160| 1.15k| skp += 32 + 8; 161| 1.15k| memcpy(seed + 1, &r[ sizeof(r) - 32 ], 32); 162| | 163| | // generating irreducible polynomial 164| | 165| 1.15k| rp -= sizeof(f); 166| | 167| 138k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 138k|#define SYS_T 119 ------------------ | Branch (167:21): [True: 137k, False: 1.15k] ------------------ 168| 137k| f[i] = load_gf(rp + i * 2); 169| 137k| } 170| | 171| 1.15k| if (genpoly_gen(irr, f)) { ------------------ | | 9| 1.15k|#define genpoly_gen CRYPTO_NAMESPACE(genpoly_gen) | | ------------------ | | | | 4| 1.15k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ | Branch (171:13): [True: 0, False: 1.15k] ------------------ 172| 0| continue; 173| 0| } 174| | 175| 138k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 138k|#define SYS_T 119 ------------------ | Branch (175:21): [True: 137k, False: 1.15k] ------------------ 176| 137k| store_gf(skp + i * 2, irr[i]); 177| 137k| } 178| | 179| 1.15k| skp += IRR_BYTES; ------------------ | | 11| 1.15k|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 1.15k|#define SYS_T 119 | | ------------------ ------------------ 180| | 181| | // generating permutation 182| | 183| 1.15k| rp -= sizeof(perm); 184| | 185| 9.44M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 9.44M|#define GFBITS 13 ------------------ | Branch (185:21): [True: 9.44M, False: 1.15k] ------------------ 186| 9.44M| perm[i] = load4(rp + i * 4); 187| 9.44M| } 188| | 189| 1.15k| if (pk_gen(pk, skp - IRR_BYTES, perm, pi)) { ------------------ | | 9| 1.15k|#define pk_gen CRYPTO_NAMESPACE(pk_gen) | | ------------------ | | | | 4| 1.15k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ if (pk_gen(pk, skp - IRR_BYTES, perm, pi)) { ------------------ | | 11| 1.15k|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 1.15k|#define SYS_T 119 | | ------------------ ------------------ | Branch (189:13): [True: 1.03k, False: 114] ------------------ 190| 1.03k| continue; 191| 1.03k| } 192| | 193| 114| controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 10| 114|#define controlbitsfrompermutation CRYPTO_NAMESPACE(controlbitsfrompermutation) | | ------------------ | | | | 4| 114|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 114|#define GFBITS 13 ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 114|#define GFBITS 13 ------------------ 194| 114| skp += COND_BYTES; ------------------ | | 10| 114|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 114|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 114|#define GFBITS 13 | | ------------------ ------------------ 195| | 196| | // storing the random string s 197| | 198| 114| rp -= SYS_N / 8; ------------------ | | 7| 114|#define SYS_N 6960 ------------------ 199| 114| memcpy(skp, rp, SYS_N / 8); ------------------ | | 7| 114|#define SYS_N 6960 ------------------ 200| | 201| | // storing positions of the 32 pivots 202| | 203| 114| store8(sk + 32, 0xFFFFFFFF); 204| | 205| 114| break; 206| 1.15k| } 207| | 208| 114| return 0; 209| 114|} PQCLEAN_MCELIECE6960119_AVX2_pk_gen: 199| 1.15k|int pk_gen(unsigned char *pk, const unsigned char *irr, const uint32_t *perm, int16_t *pi) { 200| 1.15k|#define nBlocks_I ((PK_NROWS + 255) / 256) 201| 1.15k| const int head = PK_NROWS % 64; ------------------ | | 13| 1.15k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.15k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.15k|#define GFBITS 13 | | ------------------ ------------------ 202| 1.15k| const int tail = PK_NCOLS % 64; ------------------ | | 14| 1.15k|#define PK_NCOLS (SYS_N - PK_NROWS) | | ------------------ | | | | 7| 1.15k|#define SYS_N 6960 | | ------------------ | | #define PK_NCOLS (SYS_N - PK_NROWS) | | ------------------ | | | | 13| 1.15k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 1.15k|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 1.15k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 203| 1.15k| const uint64_t one = 1; 204| | 205| 1.15k| int i, j, k, b; 206| 1.15k| int row, c; 207| | 208| 1.15k| union { 209| 1.15k| uint64_t w[ PK_NROWS ][ nBlocks_I * 4 ]; 210| 1.15k| vec256 v[ PK_NROWS ][ nBlocks_I ]; 211| 1.15k| } mat; 212| | 213| 1.15k| union { 214| 1.15k| uint64_t w[ PK_NROWS ][ par_width * 4 ]; 215| 1.15k| vec256 v[ PK_NROWS ][ par_width ]; 216| 1.15k| } par; 217| | 218| 1.15k| uint16_t m; 219| 1.15k| vec256 mm; 220| | 221| 1.15k| vec128 sk_int[ GFBITS ]; 222| | 223| 1.15k| vec256 consts[ 32 ][ GFBITS ]; 224| 1.15k| vec256 eval[ 32 ][ GFBITS ]; 225| 1.15k| vec256 prod[ 32 ][ GFBITS ]; 226| 1.15k| vec256 tmp[ GFBITS ]; 227| | 228| 1.15k| uint64_t list[1 << GFBITS]; 229| 1.15k| uint64_t buf[ PK_NROWS ]; 230| 1.15k| uint64_t t; 231| | 232| 1.15k| uint16_t ind[ PK_NROWS ]; 233| 1.15k| uint16_t ind_inv[ PK_NROWS ]; 234| | 235| | // compute the inverses 236| | 237| 1.15k| irr_load(sk_int, irr); 238| | 239| 1.15k| fft(eval, sk_int); ------------------ | | 10| 1.15k|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 1.15k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 240| | 241| 1.15k| vec256_copy(prod[0], eval[0]); 242| | 243| 36.8k| for (i = 1; i < 32; i++) { ------------------ | Branch (243:17): [True: 35.7k, False: 1.15k] ------------------ 244| 35.7k| vec256_mul(prod[i], prod[i - 1], eval[i]); 245| 35.7k| } 246| | 247| 1.15k| vec256_inv(tmp, prod[31]); ------------------ | | 11| 1.15k|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 1.15k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 248| | 249| 36.8k| for (i = 30; i >= 0; i--) { ------------------ | Branch (249:18): [True: 35.7k, False: 1.15k] ------------------ 250| 35.7k| vec256_mul(prod[i + 1], prod[i], tmp); 251| 35.7k| vec256_mul(tmp, tmp, eval[i + 1]); 252| 35.7k| } 253| | 254| 1.15k| vec256_copy(prod[0], tmp); 255| | 256| | // fill matrix 257| | 258| 1.15k| de_bitslicing(list, prod); 259| | 260| 9.44M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 9.44M|#define GFBITS 13 ------------------ | Branch (260:17): [True: 9.44M, False: 1.15k] ------------------ 261| 9.44M| list[i] <<= GFBITS; ------------------ | | 6| 9.44M|#define GFBITS 13 ------------------ 262| 9.44M| list[i] |= i; 263| 9.44M| list[i] |= ((uint64_t) perm[i]) << 31; 264| 9.44M| } 265| | 266| 1.15k| uint64_sort(list, 1 << GFBITS); ------------------ | | 6| 1.15k|#define GFBITS 13 ------------------ 267| | 268| 9.28M| for (i = 1; i < (1 << GFBITS); i++) { ------------------ | | 6| 9.28M|#define GFBITS 13 ------------------ | Branch (268:17): [True: 9.27M, False: 1.11k] ------------------ 269| 9.27M| if (uint64_is_equal_declassify(list[i - 1] >> 31, list[i] >> 31)) { ------------------ | Branch (269:13): [True: 37, False: 9.27M] ------------------ 270| 37| return -1; 271| 37| } 272| 9.27M| } 273| | 274| 1.11k| to_bitslicing_2x(consts, prod, list); 275| | 276| 9.14M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 9.14M|#define GFBITS 13 ------------------ | Branch (276:17): [True: 9.14M, False: 1.11k] ------------------ 277| 9.14M| pi[i] = list[i] & GFMASK; ------------------ | | 19| 9.14M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 9.14M|#define GFBITS 13 | | ------------------ ------------------ 278| 9.14M| } 279| | 280| 8.92k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 200| 8.92k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 8.92k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 8.92k|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 8.92k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (280:17): [True: 7.81k, False: 1.11k] ------------------ 281| 109k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 109k|#define GFBITS 13 ------------------ | Branch (281:21): [True: 101k, False: 7.81k] ------------------ 282| 101k| mat.v[ k ][ j ] = prod[ j ][ k ]; 283| 101k| } 284| 7.81k| } 285| | 286| 132k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 132k|#define SYS_T 119 ------------------ | Branch (286:17): [True: 131k, False: 1.11k] ------------------ 287| 1.05M| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 200| 1.05M|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 1.05M|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 1.05M|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 1.05M|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (287:21): [True: 921k, False: 131k] ------------------ 288| 921k| vec256_mul(prod[j], prod[j], consts[j]); 289| | 290| 12.9M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 12.9M|#define GFBITS 13 ------------------ | Branch (290:25): [True: 11.9M, False: 921k] ------------------ 291| 11.9M| mat.v[ i * GFBITS + k ][ j ] = prod[ j ][ k ]; ------------------ | | 6| 11.9M|#define GFBITS 13 ------------------ 292| 11.9M| } 293| 921k| } 294| 131k| } 295| | 296| | // gaussian elimination to obtain L, U, and P such that LP M = U 297| | // L and U are stored in the space of M 298| | // P is stored in ind 299| | 300| 1.72M| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 1.72M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.72M|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.72M|#define GFBITS 13 | | ------------------ ------------------ | Branch (300:17): [True: 1.72M, False: 1.11k] ------------------ 301| 1.72M| ind_inv[i] = ind[ i ] = i; 302| 1.72M| } 303| | 304| 1.72M| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 1.72M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.72M|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.72M|#define GFBITS 13 | | ------------------ ------------------ | Branch (304:19): [True: 1.72M, False: 114] ------------------ 305| 1.72M| i = row >> 6; 306| 1.72M| j = row & 63; 307| | 308| 1.33G| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 1.33G|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.33G|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.33G|#define GFBITS 13 | | ------------------ ------------------ | Branch (308:27): [True: 1.33G, False: 1.72M] ------------------ 309| 1.33G| extract_01_masks(&m, mat.w[ row ], mat.w[ k ], row); 310| 1.33G| uint16_cswap(&ind[row], &ind[k], m); 311| | 312| 1.33G| mm = vec256_set1_16b(m); 313| 10.6G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 200| 10.6G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 10.6G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 10.6G|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 10.6G|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (313:25): [True: 9.34G, False: 1.33G] ------------------ 314| 9.34G| vec256_cswap(&mat.v[ row ][ c ], &mat.v[ k ][ c ], mm); 315| 9.34G| } 316| 1.33G| } 317| | 318| 1.72M| if ( uint64_is_zero_declassify((mat.w[ row ][ i ] >> j) & 1) ) { // return if not systematic ------------------ | Branch (318:14): [True: 1.00k, False: 1.72M] ------------------ 319| 1.00k| return -1; 320| 1.00k| } 321| | 322| 1.33G| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 1.33G|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.33G|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.33G|#define GFBITS 13 | | ------------------ ------------------ | Branch (322:27): [True: 1.33G, False: 1.72M] ------------------ 323| 1.33G| t = mat.w[ k ][ i ] & (one << j); 324| 1.33G| mm = extract_mask256(mat.w[k], row); 325| | 326| 10.6G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 200| 10.6G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 10.6G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 10.6G|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 10.6G|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (326:25): [True: 9.34G, False: 1.33G] ------------------ 327| 9.34G| mat.v[ k ][ c ] ^= mat.v[ row ][ c ] & mm; 328| 9.34G| } 329| | 330| 1.33G| mat.w[ k ][ i ] |= t; 331| 1.33G| } 332| 1.72M| } 333| | 334| | // apply M^-1 to the remaining columns 335| | 336| 114| composeinv(PK_NROWS, ind_inv, ind_inv, ind); ------------------ | | 13| 114|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 114|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 114|#define GFBITS 13 | | ------------------ ------------------ 337| | 338| 342| for (j = 6; j < 28; j += par_width) { ------------------ | | 30| 228|#define par_width 11 ------------------ | Branch (338:17): [True: 228, False: 114] ------------------ 339| 3.19k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 3.19k|#define GFBITS 13 ------------------ | Branch (339:21): [True: 2.96k, False: 228] ------------------ 340| 35.5k| for (b = 0; b < par_width; b++) { ------------------ | | 30| 35.5k|#define par_width 11 ------------------ | Branch (340:25): [True: 32.6k, False: 2.96k] ------------------ 341| 32.6k| par.v[ k ][ b ] = prod[ j + b ][ k ]; 342| 32.6k| } 343| 2.96k| } 344| | 345| 27.1k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 27.1k|#define SYS_T 119 ------------------ | Branch (345:21): [True: 26.9k, False: 228] ------------------ 346| 322k| for (b = 0; b < par_width; b++) { ------------------ | | 30| 322k|#define par_width 11 ------------------ | Branch (346:25): [True: 295k, False: 26.9k] ------------------ 347| 295k| vec256_mul(prod[j + b], prod[j + b], consts[j + b]); 348| 295k| } 349| | 350| 376k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 376k|#define GFBITS 13 ------------------ | Branch (350:25): [True: 349k, False: 26.9k] ------------------ 351| 4.19M| for (b = 0; b < par_width; b++) { ------------------ | | 30| 4.19M|#define par_width 11 ------------------ | Branch (351:29): [True: 3.84M, False: 349k] ------------------ 352| 3.84M| par.v[ i * GFBITS + k ][ b ] = prod[ j + b ][ k ]; ------------------ | | 6| 3.84M|#define GFBITS 13 ------------------ 353| 3.84M| } 354| 349k| } 355| 26.9k| } 356| | 357| | // apply P 358| | 359| 352k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 352k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 352k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 352k|#define GFBITS 13 | | ------------------ ------------------ | Branch (359:21): [True: 352k, False: 228] ------------------ 360| 352k| ind[i] = ind_inv[i]; 361| 352k| } 362| | 363| 228| sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 6| 228|#define GFBITS 13 ------------------ sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 13| 228|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 228|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 228|#define GFBITS 13 | | ------------------ ------------------ 364| | 365| | // apply L 366| | 367| 352k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 228|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 228|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 228|#define GFBITS 13 | | ------------------ ------------------ | Branch (367:34): [True: 352k, False: 228] ------------------ 368| 273M| for (i = row - 1; i >= 0; i--) { ------------------ | Branch (368:31): [True: 272M, False: 352k] ------------------ 369| 272M| mm = extract_mask256(mat.w[row], i); 370| | 371| 3.27G| for (k = 0; k < par_width; k++) { ------------------ | | 30| 3.27G|#define par_width 11 ------------------ | Branch (371:29): [True: 2.99G, False: 272M] ------------------ 372| 2.99G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 373| 2.99G| } 374| 272M| } 375| 352k| } 376| | 377| | // apply U^-1 378| | 379| 228| if (j == 6) { ------------------ | Branch (379:13): [True: 114, False: 114] ------------------ 380| 176k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 176k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 176k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 176k|#define GFBITS 13 | | ------------------ ------------------ | Branch (380:25): [True: 176k, False: 114] ------------------ 381| 176k| par.v[i][0] = mat.v[i][nBlocks_I - 1]; ------------------ | | 200| 176k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 176k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 176k|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 176k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 382| 176k| } 383| 114| } 384| | 385| 352k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 228|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 228|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 228|#define GFBITS 13 | | ------------------ ------------------ | Branch (385:34): [True: 352k, False: 228] ------------------ 386| 273M| for (i = PK_NROWS - 1; i > row; i--) { ------------------ | | 13| 352k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 352k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 352k|#define GFBITS 13 | | ------------------ ------------------ | Branch (386:36): [True: 272M, False: 352k] ------------------ 387| 272M| mm = extract_mask256(mat.w[row], i); 388| | 389| 3.27G| for (k = 0; k < par_width; k++) { ------------------ | | 30| 3.27G|#define par_width 11 ------------------ | Branch (389:29): [True: 2.99G, False: 272M] ------------------ 390| 2.99G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 391| 2.99G| } 392| 272M| } 393| 352k| } 394| | 395| 228| if (j == 6) { ------------------ | Branch (395:13): [True: 114, False: 114] ------------------ 396| 176k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 176k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 176k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 176k|#define GFBITS 13 | | ------------------ ------------------ | Branch (396:27): [True: 176k, False: 114] ------------------ 397| 7.75M| for (i = 0; i < 43; i++) { ------------------ | Branch (397:29): [True: 7.58M, False: 176k] ------------------ 398| 7.58M| store8(pk + PK_ROW_BYTES * row + i * 8, (par.w[row][i] >> head) | (par.w[row][i + 1] << (64 - head))); ------------------ | | 15| 7.58M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 7.58M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 7.58M|#define SYS_N 6960 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 7.58M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 7.58M|#define SYS_T 119 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 7.58M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 399| 7.58M| } 400| | 401| 176k| buf[row] = par.w[row][i] >> head; 402| 176k| } 403| 114| } else { 404| 176k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 176k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 176k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 176k|#define GFBITS 13 | | ------------------ ------------------ | Branch (404:27): [True: 176k, False: 114] ------------------ 405| 176k| store8(pk + PK_ROW_BYTES * row + 43 * 8, buf[row] | (par.w[row][0] << (64 - head))); ------------------ | | 15| 176k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 176k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 176k|#define SYS_N 6960 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 176k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 176k|#define SYS_T 119 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 176k|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 406| | 407| 7.23M| for (i = 0; i < 40; i++) { ------------------ | Branch (407:29): [True: 7.05M, False: 176k] ------------------ 408| 7.05M| store8(pk + PK_ROW_BYTES * row + (i + 44) * 8, (par.w[row][i] >> head) | (par.w[row][i + 1] << (64 - head))); ------------------ | | 15| 7.05M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 7.05M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 7.05M|#define SYS_N 6960 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 7.05M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 7.05M|#define SYS_T 119 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 7.05M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 409| 7.05M| } 410| | 411| 176k| par.w[row][i] >>= head; 412| 176k| par.w[row][i] &= (one << tail) - 1; 413| | 414| 176k| store_i(pk + PK_ROW_BYTES * row + (i + 44) * 8, par.w[row][i], (tail + 7) / 8); ------------------ | | 15| 176k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 176k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 176k|#define SYS_N 6960 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 176k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 176k|#define SYS_T 119 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 176k|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 415| 176k| } 416| 114| } 417| 228| } 418| | 419| | // 420| | 421| 114| return 0; 422| 1.11k|} PQCLEAN_MCELIECE6960119_AVX2_genpoly_gen: 88| 1.15k|int genpoly_gen(gf *out, gf *f) { 89| 1.15k| int i, j, k; 90| | 91| 1.15k| gf t, inv; 92| | 93| 1.15k| uint64_t m; 94| 1.15k| vec128 mask; 95| | 96| 1.15k| union { 97| 1.15k| uint64_t d[ GFBITS ][ 128 ][2]; 98| 1.15k| vec128 v[ GFBITS ][ 128 ]; 99| 1.15k| } buf; 100| | 101| 1.15k| union { 102| 1.15k| uint64_t d[GFBITS][2]; 103| 1.15k| vec128 v[GFBITS]; 104| 1.15k| } v; 105| | 106| 1.15k| union { 107| 1.15k| uint64_t d[SYS_T][GFBITS][2]; 108| 1.15k| vec128 v[SYS_T][GFBITS]; 109| 1.15k| } mat; 110| | 111| | // fill matrix 112| | 113| 1.15k| buf.v[0][0] = vec128_set2x(1, 0); 114| 14.9k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 14.9k|#define GFBITS 13 ------------------ | Branch (114:17): [True: 13.8k, False: 1.15k] ------------------ 115| 13.8k| buf.v[i][0] = vec128_setzero(); 116| 13.8k| } 117| | 118| 16.1k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 16.1k|#define GFBITS 13 ------------------ | Branch (118:17): [True: 14.9k, False: 1.15k] ------------------ 119| 14.9k| v.v[j] = vec128_setzero(); 120| | 121| 1.79M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 14.9k|#define SYS_T 119 ------------------ | Branch (121:29): [True: 1.78M, False: 14.9k] ------------------ 122| 1.78M| v.d[j][1] <<= 1; 123| 1.78M| v.d[j][1] |= v.d[j][0] >> 63; 124| 1.78M| v.d[j][0] <<= 1; 125| 1.78M| v.d[j][0] |= (f[i] >> j) & 1; 126| 1.78M| } 127| 14.9k| } 128| | 129| 16.1k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 16.1k|#define GFBITS 13 ------------------ | Branch (129:17): [True: 14.9k, False: 1.15k] ------------------ 130| 14.9k| buf.v[i][1] = v.v[i]; 131| 14.9k| } 132| | 133| 137k| for (k = 2; k <= SYS_T; k++) { ------------------ | | 8| 137k|#define SYS_T 119 ------------------ | Branch (133:17): [True: 136k, False: 1.15k] ------------------ 134| 136k| vec128_mul_GF(v.v, v.v, f); ------------------ | | 11| 136k|#define vec128_mul_GF CRYPTO_NAMESPACE(vec128_mul_GF) | | ------------------ | | | | 4| 136k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 135| | 136| 136k| if (k < SYS_T) { ------------------ | | 8| 136k|#define SYS_T 119 ------------------ | Branch (136:13): [True: 134k, False: 1.15k] ------------------ 137| 1.88M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.88M|#define GFBITS 13 ------------------ | Branch (137:25): [True: 1.75M, False: 134k] ------------------ 138| 1.75M| buf.v[i][k] = v.v[i]; 139| 1.75M| } 140| 134k| } else { 141| 138k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 138k|#define SYS_T 119 ------------------ | Branch (141:25): [True: 137k, False: 1.15k] ------------------ 142| 137k| out[i] = extract_gf(v.d, i); 143| 137k| } 144| 1.15k| } 145| 136k| } 146| | 147| 16.1k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 16.1k|#define GFBITS 13 ------------------ | Branch (147:17): [True: 14.9k, False: 1.15k] ------------------ 148| 14.9k| transpose_128x128(buf.d[i]); 149| 14.9k| } 150| | 151| 138k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 138k|#define SYS_T 119 ------------------ | Branch (151:17): [True: 137k, False: 1.15k] ------------------ 152| 1.92M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.92M|#define GFBITS 13 ------------------ | Branch (152:21): [True: 1.78M, False: 137k] ------------------ 153| 1.78M| mat.v[j][i] = buf.v[i][j]; 154| 1.78M| } 155| 137k| } 156| | 157| | // gaussian 158| | 159| 138k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 138k|#define SYS_T 119 ------------------ | Branch (159:17): [True: 137k, False: 1.15k] ------------------ 160| 8.23M| for (j = i + 1; j < SYS_T; j++) { ------------------ | | 8| 8.23M|#define SYS_T 119 ------------------ | Branch (160:25): [True: 8.09M, False: 137k] ------------------ 161| 8.09M| m = extract_bit(mat.d[i], i); 162| 8.09M| m -= 1; 163| 8.09M| mask = vec128_set2x(m, m); 164| | 165| 113M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 113M|#define GFBITS 13 ------------------ | Branch (165:25): [True: 105M, False: 8.09M] ------------------ 166| 105M| mat.v[i][k] ^= mat.v[j][k] & mask; 167| 105M| } 168| | 169| 8.09M| out[i] ^= out[j] & m; 170| 8.09M| } 171| | 172| | // 173| | 174| 137k| t = extract_gf(mat.d[i], i); 175| | 176| 137k| if (gf_is_zero_declassify(t)) { ------------------ | Branch (176:13): [True: 0, False: 137k] ------------------ 177| 0| return -1; // return if not systematic 178| 0| } 179| | 180| | // 181| | 182| 137k| inv = gf_inv(t); ------------------ | | 11| 137k|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 137k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 183| 137k| vec128_mul_gf(mat.v[i], mat.v[i], inv); 184| | 185| 137k| out[i] = gf_mul(out[i], inv); ------------------ | | 14| 137k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 137k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 186| | 187| 16.4M| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 16.4M|#define SYS_T 119 ------------------ | Branch (187:21): [True: 16.3M, False: 137k] ------------------ 188| 16.3M| if (j != i) { ------------------ | Branch (188:17): [True: 16.1M, False: 137k] ------------------ 189| 16.1M| t = extract_gf(mat.d[j], i); 190| | 191| 16.1M| vec128_mul_gf(v.v, mat.v[i], t); 192| 16.1M| vec128_add(mat.v[j], mat.v[j], v.v); 193| | 194| 16.1M| out[j] ^= gf_mul(out[i], t); ------------------ | | 14| 16.1M|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 16.1M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 195| 16.1M| } 196| 16.3M| } 197| 137k| } 198| | 199| 1.15k| return 0; 200| 1.15k|} PQCLEAN_MCELIECE6960119_AVX2_vec128_mul_GF: 6| 136k|void vec128_mul_GF(vec128 out[ GFBITS ], vec128 v[ GFBITS ], gf a[ SYS_T ]) { 7| 136k| int i, j; 8| 136k| uint64_t buf[GFBITS][4]; 9| 136k| vec128 prod[GFBITS]; 10| 136k| uint64_t p[GFBITS]; 11| | 12| 136k| const uint64_t allone = -1; 13| | 14| | // polynomial multiplication 15| | 16| 1.90M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.90M|#define GFBITS 13 ------------------ | Branch (16:17): [True: 1.76M, False: 136k] ------------------ 17| 1.76M| buf[i][0] = 0; 18| 1.76M| buf[i][1] = 0; 19| 1.76M| buf[i][2] = 0; 20| 1.76M| buf[i][3] = 0; 21| 1.76M| } 22| | 23| 16.3M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 136k|#define SYS_T 119 ------------------ | Branch (23:25): [True: 16.1M, False: 136k] ------------------ 24| 226M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 226M|#define GFBITS 13 ------------------ | Branch (24:21): [True: 210M, False: 16.1M] ------------------ 25| 210M| buf[j][3] <<= 1; 26| 210M| buf[j][3] |= buf[j][2] >> 63; 27| 210M| buf[j][2] <<= 1; 28| 210M| buf[j][2] |= buf[j][1] >> 63; 29| 210M| buf[j][1] <<= 1; 30| 210M| buf[j][1] |= buf[j][0] >> 63; 31| 210M| buf[j][0] <<= 1; 32| 210M| } 33| | 34| 16.1M| vec128_mul_gf(prod, v, a[i]); 35| | 36| 226M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 226M|#define GFBITS 13 ------------------ | Branch (36:21): [True: 210M, False: 16.1M] ------------------ 37| 210M| buf[j][0] ^= vec128_extract(prod[j], 0); ------------------ | | 29| 210M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 38| 210M| buf[j][1] ^= vec128_extract(prod[j], 1); ------------------ | | 29| 210M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 39| 210M| } 40| 16.1M| } 41| | 42| | // reduction modulo y^119 + y^8 + 1 43| | 44| 1.90M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.90M|#define GFBITS 13 ------------------ | Branch (44:17): [True: 1.76M, False: 136k] ------------------ 45| 1.76M| p[i] = buf[i][3]; 46| | 47| 1.76M| buf[i][2] ^= p[i] >> (SYS_T - 8 - 64); ------------------ | | 8| 1.76M|#define SYS_T 119 ------------------ 48| 1.76M| buf[i][1] ^= p[i] << (64 - (SYS_T - 8 - 64)); ------------------ | | 8| 1.76M|#define SYS_T 119 ------------------ 49| 1.76M| buf[i][2] ^= p[i] >> (SYS_T - 64); ------------------ | | 8| 1.76M|#define SYS_T 119 ------------------ 50| 1.76M| buf[i][1] ^= p[i] << (64 - (SYS_T - 64)); ------------------ | | 8| 1.76M|#define SYS_T 119 ------------------ 51| 1.76M| } 52| | 53| | // 54| | 55| 1.90M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.90M|#define GFBITS 13 ------------------ | Branch (55:17): [True: 1.76M, False: 136k] ------------------ 56| 1.76M| p[i] = buf[i][2]; 57| | 58| 1.76M| buf[i][1] ^= p[i] >> (SYS_T - 8 - 64); ------------------ | | 8| 1.76M|#define SYS_T 119 ------------------ 59| 1.76M| buf[i][0] ^= p[i] << (64 - (SYS_T - 8 - 64)); ------------------ | | 8| 1.76M|#define SYS_T 119 ------------------ 60| 1.76M| buf[i][1] ^= p[i] >> (SYS_T - 64); ------------------ | | 8| 1.76M|#define SYS_T 119 ------------------ 61| 1.76M| buf[i][0] ^= p[i] << (64 - (SYS_T - 64)); ------------------ | | 8| 1.76M|#define SYS_T 119 ------------------ 62| 1.76M| } 63| | 64| | // 65| | 66| 1.90M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.90M|#define GFBITS 13 ------------------ | Branch (66:17): [True: 1.76M, False: 136k] ------------------ 67| 1.76M| p[i] = buf[i][1] & (allone << (SYS_T - 64)); ------------------ | | 8| 1.76M|#define SYS_T 119 ------------------ 68| | 69| 1.76M| buf[i][0] ^= p[i] >> (SYS_T - 8 - 64); ------------------ | | 8| 1.76M|#define SYS_T 119 ------------------ 70| 1.76M| buf[i][0] ^= p[i] >> (SYS_T - 64); ------------------ | | 8| 1.76M|#define SYS_T 119 ------------------ 71| 1.76M| } 72| | 73| | // 74| | 75| 1.90M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.90M|#define GFBITS 13 ------------------ | Branch (75:17): [True: 1.76M, False: 136k] ------------------ 76| 1.76M| out[i] = vec128_set2x(buf[i][0], buf[i][1] & (allone >> (128 - SYS_T))); ------------------ | | 8| 1.76M|#define SYS_T 119 ------------------ 77| 1.76M| } 78| 136k|} PQCLEAN_MCELIECE6960119_AVX2_vec256_sq: 9| 18.8k|void vec256_sq(vec256 *out, vec256 *in) { 10| 18.8k| int i; 11| 18.8k| vec256 result[GFBITS], t; 12| | 13| 18.8k| t = vec256_xor(in[11], in[12]); 14| | 15| 18.8k| result[0] = vec256_xor(in[0], in[11]); 16| 18.8k| result[1] = vec256_xor(in[7], t); 17| 18.8k| result[2] = vec256_xor(in[1], in[7]); 18| 18.8k| result[3] = vec256_xor(in[8], t); 19| 18.8k| result[4] = vec256_xor(in[2], in[7]); 20| 18.8k| result[4] = vec256_xor(result[4], in[8]); 21| 18.8k| result[4] = vec256_xor(result[4], t); 22| 18.8k| result[5] = vec256_xor(in[7], in[9]); 23| 18.8k| result[6] = vec256_xor(in[3], in[8]); 24| 18.8k| result[6] = vec256_xor(result[6], in[9]); 25| 18.8k| result[6] = vec256_xor(result[6], in[12]); 26| 18.8k| result[7] = vec256_xor(in[8], in[10]); 27| 18.8k| result[8] = vec256_xor(in[4], in[9]); 28| 18.8k| result[8] = vec256_xor(result[8], in[10]); 29| 18.8k| result[9] = vec256_xor(in[9], in[11]); 30| 18.8k| result[10] = vec256_xor(in[5], in[10]); 31| 18.8k| result[10] = vec256_xor(result[10], in[11]); 32| 18.8k| result[11] = vec256_xor(in[10], in[12]); 33| 18.8k| result[12] = vec256_xor(in[6], t); 34| | 35| 263k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 263k|#define GFBITS 13 ------------------ | Branch (35:17): [True: 245k, False: 18.8k] ------------------ 36| 245k| out[i] = result[i]; 37| 245k| } 38| 18.8k|} PQCLEAN_MCELIECE6960119_AVX2_vec256_inv: 41| 1.26k|void vec256_inv(vec256 *out, vec256 *in) { 42| 1.26k| vec256 tmp_11[ GFBITS ]; 43| 1.26k| vec256 tmp_1111[ GFBITS ]; 44| | 45| 1.26k| vec256_copy(out, in); 46| | 47| 1.26k| vec256_sq(out, out); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 48| 1.26k| vec256_mul(tmp_11, out, in); // ^11 49| | 50| 1.26k| vec256_sq(out, tmp_11); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 51| 1.26k| vec256_sq(out, out); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 52| 1.26k| vec256_mul(tmp_1111, out, tmp_11); // ^1111 53| | 54| 1.26k| vec256_sq(out, tmp_1111); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 55| 1.26k| vec256_sq(out, out); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 56| 1.26k| vec256_sq(out, out); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 57| 1.26k| vec256_sq(out, out); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 58| 1.26k| vec256_mul(out, out, tmp_1111); // ^11111111 59| | 60| 1.26k| vec256_sq(out, out); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 61| 1.26k| vec256_sq(out, out); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 62| 1.26k| vec256_sq(out, out); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 63| 1.26k| vec256_sq(out, out); ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 64| 1.26k| vec256_mul(out, out, tmp_1111); // ^111111111111 65| | 66| 1.26k| vec256_sq(out, out); // ^1111111111110 ------------------ | | 14| 1.26k|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 1.26k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119_AVX2_ ## fun | | ------------------ ------------------ 67| 1.26k|} operations.c:check_pk_padding: 19| 202|static int check_pk_padding(const unsigned char *pk) { 20| 202| unsigned char b; 21| 202| int i, ret; 22| | 23| 202| b = 0; 24| 312k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 312k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 312k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 312k|#define GFBITS 13 | | ------------------ ------------------ | Branch (24:17): [True: 312k, False: 202] ------------------ 25| 312k| b |= pk[i * PK_ROW_BYTES + PK_ROW_BYTES - 1]; ------------------ | | 15| 312k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 312k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 312k|#define SYS_N 6960 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 312k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 312k|#define SYS_T 119 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 312k|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ b |= pk[i * PK_ROW_BYTES + PK_ROW_BYTES - 1]; ------------------ | | 15| 312k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 312k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 312k|#define SYS_N 6960 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 312k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 312k|#define SYS_T 119 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 312k|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 26| 312k| } 27| | 28| 202| b >>= (PK_NCOLS % 8); ------------------ | | 14| 202|#define PK_NCOLS (SYS_N - PK_NROWS) | | ------------------ | | | | 7| 202|#define SYS_N 6960 | | ------------------ | | #define PK_NCOLS (SYS_N - PK_NROWS) | | ------------------ | | | | 13| 202|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 202|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 202|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 29| 202| b -= 1; 30| 202| b >>= 7; 31| 202| ret = b; 32| | 33| 202| return ret - 1; 34| 202|} operations.c:check_c_padding: 74| 202|static int check_c_padding(const unsigned char *c) { 75| 202| unsigned char b; 76| 202| int ret; 77| | 78| 202| b = c[ SYND_BYTES - 1 ] >> (PK_NROWS % 8); ------------------ | | 17| 202|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 202|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 202|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 202|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ b = c[ SYND_BYTES - 1 ] >> (PK_NROWS % 8); ------------------ | | 13| 202|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 202|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 202|#define GFBITS 13 | | ------------------ ------------------ 79| 202| b -= 1; 80| 202| b >>= 7; 81| 202| ret = b; 82| | 83| 202| return ret - 1; 84| 202|} PQCLEAN_MCELIECE6960119F_AVX2_load_bits: 188| 88|void load_bits(vec128 bits_int[][32], const unsigned char *bits) { 189| 88| int i, j; 190| 88| const unsigned char *ptr = bits; 191| | 192| 88| vec128 buf[64]; 193| | 194| 352| for (i = 0; i <= 5; i += 2) { ------------------ | Branch (194:17): [True: 264, False: 88] ------------------ 195| 17.1k| for (j = 0; j < 64; j++) { ------------------ | Branch (195:21): [True: 16.8k, False: 264] ------------------ 196| 16.8k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 197| 16.8k| ptr += 8; 198| 16.8k| } 199| | 200| 264| transpose_64x128_sp( buf ); 201| | 202| 8.71k| for (j = 0; j < 32; j++) { ------------------ | Branch (202:21): [True: 8.44k, False: 264] ------------------ 203| 8.44k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 204| 8.44k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 205| 8.44k| } 206| | 207| 264| ptr += 512; 208| 264| } 209| | 210| 1.23k| for (i = 6; i <= 18; i++) { ------------------ | Branch (210:17): [True: 1.14k, False: 88] ------------------ 211| 37.7k| for (j = 0; j < 32; j++) { ------------------ | Branch (211:21): [True: 36.6k, False: 1.14k] ------------------ 212| 36.6k| bits_int[i][j] = load16(ptr); 213| 36.6k| ptr += 16; 214| 36.6k| } 215| 1.14k| } 216| | 217| 352| for (i = 19; i < 25; i += 2) { ------------------ | Branch (217:18): [True: 264, False: 88] ------------------ 218| 17.1k| for (j = 0; j < 64; j++) { ------------------ | Branch (218:21): [True: 16.8k, False: 264] ------------------ 219| 16.8k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 220| 16.8k| ptr += 8; 221| 16.8k| } 222| | 223| 264| transpose_64x128_sp( buf ); 224| | 225| 8.71k| for (j = 0; j < 32; j++) { ------------------ | Branch (225:21): [True: 8.44k, False: 264] ------------------ 226| 8.44k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 227| 8.44k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 228| 8.44k| } 229| | 230| 264| ptr += 512; 231| 264| } 232| 88|} PQCLEAN_MCELIECE6960119F_AVX2_benes: 238| 176|void benes(vec128 *r, vec128 b[][32], int rev) { 239| 176| int inc; 240| | 241| 176| vec128 *b_ptr; 242| | 243| 176| if (rev == 0) { ------------------ | Branch (243:9): [True: 88, False: 88] ------------------ 244| 88| inc = 32; 245| 88| b_ptr = b[ 0]; 246| 88| } else { 247| 88| inc = -32; 248| 88| b_ptr = b[24]; 249| 88| } 250| | 251| | // 252| | 253| 176| transpose_64x128_sp( r ); 254| | 255| 176| layer_0(r, b_ptr); 256| 176| b_ptr += inc; 257| 176| layer_1(r, b_ptr); 258| 176| b_ptr += inc; 259| 176| layer_2(r, b_ptr); 260| 176| b_ptr += inc; 261| 176| layer_3(r, b_ptr); 262| 176| b_ptr += inc; 263| 176| layer_4(r, b_ptr); 264| 176| b_ptr += inc; 265| 176| layer_5(r, b_ptr); 266| 176| b_ptr += inc; 267| | 268| 176| transpose_64x128_sp( r ); 269| | 270| 176| layer_x(r, b_ptr); 271| 176| b_ptr += inc; 272| 176| layer_0(r, b_ptr); 273| 176| b_ptr += inc; 274| 176| layer_1(r, b_ptr); 275| 176| b_ptr += inc; 276| 176| layer_2(r, b_ptr); 277| 176| b_ptr += inc; 278| 176| layer_3(r, b_ptr); 279| 176| b_ptr += inc; 280| 176| layer_4(r, b_ptr); 281| 176| b_ptr += inc; 282| 176| layer_5(r, b_ptr); 283| 176| b_ptr += inc; 284| 176| layer_4(r, b_ptr); 285| 176| b_ptr += inc; 286| 176| layer_3(r, b_ptr); 287| 176| b_ptr += inc; 288| 176| layer_2(r, b_ptr); 289| 176| b_ptr += inc; 290| 176| layer_1(r, b_ptr); 291| 176| b_ptr += inc; 292| 176| layer_0(r, b_ptr); 293| 176| b_ptr += inc; 294| 176| layer_x(r, b_ptr); 295| 176| b_ptr += inc; 296| | 297| 176| transpose_64x128_sp( r ); 298| | 299| 176| layer_5(r, b_ptr); 300| 176| b_ptr += inc; 301| 176| layer_4(r, b_ptr); 302| 176| b_ptr += inc; 303| 176| layer_3(r, b_ptr); 304| 176| b_ptr += inc; 305| 176| layer_2(r, b_ptr); 306| 176| b_ptr += inc; 307| 176| layer_1(r, b_ptr); 308| 176| b_ptr += inc; 309| 176| layer_0(r, b_ptr); 310| | 311| 176| transpose_64x128_sp( r ); 312| 176|} PQCLEAN_MCELIECE6960119F_AVX2_bm: 147| 88|void bm(vec128 *out, vec256 *in) { 148| 88| int i; 149| 88| uint16_t N, L; 150| 88| uint16_t mask; 151| 88| uint64_t one = 1; 152| 88| uint64_t v[2]; 153| | 154| 88| vec128 prod[ GFBITS ]; 155| 88| vec128 interval[GFBITS]; 156| | 157| 88| typedef union { 158| 88| vec128 v[GFBITS][2]; 159| 88| vec256 V[GFBITS]; 160| 88| } db_t; 161| | 162| 88| db_t db; 163| 88| db_t BC_tmp; 164| 88| db_t BC; 165| | 166| 88| gf d, b; 167| 88| gf coefs[256]; 168| | 169| | // initialization 170| | 171| 88| get_coefs(coefs, in); 172| | 173| 88| BC.v[0][0] = vec128_set2x(0, one << 62); 174| 88| BC.v[0][1] = vec128_set2x(0, one << 63); 175| | 176| 1.14k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.14k|#define GFBITS 13 ------------------ | Branch (176:17): [True: 1.05k, False: 88] ------------------ 177| 1.05k| BC.v[i][0] = BC.v[i][1] = vec128_setzero(); 178| 1.05k| } 179| | 180| 88| b = 1; 181| 88| L = 0; 182| | 183| | // 184| | 185| 1.23k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.23k|#define GFBITS 13 ------------------ | Branch (185:17): [True: 1.14k, False: 88] ------------------ 186| 1.14k| interval[i] = vec128_setzero(); 187| 1.14k| } 188| | 189| 21.0k| for (N = 0; N < SYS_T * 2; N++) { ------------------ | | 8| 21.0k|#define SYS_T 119 ------------------ | Branch (189:17): [True: 20.9k, False: 88] ------------------ 190| 20.9k| update_asm(interval, coefs[N], 16); ------------------ | | 1| 20.9k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 20.9k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 191| 20.9k| vec128_mul_asm(prod, interval, BC.v[0] + 1, 32); ------------------ | | 10| 20.9k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 20.9k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 192| | 193| 20.9k| d = vec_reduce_asm(prod); ------------------ | | 3| 20.9k|#define vec_reduce_asm CRYPTO_NAMESPACE(vec_reduce_asm) | | ------------------ | | | | 4| 20.9k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 194| | 195| 20.9k| mask = mask_nonzero(d) & mask_leq(L * 2, N); 196| | 197| 293k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 293k|#define GFBITS 13 ------------------ | Branch (197:21): [True: 272k, False: 20.9k] ------------------ 198| 272k| db.v[i][0] = vec128_setbits((d >> i) & 1); 199| 272k| db.v[i][1] = vec128_setbits((b >> i) & 1); 200| 272k| } 201| | 202| 20.9k| vec256_mul((vec256 *) BC_tmp.V, (vec256 *) db.V, (vec256 *) BC.V); 203| | 204| 20.9k| vec128_cmov(BC.v, mask); 205| 20.9k| update_asm(BC.v, 0, 32); ------------------ | | 1| 20.9k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 20.9k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 293k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 293k|#define GFBITS 13 ------------------ | Branch (207:21): [True: 272k, False: 20.9k] ------------------ 208| 272k| BC.v[i][1] = vec128_xor(BC_tmp.v[i][0], BC_tmp.v[i][1]); 209| 272k| } 210| | 211| 20.9k| b = (d & mask) | (b & ~mask); 212| 20.9k| L = ((N + 1 - L) & mask) | (L & ~mask); 213| 20.9k| } 214| | 215| 1.23k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.23k|#define GFBITS 13 ------------------ | Branch (215:17): [True: 1.14k, False: 88] ------------------ 216| 1.14k| v[0] = vec128_extract(BC.v[i][1], 0); ------------------ | | 29| 1.14k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 217| 1.14k| v[1] = vec128_extract(BC.v[i][1], 1); ------------------ | | 29| 1.14k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 218| | 219| 1.14k| out[i] = vec128_set2x((v[0] >> 8) | (v[1] << 56), v[1] >> 8); 220| 1.14k| } 221| 88|} PQCLEAN_MCELIECE6960119F_AVX2_controlbitsfrompermutation: 205| 88|void controlbitsfrompermutation(unsigned char *out, const int16 *pi, long long w, long long n) { 206| 88| PQCLEAN_VLA(int32, temp, (size_t)(2 * n)); ------------------ | | 57| 88|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 207| 88| PQCLEAN_VLA(int16, pi_test, (size_t)n); ------------------ | | 57| 88|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 208| 88| int16 diff; 209| 88| int i; 210| 88| unsigned char *ptr; 211| | 212| 88| OQS_MEM_cleanse(temp, (size_t)n * 2); 213| 88| OQS_MEM_cleanse(pi_test, (size_t)n); 214| | 215| 88| while (1) { ------------------ | Branch (215:12): [True: 88, Folded] ------------------ 216| 88| OQS_MEM_cleanse(out, (size_t)((((2 * w - 1)*n / 2) + 7) / 8)); 217| 88| cbrecursion(out, 0, 1, pi, w, n, temp); 218| | 219| | // check for correctness 220| | 221| 720k| for (i = 0; i < n; i++) { ------------------ | Branch (221:21): [True: 720k, False: 88] ------------------ 222| 720k| pi_test[i] = (int16)i; 223| 720k| } 224| | 225| 88| ptr = out; 226| 1.23k| for (i = 0; i < w; i++) { ------------------ | Branch (226:21): [True: 1.14k, False: 88] ------------------ 227| 1.14k| layer(pi_test, ptr, i, (int32)n); 228| 1.14k| ptr += n >> 4; 229| 1.14k| } 230| | 231| 1.14k| for (i = (int)(w - 2); i >= 0; i--) { ------------------ | Branch (231:32): [True: 1.05k, False: 88] ------------------ 232| 1.05k| layer(pi_test, ptr, i, (int32)n); 233| 1.05k| ptr += n >> 4; 234| 1.05k| } 235| | 236| 88| diff = 0; 237| 720k| for (i = 0; i < n; i++) { ------------------ | Branch (237:21): [True: 720k, False: 88] ------------------ 238| 720k| diff |= pi[i] ^ pi_test[i]; 239| 720k| } 240| | 241| 88| diff = crypto_int16_nonzero_mask(diff); ------------------ | | 12| 88|#define crypto_int16_nonzero_mask CRYPTO_NAMESPACE(crypto_int16_nonzero_mask) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 242| 88| crypto_declassify(&diff, sizeof diff); 243| 88| if (diff == 0) { ------------------ | Branch (243:13): [True: 88, False: 0] ------------------ 244| 88| break; 245| 88| } 246| 88| } 247| 88|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_int16_negative_mask: 3| 176|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 4| 176| return crypto_int16_x >> 15; 5| 176|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_int16_nonzero_mask: 7| 88|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 8| 88| return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 88|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 88|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 9| 88|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_int32_negative_mask: 3| 56.2M|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 4| 56.2M| return crypto_int32_x >> 31; 5| 56.2M|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_int32_min: 37| 56.2M|crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x, crypto_int32 crypto_int32_y) { 38| 56.2M| crypto_int32 crypto_int32_xy = crypto_int32_y ^ crypto_int32_x; 39| 56.2M| crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x; 40| 56.2M| crypto_int32_z ^= crypto_int32_xy & (crypto_int32_z ^ crypto_int32_y); 41| 56.2M| crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); ------------------ | | 9| 56.2M|#define crypto_int32_negative_mask CRYPTO_NAMESPACE(crypto_int32_negative_mask) | | ------------------ | | | | 4| 56.2M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 42| 56.2M| crypto_int32_z &= crypto_int32_xy; 43| 56.2M| return crypto_int32_x ^ crypto_int32_z; 44| 56.2M|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint16_signed_negative_mask: 3| 102k|crypto_uint16_signed crypto_uint16_signed_negative_mask(crypto_uint16_signed crypto_uint16_signed_x) { 4| 102k| return crypto_uint16_signed_x >> 15; 5| 102k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint16_nonzero_mask: 7| 13.6k|crypto_uint16 crypto_uint16_nonzero_mask(crypto_uint16 crypto_uint16_x) { 8| 13.6k| return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 13.6k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 13.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 13.6k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 13.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 9| 13.6k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint16_zero_mask: 11| 13.6k|crypto_uint16 crypto_uint16_zero_mask(crypto_uint16 crypto_uint16_x) { 12| 13.6k| return ~crypto_uint16_nonzero_mask(crypto_uint16_x); ------------------ | | 13| 13.6k|#define crypto_uint16_nonzero_mask CRYPTO_NAMESPACE(crypto_uint16_nonzero_mask) | | ------------------ | | | | 4| 13.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 13| 13.6k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint16_smaller_mask: 24| 74.7k|crypto_uint16 crypto_uint16_smaller_mask(crypto_uint16 crypto_uint16_x, crypto_uint16 crypto_uint16_y) { 25| 74.7k| crypto_uint16 crypto_uint16_xy = crypto_uint16_x ^ crypto_uint16_y; 26| 74.7k| crypto_uint16 crypto_uint16_z = crypto_uint16_x - crypto_uint16_y; 27| 74.7k| crypto_uint16_z ^= crypto_uint16_xy & (crypto_uint16_z ^ crypto_uint16_x ^ (((crypto_uint16) 1) << 15)); 28| 74.7k| return crypto_uint16_signed_negative_mask(crypto_uint16_z); ------------------ | | 11| 74.7k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 74.7k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 29| 74.7k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint32_signed_negative_mask: 3| 126k|crypto_uint32_signed crypto_uint32_signed_negative_mask(crypto_uint32_signed crypto_uint32_signed_x) { 4| 126k| return crypto_uint32_signed_x >> 31; 5| 126k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint32_nonzero_mask: 7| 63.0k|crypto_uint32 crypto_uint32_nonzero_mask(crypto_uint32 crypto_uint32_x) { 8| 63.0k| return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 63.0k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 63.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 63.0k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 63.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 9| 63.0k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint32_unequal_mask: 15| 63.0k|crypto_uint32 crypto_uint32_unequal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 16| 63.0k| crypto_uint32 crypto_uint32_xy = crypto_uint32_x ^ crypto_uint32_y; 17| 63.0k| return crypto_uint32_nonzero_mask(crypto_uint32_xy); ------------------ | | 13| 63.0k|#define crypto_uint32_nonzero_mask CRYPTO_NAMESPACE(crypto_uint32_nonzero_mask) | | ------------------ | | | | 4| 63.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 18| 63.0k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint32_equal_mask: 20| 63.0k|crypto_uint32 crypto_uint32_equal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 21| 63.0k| return ~crypto_uint32_unequal_mask(crypto_uint32_x, crypto_uint32_y); ------------------ | | 17| 63.0k|#define crypto_uint32_unequal_mask CRYPTO_NAMESPACE(crypto_uint32_unequal_mask) | | ------------------ | | | | 4| 63.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 22| 63.0k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint64_signed_negative_mask: 3| 1.95M|crypto_uint64_signed crypto_uint64_signed_negative_mask(crypto_uint64_signed crypto_uint64_signed_x) { 4| 1.95M| return crypto_uint64_signed_x >> 63; 5| 1.95M|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint64_nonzero_mask: 7| 975k|crypto_uint64 crypto_uint64_nonzero_mask(crypto_uint64 crypto_uint64_x) { 8| 975k| return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 975k|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 975k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 975k|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 975k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 9| 975k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint64_zero_mask: 11| 138k|crypto_uint64 crypto_uint64_zero_mask(crypto_uint64 crypto_uint64_x) { 12| 138k| return ~crypto_uint64_nonzero_mask(crypto_uint64_x); ------------------ | | 13| 138k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 138k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 13| 138k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint64_unequal_mask: 15| 836k|crypto_uint64 crypto_uint64_unequal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 16| 836k| crypto_uint64 crypto_uint64_xy = crypto_uint64_x ^ crypto_uint64_y; 17| 836k| return crypto_uint64_nonzero_mask(crypto_uint64_xy); ------------------ | | 13| 836k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 836k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 18| 836k|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_uint64_equal_mask: 20| 836k|crypto_uint64 crypto_uint64_equal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 21| 836k| return ~crypto_uint64_unequal_mask(crypto_uint64_x, crypto_uint64_y); ------------------ | | 17| 836k|#define crypto_uint64_unequal_mask CRYPTO_NAMESPACE(crypto_uint64_unequal_mask) | | ------------------ | | | | 4| 836k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 22| 836k|} PQCLEAN_MCELIECE6960119F_AVX2_decrypt: 171| 88|int decrypt(unsigned char *e, const unsigned char *sk, const unsigned char *s) { 172| 88| int i; 173| | 174| 88| uint16_t check_synd; 175| 88| uint16_t check_weight; 176| | 177| 88| vec256 inv[ 32 ][ GFBITS ]; 178| 88| vec256 scaled[ 32 ][ GFBITS ]; 179| 88| vec256 eval[32][ GFBITS ]; 180| | 181| 88| vec128 error128[ 64 ]; 182| 88| vec256 error256[ 32 ]; 183| | 184| 88| vec256 s_priv[ GFBITS ]; 185| 88| vec256 s_priv_cmp[ GFBITS ]; 186| 88| vec128 locator[ GFBITS ]; 187| | 188| 88| vec128 recv128[ 64 ]; 189| 88| vec256 recv256[ 32 ]; 190| 88| vec256 allone; 191| | 192| 88| vec128 bits_int[25][32]; 193| | 194| | // Berlekamp decoder 195| | 196| 88| preprocess(recv128, s); 197| | 198| 88| load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 10| 88|#define load_bits CRYPTO_NAMESPACE(load_bits) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 11| 88|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 88|#define SYS_T 119 | | ------------------ ------------------ 199| 88| benes(recv128, bits_int, 1); ------------------ | | 9| 88|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 200| | 201| 88| reformat_128to256(recv256, recv128); 202| | 203| 88| scaling(scaled, inv, sk, recv256); 204| 88| fft_tr(s_priv, scaled); ------------------ | | 9| 88|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 205| 88| bm(locator, s_priv); ------------------ | | 10| 88|#define bm CRYPTO_NAMESPACE(bm) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 206| | 207| 88| fft(eval, locator); ------------------ | | 10| 88|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| | // reencryption and weight check 210| | 211| 88| allone = vec256_set1_16b(0xFFFF); 212| | 213| 2.90k| for (i = 0; i < 32; i++) { ------------------ | Branch (213:17): [True: 2.81k, False: 88] ------------------ 214| 2.81k| error256[i] = vec256_or_reduce(eval[i]); 215| 2.81k| error256[i] = vec256_xor(error256[i], allone); 216| 2.81k| } 217| | 218| 88| scaling_inv(scaled, inv, error256); 219| 88| fft_tr(s_priv_cmp, scaled); ------------------ | | 9| 88|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 220| | 221| 88| check_synd = synd_cmp(s_priv, s_priv_cmp); 222| | 223| | // 224| | 225| 88| reformat_256to128(error128, error256); 226| 88| benes(error128, bits_int, 0); ------------------ | | 9| 88|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 227| | 228| 88| postprocess(e, error128); 229| | 230| 88| check_weight = weight_check(e, error128); 231| | 232| 88| return 1 - (check_synd & check_weight); 233| 88|} PQCLEAN_MCELIECE6960119F_AVX2_encrypt: 116| 88|void encrypt(unsigned char *s, const unsigned char *pk, unsigned char *e) { 117| 88| gen_e(e); 118| | 119| 88| syndrome_asm(s, pk, e); ------------------ | | 1| 88|#define syndrome_asm CRYPTO_NAMESPACE(syndrome_asm) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 120| 88|} PQCLEAN_MCELIECE6960119F_AVX2_fft: 265| 291|void fft(vec256 out[][GFBITS], vec128 *in) { 266| 291| radix_conversions(in); 267| 291| butterflies(out, in); 268| 291|} PQCLEAN_MCELIECE6960119F_AVX2_fft_tr: 398| 176|void fft_tr(vec256 *out, vec256 in[][ GFBITS ]) { 399| 176| butterflies_tr(out, in); 400| 176| radix_conversions_tr(out); 401| | 402| 176| postprocess(out); 403| 176|} PQCLEAN_MCELIECE6960119F_AVX2_gf_mul: 20| 1.62M|gf gf_mul(gf in0, gf in1) { 21| 1.62M| int i; 22| | 23| 1.62M| uint64_t tmp; 24| 1.62M| uint64_t t0; 25| 1.62M| uint64_t t1; 26| 1.62M| uint64_t t; 27| | 28| 1.62M| t0 = in0; 29| 1.62M| t1 = in1; 30| | 31| 1.62M| tmp = t0 * (t1 & 1); 32| | 33| 21.1M| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 21.1M|#define GFBITS 13 ------------------ | Branch (33:17): [True: 19.5M, False: 1.62M] ------------------ 34| 19.5M| tmp ^= (t0 * (t1 & (1 << i))); 35| 19.5M| } 36| | 37| | // 38| | 39| 1.62M| t = tmp & 0x1FF0000; 40| 1.62M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 41| | 42| 1.62M| t = tmp & 0x000E000; 43| 1.62M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 44| | 45| 1.62M| return tmp & GFMASK; ------------------ | | 19| 1.62M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 1.62M|#define GFBITS 13 | | ------------------ ------------------ 46| 1.62M|} PQCLEAN_MCELIECE6960119F_AVX2_gf_frac: 156| 13.6k|gf gf_frac(gf den, gf num) { 157| 13.6k| gf tmp_11; 158| 13.6k| gf tmp_1111; 159| 13.6k| gf out; 160| | 161| 13.6k| tmp_11 = gf_sqmul(den, den); // ^11 162| 13.6k| tmp_1111 = gf_sq2mul(tmp_11, tmp_11); // ^1111 163| 13.6k| out = gf_sq2(tmp_1111); 164| 13.6k| out = gf_sq2mul(out, tmp_1111); // ^11111111 165| 13.6k| out = gf_sq2(out); 166| 13.6k| out = gf_sq2mul(out, tmp_1111); // ^111111111111 167| | 168| 13.6k| return gf_sqmul(out, num); // ^1111111111110 = ^-1 169| 13.6k|} PQCLEAN_MCELIECE6960119F_AVX2_gf_inv: 172| 13.6k|gf gf_inv(gf den) { 173| 13.6k| return gf_frac(den, ((gf) 1)); ------------------ | | 10| 13.6k|#define gf_frac CRYPTO_NAMESPACE(gf_frac) | | ------------------ | | | | 4| 13.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 174| 13.6k|} pk_gen.c:PQCLEAN_MCELIECE6960119F_AVX2_int32_sort: 21| 88|static void int32_sort(int32_t *x, long long n) { 22| 88| long long top, p, q, r, i; 23| | 24| 88| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 88] ------------------ 25| 0| return; 26| 0| } 27| 88| top = 1; 28| 968| while (top < n - top) { ------------------ | Branch (28:12): [True: 880, False: 88] ------------------ 29| 880| top += top; 30| 880| } 31| | 32| 1.05k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 968, False: 88] ------------------ 33| 1.31M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.31M, False: 968] ------------------ 34| 1.31M| if (!(i & p)) { ------------------ | Branch (34:17): [True: 701k, False: 615k] ------------------ 35| 701k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 701k| do { \ | | 12| 701k| int32_t ab = (b) ^ (a); \ | | 13| 701k| int32_t c = (b) - (a); \ | | 14| 701k| c ^= ab & ((c) ^ (b)); \ | | 15| 701k| c >>= 31; \ | | 16| 701k| c &= ab; \ | | 17| 701k| (a) ^= c; \ | | 18| 701k| (b) ^= c; \ | | 19| 701k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 701k] | | ------------------ ------------------ 36| 701k| } 37| 1.31M| } 38| 968| i = 0; 39| 5.80k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 4.84k, False: 968] ------------------ 40| 1.18M| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.18M, False: 4.84k] ------------------ 41| 1.18M| if (!(i & p)) { ------------------ | Branch (41:21): [True: 615k, False: 565k] ------------------ 42| 615k| int32_t a = x[i + p]; 43| 3.58M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 2.96M, False: 615k] ------------------ 44| 2.96M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 2.96M| do { \ | | 12| 2.96M| int32_t ab = (b) ^ (a); \ | | 13| 2.96M| int32_t c = (b) - (a); \ | | 14| 2.96M| c ^= ab & ((c) ^ (b)); \ | | 15| 2.96M| c >>= 31; \ | | 16| 2.96M| c &= ab; \ | | 17| 2.96M| (a) ^= c; \ | | 18| 2.96M| (b) ^= c; \ | | 19| 2.96M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.96M] | | ------------------ ------------------ 45| 2.96M| } 46| 615k| x[i + p] = a; 47| 615k| } 48| 1.18M| } 49| 4.84k| } 50| 968| } 51| 88|} controlbits.c:PQCLEAN_MCELIECE6960119F_AVX2_int32_sort: 21| 2.88M|static void int32_sort(int32_t *x, long long n) { 22| 2.88M| long long top, p, q, r, i; 23| | 24| 2.88M| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 2.88M] ------------------ 25| 0| return; 26| 0| } 27| 2.88M| top = 1; 28| 10.1M| while (top < n - top) { ------------------ | Branch (28:12): [True: 7.22M, False: 2.88M] ------------------ 29| 7.22M| top += top; 30| 7.22M| } 31| | 32| 12.9M| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 10.1M, False: 2.88M] ------------------ 33| 1.39G| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.38G, False: 10.1M] ------------------ 34| 1.38G| if (!(i & p)) { ------------------ | Branch (34:17): [True: 772M, False: 608M] ------------------ 35| 772M| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 772M| do { \ | | 12| 772M| int32_t ab = (b) ^ (a); \ | | 13| 772M| int32_t c = (b) - (a); \ | | 14| 772M| c ^= ab & ((c) ^ (b)); \ | | 15| 772M| c >>= 31; \ | | 16| 772M| c &= ab; \ | | 17| 772M| (a) ^= c; \ | | 18| 772M| (b) ^= c; \ | | 19| 772M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 772M] | | ------------------ ------------------ 36| 772M| } 37| 1.38G| } 38| 10.1M| i = 0; 39| 27.4M| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 17.3M, False: 10.1M] ------------------ 40| 1.23G| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.21G, False: 17.3M] ------------------ 41| 1.21G| if (!(i & p)) { ------------------ | Branch (41:21): [True: 608M, False: 608M] ------------------ 42| 608M| int32_t a = x[i + p]; 43| 3.60G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 2.99G, False: 608M] ------------------ 44| 2.99G| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 2.99G| do { \ | | 12| 2.99G| int32_t ab = (b) ^ (a); \ | | 13| 2.99G| int32_t c = (b) - (a); \ | | 14| 2.99G| c ^= ab & ((c) ^ (b)); \ | | 15| 2.99G| c >>= 31; \ | | 16| 2.99G| c &= ab; \ | | 17| 2.99G| (a) ^= c; \ | | 18| 2.99G| (b) ^= c; \ | | 19| 2.99G| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.99G] | | ------------------ ------------------ 45| 2.99G| } 46| 608M| x[i + p] = a; 47| 608M| } 48| 1.21G| } 49| 17.3M| } 50| 10.1M| } 51| 2.88M|} encrypt.c:PQCLEAN_MCELIECE6960119F_AVX2_int32_sort: 21| 534|static void int32_sort(int32_t *x, long long n) { 22| 534| long long top, p, q, r, i; 23| | 24| 534| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 534] ------------------ 25| 0| return; 26| 0| } 27| 534| top = 1; 28| 3.73k| while (top < n - top) { ------------------ | Branch (28:12): [True: 3.20k, False: 534] ------------------ 29| 3.20k| top += top; 30| 3.20k| } 31| | 32| 4.27k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 3.73k, False: 534] ------------------ 33| 380k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 377k, False: 3.73k] ------------------ 34| 377k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 212k, False: 164k] ------------------ 35| 212k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 212k| do { \ | | 12| 212k| int32_t ab = (b) ^ (a); \ | | 13| 212k| int32_t c = (b) - (a); \ | | 14| 212k| c ^= ab & ((c) ^ (b)); \ | | 15| 212k| c >>= 31; \ | | 16| 212k| c &= ab; \ | | 17| 212k| (a) ^= c; \ | | 18| 212k| (b) ^= c; \ | | 19| 212k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 212k] | | ------------------ ------------------ 36| 212k| } 37| 377k| } 38| 3.73k| i = 0; 39| 14.9k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 11.2k, False: 3.73k] ------------------ 40| 325k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 313k, False: 11.2k] ------------------ 41| 313k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 164k, False: 149k] ------------------ 42| 164k| int32_t a = x[i + p]; 43| 677k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 512k, False: 164k] ------------------ 44| 512k| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 512k| do { \ | | 12| 512k| int32_t ab = (b) ^ (a); \ | | 13| 512k| int32_t c = (b) - (a); \ | | 14| 512k| c ^= ab & ((c) ^ (b)); \ | | 15| 512k| c >>= 31; \ | | 16| 512k| c &= ab; \ | | 17| 512k| (a) ^= c; \ | | 18| 512k| (b) ^= c; \ | | 19| 512k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 512k] | | ------------------ ------------------ 45| 512k| } 46| 164k| x[i + p] = a; 47| 164k| } 48| 313k| } 49| 11.2k| } 50| 3.73k| } 51| 534|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_kem_enc: 40| 88|) { 41| 88| unsigned char e[ SYS_N / 8 ]; 42| 88| unsigned char one_ec[ 1 + SYS_N / 8 + SYND_BYTES ] = {1}; 43| 88| unsigned char mask; 44| 88| int i, padding_ok; 45| | 46| | // 47| | 48| 88| padding_ok = check_pk_padding(pk); 49| | 50| 88| encrypt(c, pk, e); ------------------ | | 9| 88|#define encrypt CRYPTO_NAMESPACE(encrypt) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 51| | 52| 88| memcpy(one_ec + 1, e, SYS_N / 8); ------------------ | | 7| 88|#define SYS_N 6960 ------------------ 53| 88| memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 7| 88|#define SYS_N 6960 ------------------ memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 17| 88|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 88|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 88|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 88|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 54| | 55| 88| crypto_hash_32b(key, one_ec, sizeof(one_ec)); ------------------ | | 7| 88| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 88|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 56| | 57| | // clear outputs (set to all 0's) if padding bits are not all zero 58| | 59| 88| mask = (unsigned char)padding_ok; 60| 88| mask ^= 0xFF; 61| | 62| 17.1k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 17.1k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 17.1k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 17.1k|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 17.1k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (62:17): [True: 17.0k, False: 88] ------------------ 63| 17.0k| c[i] &= mask; 64| 17.0k| } 65| | 66| 2.90k| for (i = 0; i < 32; i++) { ------------------ | Branch (66:17): [True: 2.81k, False: 88] ------------------ 67| 2.81k| key[i] &= mask; 68| 2.81k| } 69| | 70| 88| return padding_ok; 71| 88|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_kem_dec: 90| 88|) { 91| 88| int i, padding_ok; 92| | 93| 88| unsigned char mask; 94| 88| unsigned char ret_decrypt = 0; 95| | 96| 88| uint16_t m; 97| | 98| 88| unsigned char e[ SYS_N / 8 ]; 99| 88| unsigned char preimage[ 1 + SYS_N / 8 + SYND_BYTES ]; 100| 88| unsigned char *x = preimage; 101| 88| const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 11| 88|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 88|#define SYS_T 119 | | ------------------ ------------------ const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 10| 88|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 88|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 88|#define GFBITS 13 | | ------------------ ------------------ 102| | 103| | // 104| | 105| 88| padding_ok = check_c_padding(c); 106| | 107| 88| ret_decrypt = (unsigned char)decrypt(e, sk + 40, c); ------------------ | | 9| 88|#define decrypt CRYPTO_NAMESPACE(decrypt) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 108| | 109| 88| m = ret_decrypt; 110| 88| m -= 1; 111| 88| m >>= 8; 112| | 113| 88| *x++ = m & 1; 114| 76.6k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 76.6k|#define SYS_N 6960 ------------------ | Branch (114:17): [True: 76.5k, False: 88] ------------------ 115| 76.5k| *x++ = (~m & s[i]) | (m & e[i]); 116| 76.5k| } 117| | 118| 17.1k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 17.1k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 17.1k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 17.1k|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 17.1k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (118:17): [True: 17.0k, False: 88] ------------------ 119| 17.0k| *x++ = c[i]; 120| 17.0k| } 121| | 122| 88| crypto_hash_32b(key, preimage, sizeof(preimage)); ------------------ | | 7| 88| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 88|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 123| | 124| | // clear outputs (set to all 1's) if padding bits are not all zero 125| | 126| 88| mask = (unsigned char)padding_ok; 127| | 128| 2.90k| for (i = 0; i < 32; i++) { ------------------ | Branch (128:17): [True: 2.81k, False: 88] ------------------ 129| 2.81k| key[i] |= mask; 130| 2.81k| } 131| | 132| 88| return padding_ok; 133| 88|} PQCLEAN_MCELIECE6960119F_AVX2_crypto_kem_keypair: 139| 88|) { 140| 88| int i; 141| 88| unsigned char seed[ 33 ] = {64}; 142| 88| unsigned char r[ SYS_N / 8 + (1 << GFBITS)*sizeof(uint32_t) + SYS_T * 2 + 32 ]; 143| 88| unsigned char *rp, *skp; 144| 88| uint64_t pivots; 145| | 146| 88| gf f[ SYS_T ]; // element in GF(2^mt) 147| 88| gf irr[ SYS_T ]; // Goppa polynomial 148| 88| uint32_t perm[ 1 << GFBITS ]; // random permutation as 32-bit integers 149| 88| int16_t pi[ 1 << GFBITS ]; // random permutation 150| | 151| 88| randombytes(seed + 1, 32); ------------------ | | 8| 88|#define randombytes OQS_randombytes ------------------ 152| | 153| 115| while (1) { ------------------ | Branch (153:12): [True: 115, Folded] ------------------ 154| 115| rp = &r[ sizeof(r) - 32 ]; 155| 115| skp = sk; 156| | 157| | // expanding and updating the seed 158| | 159| 115| shake(r, sizeof(r), seed, 33); ------------------ | | 10| 115| shake256(out, outlen, in, inlen) | | ------------------ | | | | 12| 115|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 160| 115| memcpy(skp, seed + 1, 32); 161| 115| skp += 32 + 8; 162| 115| memcpy(seed + 1, &r[ sizeof(r) - 32 ], 32); 163| | 164| | // generating irreducible polynomial 165| | 166| 115| rp -= sizeof(f); 167| | 168| 13.8k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 13.8k|#define SYS_T 119 ------------------ | Branch (168:21): [True: 13.6k, False: 115] ------------------ 169| 13.6k| f[i] = load_gf(rp + i * 2); 170| 13.6k| } 171| | 172| 115| if (genpoly_gen(irr, f)) { ------------------ | | 9| 115|#define genpoly_gen CRYPTO_NAMESPACE(genpoly_gen) | | ------------------ | | | | 4| 115|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ | Branch (172:13): [True: 0, False: 115] ------------------ 173| 0| continue; 174| 0| } 175| | 176| 13.8k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 13.8k|#define SYS_T 119 ------------------ | Branch (176:21): [True: 13.6k, False: 115] ------------------ 177| 13.6k| store_gf(skp + i * 2, irr[i]); 178| 13.6k| } 179| | 180| 115| skp += IRR_BYTES; ------------------ | | 11| 115|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 115|#define SYS_T 119 | | ------------------ ------------------ 181| | 182| | // generating permutation 183| | 184| 115| rp -= sizeof(perm); 185| | 186| 942k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 942k|#define GFBITS 13 ------------------ | Branch (186:21): [True: 942k, False: 115] ------------------ 187| 942k| perm[i] = load4(rp + i * 4); 188| 942k| } 189| | 190| 115| if (pk_gen(pk, skp - IRR_BYTES, perm, pi, &pivots)) { ------------------ | | 9| 115|#define pk_gen CRYPTO_NAMESPACE(pk_gen) | | ------------------ | | | | 4| 115|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ if (pk_gen(pk, skp - IRR_BYTES, perm, pi, &pivots)) { ------------------ | | 11| 115|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 115|#define SYS_T 119 | | ------------------ ------------------ | Branch (190:13): [True: 27, False: 88] ------------------ 191| 27| continue; 192| 27| } 193| | 194| 88| controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 10| 88|#define controlbitsfrompermutation CRYPTO_NAMESPACE(controlbitsfrompermutation) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 88|#define GFBITS 13 ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 88|#define GFBITS 13 ------------------ 195| 88| skp += COND_BYTES; ------------------ | | 10| 88|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 88|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 88|#define GFBITS 13 | | ------------------ ------------------ 196| | 197| | // storing the random string s 198| | 199| 88| rp -= SYS_N / 8; ------------------ | | 7| 88|#define SYS_N 6960 ------------------ 200| 88| memcpy(skp, rp, SYS_N / 8); ------------------ | | 7| 88|#define SYS_N 6960 ------------------ 201| | 202| | // storing positions of the 32 pivots 203| | 204| 88| store8(sk + 32, pivots); 205| | 206| 88| break; 207| 115| } 208| | 209| 88| return 0; 210| 88|} PQCLEAN_MCELIECE6960119F_AVX2_pk_gen: 316| 115|int pk_gen(unsigned char *pk, const unsigned char *irr, const uint32_t *perm, int16_t *pi, uint64_t *pivots) { 317| |// const int nBlocks_I = (PK_NROWS + 255) / 256; 318| 115| const int head = PK_NROWS % 64; ------------------ | | 13| 115|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 115|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 115|#define GFBITS 13 | | ------------------ ------------------ 319| 115| const int tail = PK_NCOLS % 64; ------------------ | | 14| 115|#define PK_NCOLS (SYS_N - PK_NROWS) | | ------------------ | | | | 7| 115|#define SYS_N 6960 | | ------------------ | | #define PK_NCOLS (SYS_N - PK_NROWS) | | ------------------ | | | | 13| 115|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 115|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 115|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 320| 115| const uint64_t one = 1; 321| | 322| 115| int i, j, k, b; 323| 115| int row, c; 324| | 325| 115| union { 326| 115| uint64_t w[ PK_NROWS ][ nBlocks_I * 4 ]; 327| 115| vec256 v[ PK_NROWS ][ nBlocks_I ]; 328| 115| } mat; 329| | 330| 115| union { 331| 115| uint64_t w[ PK_NROWS ][ 44 ]; 332| 115| vec256 v[ PK_NROWS ][ 11 ]; 333| 115| } par; 334| | 335| 115| uint16_t m; 336| 115| vec256 mm; 337| | 338| 115| vec128 sk_int[ GFBITS ]; 339| | 340| 115| vec256 consts[ 32 ][ GFBITS ]; 341| 115| vec256 eval[ 32 ][ GFBITS ]; 342| 115| vec256 prod[ 32 ][ GFBITS ]; 343| 115| vec256 tmp[ GFBITS ]; 344| | 345| 115| uint64_t list[1 << GFBITS]; 346| 115| uint64_t buf[ PK_NROWS ]; 347| 115| uint64_t t; 348| | 349| 115| uint16_t ind[ PK_NROWS ]; 350| 115| uint16_t ind_inv[ PK_NROWS ]; 351| | 352| | // compute the inverses 353| | 354| 115| irr_load(sk_int, irr); 355| | 356| 115| fft(eval, sk_int); ------------------ | | 10| 115|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 115|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 357| | 358| 115| vec256_copy(prod[0], eval[0]); 359| | 360| 3.68k| for (i = 1; i < 32; i++) { ------------------ | Branch (360:17): [True: 3.56k, False: 115] ------------------ 361| 3.56k| vec256_mul(prod[i], prod[i - 1], eval[i]); 362| 3.56k| } 363| | 364| 115| vec256_inv(tmp, prod[31]); ------------------ | | 11| 115|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 115|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 365| | 366| 3.68k| for (i = 30; i >= 0; i--) { ------------------ | Branch (366:18): [True: 3.56k, False: 115] ------------------ 367| 3.56k| vec256_mul(prod[i + 1], prod[i], tmp); 368| 3.56k| vec256_mul(tmp, tmp, eval[i + 1]); 369| 3.56k| } 370| | 371| 115| vec256_copy(prod[0], tmp); 372| | 373| | // fill matrix 374| | 375| 115| de_bitslicing(list, prod); 376| | 377| 942k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 942k|#define GFBITS 13 ------------------ | Branch (377:17): [True: 942k, False: 115] ------------------ 378| 942k| list[i] <<= GFBITS; ------------------ | | 6| 942k|#define GFBITS 13 ------------------ 379| 942k| list[i] |= i; 380| 942k| list[i] |= ((uint64_t) perm[i]) << 31; 381| 942k| } 382| | 383| 115| uint64_sort(list, 1 << GFBITS); ------------------ | | 6| 115|#define GFBITS 13 ------------------ 384| | 385| 836k| for (i = 1; i < (1 << GFBITS); i++) { ------------------ | | 6| 836k|#define GFBITS 13 ------------------ | Branch (385:17): [True: 836k, False: 88] ------------------ 386| 836k| if (uint64_is_equal_declassify(list[i - 1] >> 31, list[i] >> 31)) { ------------------ | Branch (386:13): [True: 27, False: 836k] ------------------ 387| 27| return -1; 388| 27| } 389| 836k| } 390| | 391| 88| to_bitslicing_2x(consts, prod, list); 392| | 393| 720k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 720k|#define GFBITS 13 ------------------ | Branch (393:17): [True: 720k, False: 88] ------------------ 394| 720k| pi[i] = list[i] & GFMASK; ------------------ | | 19| 720k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 720k|#define GFBITS 13 | | ------------------ ------------------ 395| 720k| } 396| | 397| 704| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 32| 704|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 704|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 704|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 704|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (397:17): [True: 616, False: 88] ------------------ 398| 8.62k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 8.62k|#define GFBITS 13 ------------------ | Branch (398:21): [True: 8.00k, False: 616] ------------------ 399| 8.00k| mat.v[ k ][ j ] = prod[ j ][ k ]; 400| 8.00k| } 401| 616| } 402| | 403| 10.4k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 10.4k|#define SYS_T 119 ------------------ | Branch (403:17): [True: 10.3k, False: 88] ------------------ 404| 83.0k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 32| 83.0k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 83.0k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 83.0k|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 83.0k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (404:21): [True: 72.6k, False: 10.3k] ------------------ 405| 72.6k| vec256_mul(prod[j], prod[j], consts[j]); 406| | 407| 1.01M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 1.01M|#define GFBITS 13 ------------------ | Branch (407:25): [True: 944k, False: 72.6k] ------------------ 408| 944k| mat.v[ i * GFBITS + k ][ j ] = prod[ j ][ k ]; ------------------ | | 6| 944k|#define GFBITS 13 ------------------ 409| 944k| } 410| 72.6k| } 411| 10.3k| } 412| | 413| | // gaussian elimination to obtain L, U, and P such that LP M = U 414| | // L and U are stored in the space of M 415| | // P is stored in ind 416| | 417| 136k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 136k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 136k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 136k|#define GFBITS 13 | | ------------------ ------------------ | Branch (417:17): [True: 136k, False: 88] ------------------ 418| 136k| ind_inv[i] = ind[ i ] = i; 419| 136k| } 420| | 421| 136k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 136k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 136k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 136k|#define GFBITS 13 | | ------------------ ------------------ | Branch (421:19): [True: 136k, False: 88] ------------------ 422| 136k| i = row >> 6; 423| 136k| j = row & 63; 424| | 425| 136k| if (row == PK_NROWS - 32) { ------------------ | | 13| 136k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 136k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 136k|#define GFBITS 13 | | ------------------ ------------------ | Branch (425:13): [True: 88, False: 136k] ------------------ 426| 88| if (mov_columns(mat.w, pi, pivots)) { ------------------ | Branch (426:17): [True: 0, False: 88] ------------------ 427| 0| return -1; 428| 0| } 429| 88| } 430| | 431| 105M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 105M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 105M|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 105M|#define GFBITS 13 | | ------------------ ------------------ | Branch (431:27): [True: 105M, False: 136k] ------------------ 432| 105M| extract_01_masks(&m, mat.w[ row ], mat.w[ k ], row); 433| 105M| uint16_cswap(&ind[row], &ind[k], m); 434| | 435| 105M| mm = vec256_set1_16b(m); 436| 841M| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 32| 841M|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 841M|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 841M|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 841M|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (436:25): [True: 736M, False: 105M] ------------------ 437| 736M| vec256_cswap(&mat.v[ row ][ c ], &mat.v[ k ][ c ], mm); 438| 736M| } 439| 105M| } 440| | 441| 136k| if ( uint64_is_zero_declassify((mat.w[ row ][ i ] >> j) & 1) ) { // return if not systematic ------------------ | Branch (441:14): [True: 0, False: 136k] ------------------ 442| 0| return -1; 443| 0| } 444| | 445| 105M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 105M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 105M|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 105M|#define GFBITS 13 | | ------------------ ------------------ | Branch (445:27): [True: 105M, False: 136k] ------------------ 446| 105M| t = mat.w[ k ][ i ] & (one << j); 447| 105M| mm = extract_mask256(mat.w[k], row); 448| | 449| 841M| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 32| 841M|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 841M|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 841M|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 841M|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (449:25): [True: 736M, False: 105M] ------------------ 450| 736M| mat.v[ k ][ c ] ^= mat.v[ row ][ c ] & mm; 451| 736M| } 452| | 453| 105M| mat.w[ k ][ i ] |= t; 454| 105M| } 455| 136k| } 456| | 457| | // apply M^-1 to the remaining columns 458| | 459| 88| composeinv(PK_NROWS, ind_inv, ind_inv, ind); ------------------ | | 13| 88|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 88|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 88|#define GFBITS 13 | | ------------------ ------------------ 460| | 461| 264| for (j = 6; j < 28; j += 11) { ------------------ | Branch (461:17): [True: 176, False: 88] ------------------ 462| 2.46k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 2.46k|#define GFBITS 13 ------------------ | Branch (462:21): [True: 2.28k, False: 176] ------------------ 463| 27.4k| for (b = 0; b < 11; b++) { ------------------ | Branch (463:25): [True: 25.1k, False: 2.28k] ------------------ 464| 25.1k| par.v[ k ][ b ] = prod[ j + b ][ k ]; 465| 25.1k| } 466| 2.28k| } 467| | 468| 20.9k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 20.9k|#define SYS_T 119 ------------------ | Branch (468:21): [True: 20.7k, False: 176] ------------------ 469| 249k| for (b = 0; b < 11; b++) { ------------------ | Branch (469:25): [True: 228k, False: 20.7k] ------------------ 470| 228k| vec256_mul(prod[j + b], prod[j + b], consts[j + b]); 471| 228k| } 472| | 473| 290k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 290k|#define GFBITS 13 ------------------ | Branch (473:25): [True: 269k, False: 20.7k] ------------------ 474| 3.23M| for (b = 0; b < 11; b++) { ------------------ | Branch (474:29): [True: 2.96M, False: 269k] ------------------ 475| 2.96M| par.v[ i * GFBITS + k ][ b ] = prod[ j + b ][ k ]; ------------------ | | 6| 2.96M|#define GFBITS 13 ------------------ 476| 2.96M| } 477| 269k| } 478| 20.7k| } 479| | 480| | // apply P 481| | 482| 272k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 272k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 272k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 272k|#define GFBITS 13 | | ------------------ ------------------ | Branch (482:21): [True: 272k, False: 176] ------------------ 483| 272k| ind[i] = ind_inv[i]; 484| 272k| } 485| | 486| 176| sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 6| 176|#define GFBITS 13 ------------------ sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 13| 176|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 176|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 176|#define GFBITS 13 | | ------------------ ------------------ 487| | 488| | // apply L 489| | 490| 272k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 176|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 176|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 176|#define GFBITS 13 | | ------------------ ------------------ | Branch (490:34): [True: 272k, False: 176] ------------------ 491| 210M| for (i = row - 1; i >= 0; i--) { ------------------ | Branch (491:31): [True: 210M, False: 272k] ------------------ 492| 210M| mm = extract_mask256(mat.w[row], i); 493| | 494| 2.52G| for (k = 0; k < 11; k++) { ------------------ | Branch (494:29): [True: 2.31G, False: 210M] ------------------ 495| 2.31G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 496| 2.31G| } 497| 210M| } 498| 272k| } 499| | 500| | // apply U^-1 501| | 502| 176| if (j == 6) { ------------------ | Branch (502:13): [True: 88, False: 88] ------------------ 503| 136k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 136k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 136k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 136k|#define GFBITS 13 | | ------------------ ------------------ | Branch (503:25): [True: 136k, False: 88] ------------------ 504| 136k| par.v[i][0] = mat.v[ i ][ nBlocks_I - 1 ]; ------------------ | | 32| 136k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 136k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 136k|#define SYS_T 119 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 136k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 505| 136k| } 506| 88| } 507| | 508| 272k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 176|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 176|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 176|#define GFBITS 13 | | ------------------ ------------------ | Branch (508:34): [True: 272k, False: 176] ------------------ 509| 210M| for (i = PK_NROWS - 1; i > row; i--) { ------------------ | | 13| 272k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 272k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 272k|#define GFBITS 13 | | ------------------ ------------------ | Branch (509:36): [True: 210M, False: 272k] ------------------ 510| 210M| mm = extract_mask256(mat.w[row], i); 511| | 512| 2.52G| for (k = 0; k < 11; k++) { ------------------ | Branch (512:29): [True: 2.31G, False: 210M] ------------------ 513| 2.31G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 514| 2.31G| } 515| 210M| } 516| 272k| } 517| | 518| 176| if (j == 6) { ------------------ | Branch (518:13): [True: 88, False: 88] ------------------ 519| 136k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 136k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 136k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 136k|#define GFBITS 13 | | ------------------ ------------------ | Branch (519:27): [True: 136k, False: 88] ------------------ 520| 5.98M| for (i = 0; i < 43; i++) { ------------------ | Branch (520:29): [True: 5.85M, False: 136k] ------------------ 521| 5.85M| store8(pk + PK_ROW_BYTES * row + i * 8, (par.w[row][i] >> head) | (par.w[row][i + 1] << (64 - head))); ------------------ | | 15| 5.85M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 5.85M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 5.85M|#define SYS_N 6960 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 5.85M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 5.85M|#define SYS_T 119 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 5.85M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 522| 5.85M| } 523| | 524| 136k| buf[row] = par.w[row][i] >> head; 525| 136k| } 526| 88| } else { 527| 136k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 136k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 136k|#define SYS_T 119 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 136k|#define GFBITS 13 | | ------------------ ------------------ | Branch (527:27): [True: 136k, False: 88] ------------------ 528| 136k| store8(pk + PK_ROW_BYTES * row + 43 * 8, buf[row] | (par.w[row][0] << (64 - head))); ------------------ | | 15| 136k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 136k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 136k|#define SYS_N 6960 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 136k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 136k|#define SYS_T 119 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 136k|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 529| | 530| 5.58M| for (i = 0; i < 40; i++) { ------------------ | Branch (530:29): [True: 5.44M, False: 136k] ------------------ 531| 5.44M| store8(pk + PK_ROW_BYTES * row + (i + 44) * 8, (par.w[row][i] >> head) | (par.w[row][i + 1] << (64 - head))); ------------------ | | 15| 5.44M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 5.44M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 5.44M|#define SYS_N 6960 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 5.44M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 5.44M|#define SYS_T 119 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 5.44M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 532| 5.44M| } 533| | 534| 136k| par.w[row][i] >>= head; 535| 136k| par.w[row][i] &= (one << tail) - 1; 536| | 537| 136k| store_i(pk + PK_ROW_BYTES * row + (i + 44) * 8, par.w[row][i], (tail + 7) / 8); ------------------ | | 15| 136k|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 136k|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 136k|#define SYS_N 6960 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 136k|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 136k|#define SYS_T 119 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 136k|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 538| 136k| } 539| 88| } 540| | 541| 176| } 542| | 543| | // 544| | 545| 88| return 0; 546| 88|} PQCLEAN_MCELIECE6960119F_AVX2_genpoly_gen: 88| 115|int genpoly_gen(gf *out, gf *f) { 89| 115| int i, j, k; 90| | 91| 115| gf t, inv; 92| | 93| 115| uint64_t m; 94| 115| vec128 mask; 95| | 96| 115| union { 97| 115| uint64_t d[ GFBITS ][ 128 ][2]; 98| 115| vec128 v[ GFBITS ][ 128 ]; 99| 115| } buf; 100| | 101| 115| union { 102| 115| uint64_t d[GFBITS][2]; 103| 115| vec128 v[GFBITS]; 104| 115| } v; 105| | 106| 115| union { 107| 115| uint64_t d[SYS_T][GFBITS][2]; 108| 115| vec128 v[SYS_T][GFBITS]; 109| 115| } mat; 110| | 111| | // fill matrix 112| | 113| 115| buf.v[0][0] = vec128_set2x(1, 0); 114| 1.49k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.49k|#define GFBITS 13 ------------------ | Branch (114:17): [True: 1.38k, False: 115] ------------------ 115| 1.38k| buf.v[i][0] = vec128_setzero(); 116| 1.38k| } 117| | 118| 1.61k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 1.61k|#define GFBITS 13 ------------------ | Branch (118:17): [True: 1.49k, False: 115] ------------------ 119| 1.49k| v.v[j] = vec128_setzero(); 120| | 121| 179k| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 1.49k|#define SYS_T 119 ------------------ | Branch (121:29): [True: 177k, False: 1.49k] ------------------ 122| 177k| v.d[j][1] <<= 1; 123| 177k| v.d[j][1] |= v.d[j][0] >> 63; 124| 177k| v.d[j][0] <<= 1; 125| 177k| v.d[j][0] |= (f[i] >> j) & 1; 126| 177k| } 127| 1.49k| } 128| | 129| 1.61k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.61k|#define GFBITS 13 ------------------ | Branch (129:17): [True: 1.49k, False: 115] ------------------ 130| 1.49k| buf.v[i][1] = v.v[i]; 131| 1.49k| } 132| | 133| 13.6k| for (k = 2; k <= SYS_T; k++) { ------------------ | | 8| 13.6k|#define SYS_T 119 ------------------ | Branch (133:17): [True: 13.5k, False: 115] ------------------ 134| 13.5k| vec128_mul_GF(v.v, v.v, f); ------------------ | | 11| 13.5k|#define vec128_mul_GF CRYPTO_NAMESPACE(vec128_mul_GF) | | ------------------ | | | | 4| 13.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 135| | 136| 13.5k| if (k < SYS_T) { ------------------ | | 8| 13.5k|#define SYS_T 119 ------------------ | Branch (136:13): [True: 13.4k, False: 115] ------------------ 137| 188k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 188k|#define GFBITS 13 ------------------ | Branch (137:25): [True: 174k, False: 13.4k] ------------------ 138| 174k| buf.v[i][k] = v.v[i]; 139| 174k| } 140| 13.4k| } else { 141| 13.8k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 13.8k|#define SYS_T 119 ------------------ | Branch (141:25): [True: 13.6k, False: 115] ------------------ 142| 13.6k| out[i] = extract_gf(v.d, i); 143| 13.6k| } 144| 115| } 145| 13.5k| } 146| | 147| 1.61k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.61k|#define GFBITS 13 ------------------ | Branch (147:17): [True: 1.49k, False: 115] ------------------ 148| 1.49k| transpose_128x128(buf.d[i]); 149| 1.49k| } 150| | 151| 13.8k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 13.8k|#define SYS_T 119 ------------------ | Branch (151:17): [True: 13.6k, False: 115] ------------------ 152| 191k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 191k|#define GFBITS 13 ------------------ | Branch (152:21): [True: 177k, False: 13.6k] ------------------ 153| 177k| mat.v[j][i] = buf.v[i][j]; 154| 177k| } 155| 13.6k| } 156| | 157| | // gaussian 158| | 159| 13.8k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 13.8k|#define SYS_T 119 ------------------ | Branch (159:17): [True: 13.6k, False: 115] ------------------ 160| 821k| for (j = i + 1; j < SYS_T; j++) { ------------------ | | 8| 821k|#define SYS_T 119 ------------------ | Branch (160:25): [True: 807k, False: 13.6k] ------------------ 161| 807k| m = extract_bit(mat.d[i], i); 162| 807k| m -= 1; 163| 807k| mask = vec128_set2x(m, m); 164| | 165| 11.3M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 11.3M|#define GFBITS 13 ------------------ | Branch (165:25): [True: 10.4M, False: 807k] ------------------ 166| 10.4M| mat.v[i][k] ^= mat.v[j][k] & mask; 167| 10.4M| } 168| | 169| 807k| out[i] ^= out[j] & m; 170| 807k| } 171| | 172| | // 173| | 174| 13.6k| t = extract_gf(mat.d[i], i); 175| | 176| 13.6k| if (gf_is_zero_declassify(t)) { ------------------ | Branch (176:13): [True: 0, False: 13.6k] ------------------ 177| 0| return -1; // return if not systematic 178| 0| } 179| | 180| | // 181| | 182| 13.6k| inv = gf_inv(t); ------------------ | | 11| 13.6k|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 13.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 183| 13.6k| vec128_mul_gf(mat.v[i], mat.v[i], inv); 184| | 185| 13.6k| out[i] = gf_mul(out[i], inv); ------------------ | | 14| 13.6k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 13.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 186| | 187| 1.64M| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 1.64M|#define SYS_T 119 ------------------ | Branch (187:21): [True: 1.62M, False: 13.6k] ------------------ 188| 1.62M| if (j != i) { ------------------ | Branch (188:17): [True: 1.61M, False: 13.6k] ------------------ 189| 1.61M| t = extract_gf(mat.d[j], i); 190| | 191| 1.61M| vec128_mul_gf(v.v, mat.v[i], t); 192| 1.61M| vec128_add(mat.v[j], mat.v[j], v.v); 193| | 194| 1.61M| out[j] ^= gf_mul(out[i], t); ------------------ | | 14| 1.61M|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 1.61M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 195| 1.61M| } 196| 1.62M| } 197| 13.6k| } 198| | 199| 115| return 0; 200| 115|} PQCLEAN_MCELIECE6960119F_AVX2_vec128_mul_GF: 6| 13.5k|void vec128_mul_GF(vec128 out[ GFBITS ], vec128 v[ GFBITS ], gf a[ SYS_T ]) { 7| 13.5k| int i, j; 8| 13.5k| uint64_t buf[GFBITS][4]; 9| 13.5k| vec128 prod[GFBITS]; 10| 13.5k| uint64_t p[GFBITS]; 11| | 12| 13.5k| const uint64_t allone = -1; 13| | 14| | // polynomial multiplication 15| | 16| 189k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 189k|#define GFBITS 13 ------------------ | Branch (16:17): [True: 176k, False: 13.5k] ------------------ 17| 176k| buf[i][0] = 0; 18| 176k| buf[i][1] = 0; 19| 176k| buf[i][2] = 0; 20| 176k| buf[i][3] = 0; 21| 176k| } 22| | 23| 1.62M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 13.5k|#define SYS_T 119 ------------------ | Branch (23:25): [True: 1.61M, False: 13.5k] ------------------ 24| 22.6M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 22.6M|#define GFBITS 13 ------------------ | Branch (24:21): [True: 20.9M, False: 1.61M] ------------------ 25| 20.9M| buf[j][3] <<= 1; 26| 20.9M| buf[j][3] |= buf[j][2] >> 63; 27| 20.9M| buf[j][2] <<= 1; 28| 20.9M| buf[j][2] |= buf[j][1] >> 63; 29| 20.9M| buf[j][1] <<= 1; 30| 20.9M| buf[j][1] |= buf[j][0] >> 63; 31| 20.9M| buf[j][0] <<= 1; 32| 20.9M| } 33| | 34| 1.61M| vec128_mul_gf(prod, v, a[i]); 35| | 36| 22.6M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 22.6M|#define GFBITS 13 ------------------ | Branch (36:21): [True: 20.9M, False: 1.61M] ------------------ 37| 20.9M| buf[j][0] ^= vec128_extract(prod[j], 0); ------------------ | | 29| 20.9M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 38| 20.9M| buf[j][1] ^= vec128_extract(prod[j], 1); ------------------ | | 29| 20.9M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 39| 20.9M| } 40| 1.61M| } 41| | 42| | // reduction modulo y^119 + y^8 + 1 43| | 44| 189k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 189k|#define GFBITS 13 ------------------ | Branch (44:17): [True: 176k, False: 13.5k] ------------------ 45| 176k| p[i] = buf[i][3]; 46| | 47| 176k| buf[i][2] ^= p[i] >> (SYS_T - 8 - 64); ------------------ | | 8| 176k|#define SYS_T 119 ------------------ 48| 176k| buf[i][1] ^= p[i] << (64 - (SYS_T - 8 - 64)); ------------------ | | 8| 176k|#define SYS_T 119 ------------------ 49| 176k| buf[i][2] ^= p[i] >> (SYS_T - 64); ------------------ | | 8| 176k|#define SYS_T 119 ------------------ 50| 176k| buf[i][1] ^= p[i] << (64 - (SYS_T - 64)); ------------------ | | 8| 176k|#define SYS_T 119 ------------------ 51| 176k| } 52| | 53| | // 54| | 55| 189k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 189k|#define GFBITS 13 ------------------ | Branch (55:17): [True: 176k, False: 13.5k] ------------------ 56| 176k| p[i] = buf[i][2]; 57| | 58| 176k| buf[i][1] ^= p[i] >> (SYS_T - 8 - 64); ------------------ | | 8| 176k|#define SYS_T 119 ------------------ 59| 176k| buf[i][0] ^= p[i] << (64 - (SYS_T - 8 - 64)); ------------------ | | 8| 176k|#define SYS_T 119 ------------------ 60| 176k| buf[i][1] ^= p[i] >> (SYS_T - 64); ------------------ | | 8| 176k|#define SYS_T 119 ------------------ 61| 176k| buf[i][0] ^= p[i] << (64 - (SYS_T - 64)); ------------------ | | 8| 176k|#define SYS_T 119 ------------------ 62| 176k| } 63| | 64| | // 65| | 66| 189k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 189k|#define GFBITS 13 ------------------ | Branch (66:17): [True: 176k, False: 13.5k] ------------------ 67| 176k| p[i] = buf[i][1] & (allone << (SYS_T - 64)); ------------------ | | 8| 176k|#define SYS_T 119 ------------------ 68| | 69| 176k| buf[i][0] ^= p[i] >> (SYS_T - 8 - 64); ------------------ | | 8| 176k|#define SYS_T 119 ------------------ 70| 176k| buf[i][0] ^= p[i] >> (SYS_T - 64); ------------------ | | 8| 176k|#define SYS_T 119 ------------------ 71| 176k| } 72| | 73| | // 74| | 75| 189k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 189k|#define GFBITS 13 ------------------ | Branch (75:17): [True: 176k, False: 13.5k] ------------------ 76| 176k| out[i] = vec128_set2x(buf[i][0], buf[i][1] & (allone >> (128 - SYS_T))); ------------------ | | 8| 176k|#define SYS_T 119 ------------------ 77| 176k| } 78| 13.5k|} PQCLEAN_MCELIECE6960119F_AVX2_vec256_sq: 9| 5.25k|void vec256_sq(vec256 *out, vec256 *in) { 10| 5.25k| int i; 11| 5.25k| vec256 result[GFBITS], t; 12| | 13| 5.25k| t = vec256_xor(in[11], in[12]); 14| | 15| 5.25k| result[0] = vec256_xor(in[0], in[11]); 16| 5.25k| result[1] = vec256_xor(in[7], t); 17| 5.25k| result[2] = vec256_xor(in[1], in[7]); 18| 5.25k| result[3] = vec256_xor(in[8], t); 19| 5.25k| result[4] = vec256_xor(in[2], in[7]); 20| 5.25k| result[4] = vec256_xor(result[4], in[8]); 21| 5.25k| result[4] = vec256_xor(result[4], t); 22| 5.25k| result[5] = vec256_xor(in[7], in[9]); 23| 5.25k| result[6] = vec256_xor(in[3], in[8]); 24| 5.25k| result[6] = vec256_xor(result[6], in[9]); 25| 5.25k| result[6] = vec256_xor(result[6], in[12]); 26| 5.25k| result[7] = vec256_xor(in[8], in[10]); 27| 5.25k| result[8] = vec256_xor(in[4], in[9]); 28| 5.25k| result[8] = vec256_xor(result[8], in[10]); 29| 5.25k| result[9] = vec256_xor(in[9], in[11]); 30| 5.25k| result[10] = vec256_xor(in[5], in[10]); 31| 5.25k| result[10] = vec256_xor(result[10], in[11]); 32| 5.25k| result[11] = vec256_xor(in[10], in[12]); 33| 5.25k| result[12] = vec256_xor(in[6], t); 34| | 35| 73.5k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 73.5k|#define GFBITS 13 ------------------ | Branch (35:17): [True: 68.2k, False: 5.25k] ------------------ 36| 68.2k| out[i] = result[i]; 37| 68.2k| } 38| 5.25k|} PQCLEAN_MCELIECE6960119F_AVX2_vec256_inv: 41| 203|void vec256_inv(vec256 *out, vec256 *in) { 42| 203| vec256 tmp_11[ GFBITS ]; 43| 203| vec256 tmp_1111[ GFBITS ]; 44| | 45| 203| vec256_copy(out, in); 46| | 47| 203| vec256_sq(out, out); ------------------ | | 14| 203|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 203|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 48| 203| vec256_mul(tmp_11, out, in); // ^11 49| | 50| 203| vec256_sq(out, tmp_11); ------------------ | | 14| 203|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 203|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 51| 203| vec256_sq(out, out); ------------------ | | 14| 203|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 203|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 52| 203| vec256_mul(tmp_1111, out, tmp_11); // ^1111 53| | 54| 203| vec256_sq(out, tmp_1111); ------------------ | | 14| 203|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 203|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 55| 203| vec256_sq(out, out); ------------------ | | 14| 203|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 203|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 56| 203| vec256_sq(out, out); ------------------ | | 14| 203|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 203|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 57| 203| vec256_sq(out, out); ------------------ | | 14| 203|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 203|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 58| 203| vec256_mul(out, out, tmp_1111); // ^11111111 59| | 60| 203| vec256_sq(out, out); ------------------ | | 14| 203|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 203|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 61| 203| vec256_sq(out, out); ------------------ | | 14| 203|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 203|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 62| 203| vec256_sq(out, out); ------------------ | | 14| 203|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 203|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 63| 203| vec256_sq(out, out); ------------------ | | 14| 203|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 203|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 64| 203| vec256_mul(out, out, tmp_1111); // ^111111111111 65| | 66| 203| vec256_sq(out, out); // ^1111111111110 ------------------ | | 14| 203|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 203|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE6960119F_AVX2_ ## fun | | ------------------ ------------------ 67| 203|} PQCLEAN_MCELIECE8192128_AVX2_load_bits: 188| 88|void load_bits(vec128 bits_int[][32], const unsigned char *bits) { 189| 88| int i, j; 190| 88| const unsigned char *ptr = bits; 191| | 192| 88| vec128 buf[64]; 193| | 194| 352| for (i = 0; i <= 5; i += 2) { ------------------ | Branch (194:17): [True: 264, False: 88] ------------------ 195| 17.1k| for (j = 0; j < 64; j++) { ------------------ | Branch (195:21): [True: 16.8k, False: 264] ------------------ 196| 16.8k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 197| 16.8k| ptr += 8; 198| 16.8k| } 199| | 200| 264| transpose_64x128_sp( buf ); 201| | 202| 8.71k| for (j = 0; j < 32; j++) { ------------------ | Branch (202:21): [True: 8.44k, False: 264] ------------------ 203| 8.44k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 204| 8.44k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 205| 8.44k| } 206| | 207| 264| ptr += 512; 208| 264| } 209| | 210| 1.23k| for (i = 6; i <= 18; i++) { ------------------ | Branch (210:17): [True: 1.14k, False: 88] ------------------ 211| 37.7k| for (j = 0; j < 32; j++) { ------------------ | Branch (211:21): [True: 36.6k, False: 1.14k] ------------------ 212| 36.6k| bits_int[i][j] = load16(ptr); 213| 36.6k| ptr += 16; 214| 36.6k| } 215| 1.14k| } 216| | 217| 352| for (i = 19; i < 25; i += 2) { ------------------ | Branch (217:18): [True: 264, False: 88] ------------------ 218| 17.1k| for (j = 0; j < 64; j++) { ------------------ | Branch (218:21): [True: 16.8k, False: 264] ------------------ 219| 16.8k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 220| 16.8k| ptr += 8; 221| 16.8k| } 222| | 223| 264| transpose_64x128_sp( buf ); 224| | 225| 8.71k| for (j = 0; j < 32; j++) { ------------------ | Branch (225:21): [True: 8.44k, False: 264] ------------------ 226| 8.44k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 227| 8.44k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 228| 8.44k| } 229| | 230| 264| ptr += 512; 231| 264| } 232| 88|} PQCLEAN_MCELIECE8192128_AVX2_benes: 238| 176|void benes(vec128 *r, vec128 b[][32], int rev) { 239| 176| int inc; 240| | 241| 176| vec128 *b_ptr; 242| | 243| 176| if (rev == 0) { ------------------ | Branch (243:9): [True: 88, False: 88] ------------------ 244| 88| inc = 32; 245| 88| b_ptr = b[ 0]; 246| 88| } else { 247| 88| inc = -32; 248| 88| b_ptr = b[24]; 249| 88| } 250| | 251| | // 252| | 253| 176| transpose_64x128_sp( r ); 254| | 255| 176| layer_0(r, b_ptr); 256| 176| b_ptr += inc; 257| 176| layer_1(r, b_ptr); 258| 176| b_ptr += inc; 259| 176| layer_2(r, b_ptr); 260| 176| b_ptr += inc; 261| 176| layer_3(r, b_ptr); 262| 176| b_ptr += inc; 263| 176| layer_4(r, b_ptr); 264| 176| b_ptr += inc; 265| 176| layer_5(r, b_ptr); 266| 176| b_ptr += inc; 267| | 268| 176| transpose_64x128_sp( r ); 269| | 270| 176| layer_x(r, b_ptr); 271| 176| b_ptr += inc; 272| 176| layer_0(r, b_ptr); 273| 176| b_ptr += inc; 274| 176| layer_1(r, b_ptr); 275| 176| b_ptr += inc; 276| 176| layer_2(r, b_ptr); 277| 176| b_ptr += inc; 278| 176| layer_3(r, b_ptr); 279| 176| b_ptr += inc; 280| 176| layer_4(r, b_ptr); 281| 176| b_ptr += inc; 282| 176| layer_5(r, b_ptr); 283| 176| b_ptr += inc; 284| 176| layer_4(r, b_ptr); 285| 176| b_ptr += inc; 286| 176| layer_3(r, b_ptr); 287| 176| b_ptr += inc; 288| 176| layer_2(r, b_ptr); 289| 176| b_ptr += inc; 290| 176| layer_1(r, b_ptr); 291| 176| b_ptr += inc; 292| 176| layer_0(r, b_ptr); 293| 176| b_ptr += inc; 294| 176| layer_x(r, b_ptr); 295| 176| b_ptr += inc; 296| | 297| 176| transpose_64x128_sp( r ); 298| | 299| 176| layer_5(r, b_ptr); 300| 176| b_ptr += inc; 301| 176| layer_4(r, b_ptr); 302| 176| b_ptr += inc; 303| 176| layer_3(r, b_ptr); 304| 176| b_ptr += inc; 305| 176| layer_2(r, b_ptr); 306| 176| b_ptr += inc; 307| 176| layer_1(r, b_ptr); 308| 176| b_ptr += inc; 309| 176| layer_0(r, b_ptr); 310| | 311| 176| transpose_64x128_sp( r ); 312| 176|} PQCLEAN_MCELIECE8192128_AVX2_bm: 147| 88|void bm(vec128 *out, vec256 *in) { 148| 88| int i; 149| 88| uint16_t N, L; 150| 88| uint16_t mask; 151| 88| uint64_t one = 1, t; 152| | 153| 88| vec128 prod[ GFBITS ]; 154| 88| vec128 interval[GFBITS]; 155| | 156| 88| typedef union { 157| 88| vec128 v[GFBITS][2]; 158| 88| vec256 V[GFBITS]; 159| 88| } db_t; 160| | 161| 88| db_t db; 162| 88| db_t BC_tmp; 163| 88| db_t BC; 164| | 165| 88| gf d, b, c0 = 1; 166| 88| gf coefs[256]; 167| | 168| | // initialization 169| | 170| 88| get_coefs(coefs, in); 171| | 172| 88| BC.v[0][0] = vec128_set2x(0, one << 63); 173| 88| BC.v[0][1] = vec128_setzero(); 174| | 175| 1.14k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.14k|#define GFBITS 13 ------------------ | Branch (175:17): [True: 1.05k, False: 88] ------------------ 176| 1.05k| BC.v[i][0] = BC.v[i][1] = vec128_setzero(); 177| 1.05k| } 178| | 179| 88| b = 1; 180| 88| L = 0; 181| | 182| | // 183| | 184| 1.23k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.23k|#define GFBITS 13 ------------------ | Branch (184:17): [True: 1.14k, False: 88] ------------------ 185| 1.14k| interval[i] = vec128_setzero(); 186| 1.14k| } 187| | 188| 22.6k| for (N = 0; N < 256; N++) { ------------------ | Branch (188:17): [True: 22.5k, False: 88] ------------------ 189| 22.5k| vec128_mul_asm(prod, interval, BC.v[0] + 1, 32); ------------------ | | 10| 22.5k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 22.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 190| 22.5k| update_asm(interval, coefs[N], 16); ------------------ | | 1| 22.5k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 22.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 191| | 192| 22.5k| d = vec_reduce_asm(prod); ------------------ | | 3| 22.5k|#define vec_reduce_asm CRYPTO_NAMESPACE(vec_reduce_asm) | | ------------------ | | | | 4| 22.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 193| | 194| 22.5k| t = gf_mul2(c0, coefs[N], b); ------------------ | | 13| 22.5k|#define gf_mul2 CRYPTO_NAMESPACE(gf_mul2) | | ------------------ | | | | 4| 22.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 195| 22.5k| d ^= t & 0xFFFFFFFF; 196| | 197| 22.5k| mask = mask_nonzero(d) & mask_leq(L * 2, N); 198| | 199| 315k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 315k|#define GFBITS 13 ------------------ | Branch (199:21): [True: 292k, False: 22.5k] ------------------ 200| 292k| db.v[i][0] = vec128_setbits((d >> i) & 1); 201| 292k| db.v[i][1] = vec128_setbits((b >> i) & 1); 202| 292k| } 203| | 204| 22.5k| vec256_mul((vec256 *) BC_tmp.V, (vec256 *) db.V, (vec256 *) BC.V); 205| | 206| 22.5k| vec128_cmov(BC.v, mask); 207| 22.5k| update_asm(BC.v, c0 & mask, 32); ------------------ | | 1| 22.5k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 22.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| 315k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 315k|#define GFBITS 13 ------------------ | Branch (209:21): [True: 292k, False: 22.5k] ------------------ 210| 292k| BC.v[i][1] = vec128_xor(BC_tmp.v[i][0], BC_tmp.v[i][1]); 211| 292k| } 212| | 213| 22.5k| c0 = t >> 32; 214| 22.5k| b = (d & mask) | (b & ~mask); 215| 22.5k| L = ((N + 1 - L) & mask) | (L & ~mask); 216| 22.5k| } 217| | 218| 88| c0 = gf_inv(c0); ------------------ | | 11| 88|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 219| | 220| 1.23k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.23k|#define GFBITS 13 ------------------ | Branch (220:17): [True: 1.14k, False: 88] ------------------ 221| 1.14k| prod[i] = vec128_setbits((c0 >> i) & 1); 222| 1.14k| } 223| | 224| 88| vec128_mul_asm(out, prod, BC.v[0] + 1, 32); ------------------ | | 10| 88|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 225| 88|} PQCLEAN_MCELIECE8192128_AVX2_controlbitsfrompermutation: 205| 88|void controlbitsfrompermutation(unsigned char *out, const int16 *pi, long long w, long long n) { 206| 88| PQCLEAN_VLA(int32, temp, (size_t)(2 * n)); ------------------ | | 57| 88|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 207| 88| PQCLEAN_VLA(int16, pi_test, (size_t)n); ------------------ | | 57| 88|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 208| 88| int16 diff; 209| 88| int i; 210| 88| unsigned char *ptr; 211| | 212| 88| OQS_MEM_cleanse(temp, (size_t)n * 2); 213| 88| OQS_MEM_cleanse(pi_test, (size_t)n); 214| | 215| 88| while (1) { ------------------ | Branch (215:12): [True: 88, Folded] ------------------ 216| 88| OQS_MEM_cleanse(out, (size_t)((((2 * w - 1)*n / 2) + 7) / 8)); 217| 88| cbrecursion(out, 0, 1, pi, w, n, temp); 218| | 219| | // check for correctness 220| | 221| 720k| for (i = 0; i < n; i++) { ------------------ | Branch (221:21): [True: 720k, False: 88] ------------------ 222| 720k| pi_test[i] = (int16)i; 223| 720k| } 224| | 225| 88| ptr = out; 226| 1.23k| for (i = 0; i < w; i++) { ------------------ | Branch (226:21): [True: 1.14k, False: 88] ------------------ 227| 1.14k| layer(pi_test, ptr, i, (int32)n); 228| 1.14k| ptr += n >> 4; 229| 1.14k| } 230| | 231| 1.14k| for (i = (int)(w - 2); i >= 0; i--) { ------------------ | Branch (231:32): [True: 1.05k, False: 88] ------------------ 232| 1.05k| layer(pi_test, ptr, i, (int32)n); 233| 1.05k| ptr += n >> 4; 234| 1.05k| } 235| | 236| 88| diff = 0; 237| 720k| for (i = 0; i < n; i++) { ------------------ | Branch (237:21): [True: 720k, False: 88] ------------------ 238| 720k| diff |= pi[i] ^ pi_test[i]; 239| 720k| } 240| | 241| 88| diff = crypto_int16_nonzero_mask(diff); ------------------ | | 12| 88|#define crypto_int16_nonzero_mask CRYPTO_NAMESPACE(crypto_int16_nonzero_mask) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 242| 88| crypto_declassify(&diff, sizeof diff); 243| 88| if (diff == 0) { ------------------ | Branch (243:13): [True: 88, False: 0] ------------------ 244| 88| break; 245| 88| } 246| 88| } 247| 88|} PQCLEAN_MCELIECE8192128_AVX2_crypto_int16_negative_mask: 3| 176|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 4| 176| return crypto_int16_x >> 15; 5| 176|} PQCLEAN_MCELIECE8192128_AVX2_crypto_int16_nonzero_mask: 7| 88|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 8| 88| return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 88|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 88|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 9| 88|} PQCLEAN_MCELIECE8192128_AVX2_crypto_int32_negative_mask: 3| 56.2M|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 4| 56.2M| return crypto_int32_x >> 31; 5| 56.2M|} PQCLEAN_MCELIECE8192128_AVX2_crypto_int32_min: 37| 56.2M|crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x, crypto_int32 crypto_int32_y) { 38| 56.2M| crypto_int32 crypto_int32_xy = crypto_int32_y ^ crypto_int32_x; 39| 56.2M| crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x; 40| 56.2M| crypto_int32_z ^= crypto_int32_xy & (crypto_int32_z ^ crypto_int32_y); 41| 56.2M| crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); ------------------ | | 9| 56.2M|#define crypto_int32_negative_mask CRYPTO_NAMESPACE(crypto_int32_negative_mask) | | ------------------ | | | | 4| 56.2M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 42| 56.2M| crypto_int32_z &= crypto_int32_xy; 43| 56.2M| return crypto_int32_x ^ crypto_int32_z; 44| 56.2M|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint16_signed_negative_mask: 3| 188k|crypto_uint16_signed crypto_uint16_signed_negative_mask(crypto_uint16_signed crypto_uint16_signed_x) { 4| 188k| return crypto_uint16_signed_x >> 15; 5| 188k|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint16_nonzero_mask: 7| 94.3k|crypto_uint16 crypto_uint16_nonzero_mask(crypto_uint16 crypto_uint16_x) { 8| 94.3k| return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 94.3k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 94.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 94.3k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 94.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 9| 94.3k|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint16_zero_mask: 11| 94.3k|crypto_uint16 crypto_uint16_zero_mask(crypto_uint16 crypto_uint16_x) { 12| 94.3k| return ~crypto_uint16_nonzero_mask(crypto_uint16_x); ------------------ | | 13| 94.3k|#define crypto_uint16_nonzero_mask CRYPTO_NAMESPACE(crypto_uint16_nonzero_mask) | | ------------------ | | | | 4| 94.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 13| 94.3k|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint32_signed_negative_mask: 3| 103k|crypto_uint32_signed crypto_uint32_signed_negative_mask(crypto_uint32_signed crypto_uint32_signed_x) { 4| 103k| return crypto_uint32_signed_x >> 31; 5| 103k|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint32_nonzero_mask: 7| 51.6k|crypto_uint32 crypto_uint32_nonzero_mask(crypto_uint32 crypto_uint32_x) { 8| 51.6k| return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 51.6k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 51.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 51.6k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 51.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 9| 51.6k|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint32_unequal_mask: 15| 51.6k|crypto_uint32 crypto_uint32_unequal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 16| 51.6k| crypto_uint32 crypto_uint32_xy = crypto_uint32_x ^ crypto_uint32_y; 17| 51.6k| return crypto_uint32_nonzero_mask(crypto_uint32_xy); ------------------ | | 13| 51.6k|#define crypto_uint32_nonzero_mask CRYPTO_NAMESPACE(crypto_uint32_nonzero_mask) | | ------------------ | | | | 4| 51.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 18| 51.6k|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint32_equal_mask: 20| 51.6k|crypto_uint32 crypto_uint32_equal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 21| 51.6k| return ~crypto_uint32_unequal_mask(crypto_uint32_x, crypto_uint32_y); ------------------ | | 17| 51.6k|#define crypto_uint32_unequal_mask CRYPTO_NAMESPACE(crypto_uint32_unequal_mask) | | ------------------ | | | | 4| 51.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 22| 51.6k|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint64_signed_negative_mask: 3| 14.0M|crypto_uint64_signed crypto_uint64_signed_negative_mask(crypto_uint64_signed crypto_uint64_signed_x) { 4| 14.0M| return crypto_uint64_signed_x >> 63; 5| 14.0M|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint64_nonzero_mask: 7| 7.04M|crypto_uint64 crypto_uint64_nonzero_mask(crypto_uint64 crypto_uint64_x) { 8| 7.04M| return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 7.04M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 7.04M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 7.04M|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 7.04M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 9| 7.04M|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint64_zero_mask: 11| 1.16M|crypto_uint64 crypto_uint64_zero_mask(crypto_uint64 crypto_uint64_x) { 12| 1.16M| return ~crypto_uint64_nonzero_mask(crypto_uint64_x); ------------------ | | 13| 1.16M|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 1.16M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 13| 1.16M|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint64_unequal_mask: 15| 5.87M|crypto_uint64 crypto_uint64_unequal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 16| 5.87M| crypto_uint64 crypto_uint64_xy = crypto_uint64_x ^ crypto_uint64_y; 17| 5.87M| return crypto_uint64_nonzero_mask(crypto_uint64_xy); ------------------ | | 13| 5.87M|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 5.87M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 18| 5.87M|} PQCLEAN_MCELIECE8192128_AVX2_crypto_uint64_equal_mask: 20| 5.87M|crypto_uint64 crypto_uint64_equal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 21| 5.87M| return ~crypto_uint64_unequal_mask(crypto_uint64_x, crypto_uint64_y); ------------------ | | 17| 5.87M|#define crypto_uint64_unequal_mask CRYPTO_NAMESPACE(crypto_uint64_unequal_mask) | | ------------------ | | | | 4| 5.87M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 22| 5.87M|} PQCLEAN_MCELIECE8192128_AVX2_decrypt: 141| 88|int decrypt(unsigned char *e, const unsigned char *sk, const unsigned char *s) { 142| 88| int i; 143| | 144| 88| uint16_t check_synd; 145| 88| uint16_t check_weight; 146| | 147| 88| vec256 inv[ 64 ][ GFBITS ]; 148| 88| vec256 scaled[ 64 ][ GFBITS ]; 149| 88| vec256 eval[ 64 ][ GFBITS ]; 150| | 151| 88| vec128 error128[ 64 ]; 152| 88| vec256 error256[ 32 ]; 153| | 154| 88| vec256 s_priv[ GFBITS ]; 155| 88| vec256 s_priv_cmp[ GFBITS ]; 156| 88| vec128 locator[ GFBITS ]; 157| | 158| 88| vec128 recv128[ 64 ]; 159| 88| vec256 recv256[ 32 ]; 160| 88| vec256 allone; 161| | 162| 88| vec128 bits_int[25][32]; 163| | 164| | // Berlekamp decoder 165| | 166| 88| preprocess(recv128, s); 167| | 168| 88| load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 10| 88|#define load_bits CRYPTO_NAMESPACE(load_bits) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 11| 88|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 88|#define SYS_T 128 | | ------------------ ------------------ 169| 88| benes(recv128, bits_int, 1); ------------------ | | 9| 88|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 170| 88| reformat_128to256(recv256, recv128); 171| | 172| 88| scaling(scaled, inv, sk, recv256); // scaling 173| 88| fft_tr(s_priv, scaled); // transposed FFT ------------------ | | 9| 88|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 174| 88| bm(locator, s_priv); // Berlekamp Massey ------------------ | | 10| 88|#define bm CRYPTO_NAMESPACE(bm) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 175| | 176| 88| fft(eval, locator); // FFT ------------------ | | 10| 88|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 177| | 178| | // reencryption and weight check 179| | 180| 88| allone = vec256_set1_16b(0xFFFF); 181| | 182| 2.90k| for (i = 0; i < 32; i++) { ------------------ | Branch (182:17): [True: 2.81k, False: 88] ------------------ 183| 2.81k| error256[i] = vec256_or_reduce(eval[i]); 184| 2.81k| error256[i] = vec256_xor(error256[i], allone); 185| 2.81k| } 186| | 187| 88| check_weight = weight(error256) ^ SYS_T; ------------------ | | 8| 88|#define SYS_T 128 ------------------ 188| 88| check_weight -= 1; 189| 88| check_weight >>= 15; 190| | 191| 88| scaling_inv(scaled, inv, error256); 192| 88| fft_tr(s_priv_cmp, scaled); ------------------ | | 9| 88|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 193| | 194| 88| check_synd = synd_cmp(s_priv, s_priv_cmp); 195| | 196| | // 197| | 198| 88| reformat_256to128(error128, error256); 199| 88| benes(error128, bits_int, 0); ------------------ | | 9| 88|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 200| | 201| 5.72k| for (i = 0; i < 64; i++) { ------------------ | Branch (201:17): [True: 5.63k, False: 88] ------------------ 202| 5.63k| store16(e + i * 16, error128[i]); 203| 5.63k| } 204| | 205| 88| return 1 - (check_synd & check_weight); 206| 88|} decrypt.c:weight: 81| 154|static int weight(vec256 *v) { 82| 154| int i, w = 0; 83| | 84| 5.08k| for (i = 0; i < 32; i++) { ------------------ | Branch (84:17): [True: 4.92k, False: 154] ------------------ 85| 4.92k| w += __builtin_popcountll( vec256_extract(v[i], 0) ); ------------------ | | 39| 4.92k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 86| 4.92k| w += __builtin_popcountll( vec256_extract(v[i], 1) ); ------------------ | | 39| 4.92k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 87| 4.92k| w += __builtin_popcountll( vec256_extract(v[i], 2) ); ------------------ | | 39| 4.92k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 88| 4.92k| w += __builtin_popcountll( vec256_extract(v[i], 3) ); ------------------ | | 39| 4.92k|#define vec256_extract(a,i) ((uint64_t) _mm256_extract_epi64((vec256) (a),(i))) ------------------ 89| 4.92k| } 90| | 91| 154| return w; 92| 154|} PQCLEAN_MCELIECE8192128_AVX2_encrypt: 87| 88|void encrypt(unsigned char *s, const unsigned char *pk, unsigned char *e) { 88| 88| gen_e(e); 89| | 90| 88| syndrome_asm(s, pk, e); ------------------ | | 1| 88|#define syndrome_asm CRYPTO_NAMESPACE(syndrome_asm) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 91| 88|} PQCLEAN_MCELIECE8192128_AVX2_fft: 277| 913|void fft(vec256 out[][GFBITS], vec128 *in) { 278| 913| radix_conversions(in); 279| 913| butterflies(out, in); 280| 913|} PQCLEAN_MCELIECE8192128_AVX2_fft_tr: 380| 176|void fft_tr(vec256 *out, vec256 in[][ GFBITS ]) { 381| 176| butterflies_tr(out, in); 382| 176| radix_conversions_tr(out); 383| 176|} PQCLEAN_MCELIECE8192128_AVX2_gf_mul: 12| 12.0M|gf gf_mul(gf in0, gf in1) { 13| 12.0M| int i; 14| | 15| 12.0M| uint64_t tmp; 16| 12.0M| uint64_t t0; 17| 12.0M| uint64_t t1; 18| 12.0M| uint64_t t; 19| | 20| 12.0M| t0 = in0; 21| 12.0M| t1 = in1; 22| | 23| 12.0M| tmp = t0 * (t1 & 1); 24| | 25| 156M| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 156M|#define GFBITS 13 ------------------ | Branch (25:17): [True: 144M, False: 12.0M] ------------------ 26| 144M| tmp ^= (t0 * (t1 & (1 << i))); 27| 144M| } 28| | 29| | // 30| | 31| 12.0M| t = tmp & 0x1FF0000; 32| 12.0M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 33| | 34| 12.0M| t = tmp & 0x000E000; 35| 12.0M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 36| | 37| 12.0M| return tmp & GFMASK; ------------------ | | 19| 12.0M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 12.0M|#define GFBITS 13 | | ------------------ ------------------ 38| 12.0M|} PQCLEAN_MCELIECE8192128_AVX2_gf_frac: 148| 94.4k|gf gf_frac(gf den, gf num) { 149| 94.4k| gf tmp_11; 150| 94.4k| gf tmp_1111; 151| 94.4k| gf out; 152| | 153| 94.4k| tmp_11 = gf_sqmul(den, den); // 11 154| 94.4k| tmp_1111 = gf_sq2mul(tmp_11, tmp_11); // 1111 155| 94.4k| out = gf_sq2(tmp_1111); 156| 94.4k| out = gf_sq2mul(out, tmp_1111); // 11111111 157| 94.4k| out = gf_sq2(out); 158| 94.4k| out = gf_sq2mul(out, tmp_1111); // 111111111111 159| | 160| 94.4k| return gf_sqmul(out, num); // 1111111111110 161| 94.4k|} PQCLEAN_MCELIECE8192128_AVX2_gf_inv: 164| 94.4k|gf gf_inv(gf den) { 165| 94.4k| return gf_frac(den, ((gf) 1)); ------------------ | | 10| 94.4k|#define gf_frac CRYPTO_NAMESPACE(gf_frac) | | ------------------ | | | | 4| 94.4k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 166| 94.4k|} bm.c:PQCLEAN_MCELIECE8192128_AVX2_gf_mul2: 31| 22.5k|static inline uint64_t gf_mul2(gf a, gf b0, gf b1) { 32| 22.5k| int i; 33| | 34| 22.5k| uint64_t tmp = 0; 35| 22.5k| uint64_t t0; 36| 22.5k| uint64_t t1; 37| 22.5k| uint64_t t; 38| 22.5k| uint64_t mask = 0x0000000100000001; 39| | 40| 22.5k| t0 = a; 41| 22.5k| t1 = b1; 42| 22.5k| t1 = (t1 << 32) | b0; 43| | 44| 315k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 315k|#define GFBITS 13 ------------------ | Branch (44:17): [True: 292k, False: 22.5k] ------------------ 45| 292k| tmp ^= t0 * (t1 & mask); 46| 292k| mask += mask; 47| 292k| } 48| | 49| | // 50| | 51| 22.5k| t = tmp & 0x01FF000001FF0000; 52| 22.5k| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 53| | 54| 22.5k| t = tmp & 0x0000E0000000E000; 55| 22.5k| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 56| | 57| 22.5k| return tmp & 0x00001FFF00001FFF; 58| 22.5k|} pk_gen.c:PQCLEAN_MCELIECE8192128_AVX2_int32_sort: 21| 88|static void int32_sort(int32_t *x, long long n) { 22| 88| long long top, p, q, r, i; 23| | 24| 88| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 88] ------------------ 25| 0| return; 26| 0| } 27| 88| top = 1; 28| 968| while (top < n - top) { ------------------ | Branch (28:12): [True: 880, False: 88] ------------------ 29| 880| top += top; 30| 880| } 31| | 32| 1.05k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 968, False: 88] ------------------ 33| 1.43M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.43M, False: 968] ------------------ 34| 1.43M| if (!(i & p)) { ------------------ | Branch (34:17): [True: 760k, False: 670k] ------------------ 35| 760k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 760k| do { \ | | 12| 760k| int32_t ab = (b) ^ (a); \ | | 13| 760k| int32_t c = (b) - (a); \ | | 14| 760k| c ^= ab & ((c) ^ (b)); \ | | 15| 760k| c >>= 31; \ | | 16| 760k| c &= ab; \ | | 17| 760k| (a) ^= c; \ | | 18| 760k| (b) ^= c; \ | | 19| 760k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 760k] | | ------------------ ------------------ 36| 760k| } 37| 1.43M| } 38| 968| i = 0; 39| 5.80k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 4.84k, False: 968] ------------------ 40| 1.28M| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.28M, False: 4.84k] ------------------ 41| 1.28M| if (!(i & p)) { ------------------ | Branch (41:21): [True: 670k, False: 613k] ------------------ 42| 670k| int32_t a = x[i + p]; 43| 3.93M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 3.26M, False: 670k] ------------------ 44| 3.26M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 3.26M| do { \ | | 12| 3.26M| int32_t ab = (b) ^ (a); \ | | 13| 3.26M| int32_t c = (b) - (a); \ | | 14| 3.26M| c ^= ab & ((c) ^ (b)); \ | | 15| 3.26M| c >>= 31; \ | | 16| 3.26M| c &= ab; \ | | 17| 3.26M| (a) ^= c; \ | | 18| 3.26M| (b) ^= c; \ | | 19| 3.26M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.26M] | | ------------------ ------------------ 45| 3.26M| } 46| 670k| x[i + p] = a; 47| 670k| } 48| 1.28M| } 49| 4.84k| } 50| 968| } 51| 88|} controlbits.c:PQCLEAN_MCELIECE8192128_AVX2_int32_sort: 21| 2.88M|static void int32_sort(int32_t *x, long long n) { 22| 2.88M| long long top, p, q, r, i; 23| | 24| 2.88M| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 2.88M] ------------------ 25| 0| return; 26| 0| } 27| 2.88M| top = 1; 28| 10.1M| while (top < n - top) { ------------------ | Branch (28:12): [True: 7.22M, False: 2.88M] ------------------ 29| 7.22M| top += top; 30| 7.22M| } 31| | 32| 12.9M| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 10.1M, False: 2.88M] ------------------ 33| 1.39G| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.38G, False: 10.1M] ------------------ 34| 1.38G| if (!(i & p)) { ------------------ | Branch (34:17): [True: 772M, False: 608M] ------------------ 35| 772M| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 772M| do { \ | | 12| 772M| int32_t ab = (b) ^ (a); \ | | 13| 772M| int32_t c = (b) - (a); \ | | 14| 772M| c ^= ab & ((c) ^ (b)); \ | | 15| 772M| c >>= 31; \ | | 16| 772M| c &= ab; \ | | 17| 772M| (a) ^= c; \ | | 18| 772M| (b) ^= c; \ | | 19| 772M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 772M] | | ------------------ ------------------ 36| 772M| } 37| 1.38G| } 38| 10.1M| i = 0; 39| 27.4M| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 17.3M, False: 10.1M] ------------------ 40| 1.23G| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 1.21G, False: 17.3M] ------------------ 41| 1.21G| if (!(i & p)) { ------------------ | Branch (41:21): [True: 608M, False: 608M] ------------------ 42| 608M| int32_t a = x[i + p]; 43| 3.60G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 2.99G, False: 608M] ------------------ 44| 2.99G| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 2.99G| do { \ | | 12| 2.99G| int32_t ab = (b) ^ (a); \ | | 13| 2.99G| int32_t c = (b) - (a); \ | | 14| 2.99G| c ^= ab & ((c) ^ (b)); \ | | 15| 2.99G| c >>= 31; \ | | 16| 2.99G| c &= ab; \ | | 17| 2.99G| (a) ^= c; \ | | 18| 2.99G| (b) ^= c; \ | | 19| 2.99G| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.99G] | | ------------------ ------------------ 45| 2.99G| } 46| 608M| x[i + p] = a; 47| 608M| } 48| 1.21G| } 49| 17.3M| } 50| 10.1M| } 51| 2.88M|} encrypt.c:PQCLEAN_MCELIECE8192128_AVX2_int32_sort: 21| 407|static void int32_sort(int32_t *x, long long n) { 22| 407| long long top, p, q, r, i; 23| | 24| 407| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 407] ------------------ 25| 0| return; 26| 0| } 27| 407| top = 1; 28| 2.84k| while (top < n - top) { ------------------ | Branch (28:12): [True: 2.44k, False: 407] ------------------ 29| 2.44k| top += top; 30| 2.44k| } 31| | 32| 3.25k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 2.84k, False: 407] ------------------ 33| 315k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 312k, False: 2.84k] ------------------ 34| 312k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 182k, False: 130k] ------------------ 35| 182k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 182k| do { \ | | 12| 182k| int32_t ab = (b) ^ (a); \ | | 13| 182k| int32_t c = (b) - (a); \ | | 14| 182k| c ^= ab & ((c) ^ (b)); \ | | 15| 182k| c >>= 31; \ | | 16| 182k| c &= ab; \ | | 17| 182k| (a) ^= c; \ | | 18| 182k| (b) ^= c; \ | | 19| 182k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 182k] | | ------------------ ------------------ 36| 182k| } 37| 312k| } 38| 2.84k| i = 0; 39| 11.3k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 8.54k, False: 2.84k] ------------------ 40| 269k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 261k, False: 8.54k] ------------------ 41| 261k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 130k, False: 130k] ------------------ 42| 130k| int32_t a = x[i + p]; 43| 547k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 416k, False: 130k] ------------------ 44| 416k| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 416k| do { \ | | 12| 416k| int32_t ab = (b) ^ (a); \ | | 13| 416k| int32_t c = (b) - (a); \ | | 14| 416k| c ^= ab & ((c) ^ (b)); \ | | 15| 416k| c >>= 31; \ | | 16| 416k| c &= ab; \ | | 17| 416k| (a) ^= c; \ | | 18| 416k| (b) ^= c; \ | | 19| 416k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 416k] | | ------------------ ------------------ 45| 416k| } 46| 130k| x[i + p] = a; 47| 130k| } 48| 261k| } 49| 8.54k| } 50| 2.84k| } 51| 407|} PQCLEAN_MCELIECE8192128_AVX2_crypto_kem_enc: 22| 88|) { 23| 88| unsigned char e[ SYS_N / 8 ]; 24| 88| unsigned char one_ec[ 1 + SYS_N / 8 + SYND_BYTES ] = {1}; 25| | 26| | // 27| | 28| 88| encrypt(c, pk, e); ------------------ | | 9| 88|#define encrypt CRYPTO_NAMESPACE(encrypt) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 29| | 30| 88| memcpy(one_ec + 1, e, SYS_N / 8); ------------------ | | 7| 88|#define SYS_N 8192 ------------------ 31| 88| memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 7| 88|#define SYS_N 8192 ------------------ memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 17| 88|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 88|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 88|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 88|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 32| | 33| 88| crypto_hash_32b(key, one_ec, sizeof(one_ec)); ------------------ | | 7| 88| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 88|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 34| | 35| 88| return 0; 36| 88|} PQCLEAN_MCELIECE8192128_AVX2_crypto_kem_dec: 42| 88|) { 43| 88| int i; 44| | 45| 88| unsigned char ret_decrypt = 0; 46| | 47| 88| uint16_t m; 48| | 49| 88| unsigned char e[ SYS_N / 8 ]; 50| 88| unsigned char preimage[ 1 + SYS_N / 8 + SYND_BYTES ]; 51| 88| unsigned char *x = preimage; 52| 88| const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 11| 88|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 88|#define SYS_T 128 | | ------------------ ------------------ const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 10| 88|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 88|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 88|#define GFBITS 13 | | ------------------ ------------------ 53| | 54| | // 55| | 56| 88| ret_decrypt = (unsigned char)decrypt(e, sk + 40, c); ------------------ | | 9| 88|#define decrypt CRYPTO_NAMESPACE(decrypt) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 57| | 58| 88| m = ret_decrypt; 59| 88| m -= 1; 60| 88| m >>= 8; 61| | 62| 88| *x++ = m & 1; 63| 90.2k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 90.2k|#define SYS_N 8192 ------------------ | Branch (63:17): [True: 90.1k, False: 88] ------------------ 64| 90.1k| *x++ = (~m & s[i]) | (m & e[i]); 65| 90.1k| } 66| | 67| 18.3k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 18.3k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 18.3k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 18.3k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 18.3k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (67:17): [True: 18.3k, False: 88] ------------------ 68| 18.3k| *x++ = c[i]; 69| 18.3k| } 70| | 71| 88| crypto_hash_32b(key, preimage, sizeof(preimage)); ------------------ | | 7| 88| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 88|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 72| | 73| 88| return 0; 74| 88|} PQCLEAN_MCELIECE8192128_AVX2_crypto_kem_keypair: 80| 88|) { 81| 88| int i; 82| 88| unsigned char seed[ 33 ] = {64}; 83| 88| unsigned char r[ SYS_N / 8 + (1 << GFBITS)*sizeof(uint32_t) + SYS_T * 2 + 32 ]; 84| 88| unsigned char *rp, *skp; 85| | 86| 88| gf f[ SYS_T ]; // element in GF(2^mt) 87| 88| gf irr[ SYS_T ]; // Goppa polynomial 88| 88| uint32_t perm[ 1 << GFBITS ]; // random permutation as 32-bit integers 89| 88| int16_t pi[ 1 << GFBITS ]; // random permutation 90| | 91| 88| randombytes(seed + 1, 32); ------------------ | | 8| 88|#define randombytes OQS_randombytes ------------------ 92| | 93| 737| while (1) { ------------------ | Branch (93:12): [True: 737, Folded] ------------------ 94| 737| rp = &r[ sizeof(r) - 32 ]; 95| 737| skp = sk; 96| | 97| | // expanding and updating the seed 98| | 99| 737| shake(r, sizeof(r), seed, 33); ------------------ | | 10| 737| shake256(out, outlen, in, inlen) | | ------------------ | | | | 12| 737|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 100| 737| memcpy(skp, seed + 1, 32); 101| 737| skp += 32 + 8; 102| 737| memcpy(seed + 1, &r[ sizeof(r) - 32 ], 32); 103| | 104| | // generating irreducible polynomial 105| | 106| 737| rp -= sizeof(f); 107| | 108| 95.0k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 95.0k|#define SYS_T 128 ------------------ | Branch (108:21): [True: 94.3k, False: 737] ------------------ 109| 94.3k| f[i] = load_gf(rp + i * 2); 110| 94.3k| } 111| | 112| 737| if (genpoly_gen(irr, f)) { ------------------ | | 9| 737|#define genpoly_gen CRYPTO_NAMESPACE(genpoly_gen) | | ------------------ | | | | 4| 737|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ | Branch (112:13): [True: 0, False: 737] ------------------ 113| 0| continue; 114| 0| } 115| | 116| 95.0k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 95.0k|#define SYS_T 128 ------------------ | Branch (116:21): [True: 94.3k, False: 737] ------------------ 117| 94.3k| store_gf(skp + i * 2, irr[i]); 118| 94.3k| } 119| | 120| 737| skp += IRR_BYTES; ------------------ | | 11| 737|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 737|#define SYS_T 128 | | ------------------ ------------------ 121| | 122| | // generating permutation 123| | 124| 737| rp -= sizeof(perm); 125| | 126| 6.03M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 6.03M|#define GFBITS 13 ------------------ | Branch (126:21): [True: 6.03M, False: 737] ------------------ 127| 6.03M| perm[i] = load4(rp + i * 4); 128| 6.03M| } 129| | 130| 737| if (pk_gen(pk, skp - IRR_BYTES, perm, pi)) { ------------------ | | 9| 737|#define pk_gen CRYPTO_NAMESPACE(pk_gen) | | ------------------ | | | | 4| 737|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ if (pk_gen(pk, skp - IRR_BYTES, perm, pi)) { ------------------ | | 11| 737|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 737|#define SYS_T 128 | | ------------------ ------------------ | Branch (130:13): [True: 649, False: 88] ------------------ 131| 649| continue; 132| 649| } 133| | 134| 88| controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 10| 88|#define controlbitsfrompermutation CRYPTO_NAMESPACE(controlbitsfrompermutation) | | ------------------ | | | | 4| 88|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 88|#define GFBITS 13 ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 88|#define GFBITS 13 ------------------ 135| 88| skp += COND_BYTES; ------------------ | | 10| 88|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 88|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 88|#define GFBITS 13 | | ------------------ ------------------ 136| | 137| | // storing the random string s 138| | 139| 88| rp -= SYS_N / 8; ------------------ | | 7| 88|#define SYS_N 8192 ------------------ 140| 88| memcpy(skp, rp, SYS_N / 8); ------------------ | | 7| 88|#define SYS_N 8192 ------------------ 141| | 142| | // storing positions of the 32 pivots 143| | 144| 88| store8(sk + 32, 0xFFFFFFFF); 145| | 146| 88| break; 147| 737| } 148| | 149| 88| return 0; 150| 88|} PQCLEAN_MCELIECE8192128_AVX2_pk_gen: 199| 737|int pk_gen(unsigned char *pk, const unsigned char *irr, const uint32_t *perm, int16_t *pi) { 200| 737|#define nBlocks_I ((PK_NROWS + 255) / 256) 201| | 202| 737| int i, j, k, b; 203| 737| int row, c; 204| | 205| 737| union { 206| 737| uint64_t w[ PK_NROWS ][ nBlocks_I * 4 ]; 207| 737| vec256 v[ PK_NROWS ][ nBlocks_I ]; 208| 737| } mat; 209| | 210| 737| union { 211| 737| uint64_t w[ PK_NROWS ][ par_width * 4 ]; 212| 737| vec256 v[ PK_NROWS ][ par_width ]; 213| 737| } par; 214| | 215| 737| uint16_t m; 216| 737| vec256 mm; 217| | 218| 737| vec128 sk_int[ GFBITS ]; 219| | 220| 737| vec256 consts[ 32 ][ GFBITS ]; 221| 737| vec256 eval[ 32 ][ GFBITS ]; 222| 737| vec256 prod[ 32 ][ GFBITS ]; 223| 737| vec256 tmp[ GFBITS ]; 224| | 225| 737| uint64_t list[1 << GFBITS]; 226| 737| uint64_t one = 1; 227| 737| uint64_t t; 228| | 229| 737| uint16_t ind[ PK_NROWS ]; 230| 737| uint16_t ind_inv[ PK_NROWS ]; 231| | 232| | // compute the inverses 233| | 234| 737| irr_load(sk_int, irr); 235| | 236| 737| fft(eval, sk_int); ------------------ | | 10| 737|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 737|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 237| | 238| 737| vec256_copy(prod[0], eval[0]); 239| | 240| 23.5k| for (i = 1; i < 32; i++) { ------------------ | Branch (240:17): [True: 22.8k, False: 737] ------------------ 241| 22.8k| vec256_mul(prod[i], prod[i - 1], eval[i]); 242| 22.8k| } 243| | 244| 737| vec256_inv(tmp, prod[31]); ------------------ | | 11| 737|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 737|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 245| | 246| 23.5k| for (i = 30; i >= 0; i--) { ------------------ | Branch (246:18): [True: 22.8k, False: 737] ------------------ 247| 22.8k| vec256_mul(prod[i + 1], prod[i], tmp); 248| 22.8k| vec256_mul(tmp, tmp, eval[i + 1]); 249| 22.8k| } 250| | 251| 737| vec256_copy(prod[0], tmp); 252| | 253| | // fill matrix 254| | 255| 737| de_bitslicing(list, prod); 256| | 257| 6.03M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 6.03M|#define GFBITS 13 ------------------ | Branch (257:17): [True: 6.03M, False: 737] ------------------ 258| 6.03M| list[i] <<= GFBITS; ------------------ | | 6| 6.03M|#define GFBITS 13 ------------------ 259| 6.03M| list[i] |= i; 260| 6.03M| list[i] |= ((uint64_t) perm[i]) << 31; 261| 6.03M| } 262| | 263| 737| uint64_sort(list, 1 << GFBITS); ------------------ | | 6| 737|#define GFBITS 13 ------------------ 264| | 265| 5.87M| for (i = 1; i < (1 << GFBITS); i++) { ------------------ | | 6| 5.87M|#define GFBITS 13 ------------------ | Branch (265:17): [True: 5.87M, False: 702] ------------------ 266| 5.87M| if (uint64_is_equal_declassify(list[i - 1] >> 31, list[i] >> 31)) { ------------------ | Branch (266:13): [True: 35, False: 5.87M] ------------------ 267| 35| return -1; 268| 35| } 269| 5.87M| } 270| | 271| 702| to_bitslicing_2x(consts, prod, list); 272| | 273| 5.75M| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 5.75M|#define GFBITS 13 ------------------ | Branch (273:17): [True: 5.75M, False: 702] ------------------ 274| 5.75M| pi[i] = list[i] & GFMASK; ------------------ | | 19| 5.75M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 5.75M|#define GFBITS 13 | | ------------------ ------------------ 275| 5.75M| } 276| | 277| 5.61k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 200| 5.61k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 5.61k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 5.61k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 5.61k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (277:17): [True: 4.91k, False: 702] ------------------ 278| 68.7k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 68.7k|#define GFBITS 13 ------------------ | Branch (278:21): [True: 63.8k, False: 4.91k] ------------------ 279| 63.8k| mat.v[ k ][ j ] = prod[ j ][ k ]; 280| 63.8k| } 281| 4.91k| } 282| | 283| 89.8k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 89.8k|#define SYS_T 128 ------------------ | Branch (283:17): [True: 89.1k, False: 702] ------------------ 284| 713k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 200| 713k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 713k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 713k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 713k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (284:21): [True: 624k, False: 89.1k] ------------------ 285| 624k| vec256_mul(prod[j], prod[j], consts[j]); 286| | 287| 8.73M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 8.73M|#define GFBITS 13 ------------------ | Branch (287:25): [True: 8.11M, False: 624k] ------------------ 288| 8.11M| mat.v[ i * GFBITS + k ][ j ] = prod[ j ][ k ]; ------------------ | | 6| 8.11M|#define GFBITS 13 ------------------ 289| 8.11M| } 290| 624k| } 291| 89.1k| } 292| | 293| | // gaussian elimination to obtain L, U, and P such that LP M = U 294| | // L and U are stored in the space of M 295| | // P is stored in ind 296| | 297| 1.16M| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 1.16M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.16M|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.16M|#define GFBITS 13 | | ------------------ ------------------ | Branch (297:17): [True: 1.16M, False: 702] ------------------ 298| 1.16M| ind_inv[i] = ind[ i ] = i; 299| 1.16M| } 300| | 301| 1.16M| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 1.16M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 1.16M|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 1.16M|#define GFBITS 13 | | ------------------ ------------------ | Branch (301:19): [True: 1.16M, False: 88] ------------------ 302| 1.16M| i = row >> 6; 303| 1.16M| j = row & 63; 304| | 305| 972M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 972M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 972M|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 972M|#define GFBITS 13 | | ------------------ ------------------ | Branch (305:27): [True: 971M, False: 1.16M] ------------------ 306| 971M| extract_01_masks(&m, mat.w[ row ], mat.w[ k ], row); 307| 971M| uint16_cswap(&ind[row], &ind[k], m); 308| | 309| 971M| mm = vec256_set1_16b(m); 310| 7.77G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 200| 7.77G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 7.77G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 7.77G|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 7.77G|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (310:25): [True: 6.79G, False: 971M] ------------------ 311| 6.79G| vec256_cswap(&mat.v[ row ][ c ], &mat.v[ k ][ c ], mm); 312| 6.79G| } 313| 971M| } 314| | 315| 1.16M| if ( uint64_is_zero_declassify((mat.w[ row ][ i ] >> j) & 1) ) { // return if not systematic ------------------ | Branch (315:14): [True: 614, False: 1.16M] ------------------ 316| 614| return -1; 317| 614| } 318| | 319| 972M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 972M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 972M|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 972M|#define GFBITS 13 | | ------------------ ------------------ | Branch (319:27): [True: 971M, False: 1.16M] ------------------ 320| 971M| t = mat.w[ k ][ i ] & (one << j); 321| 971M| mm = extract_mask256(mat.w[k], row); 322| | 323| 7.77G| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 200| 7.77G|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 7.77G|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 7.77G|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 7.77G|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (323:25): [True: 6.79G, False: 971M] ------------------ 324| 6.79G| mat.v[ k ][ c ] ^= mat.v[ row ][ c ] & mm; 325| 6.79G| } 326| | 327| 971M| mat.w[ k ][ i ] |= t; 328| 971M| } 329| 1.16M| } 330| | 331| | // apply M^-1 to the remaining columns 332| | 333| 88| composeinv(PK_NROWS, ind_inv, ind_inv, ind); ------------------ | | 13| 88|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 88|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 88|#define GFBITS 13 | | ------------------ ------------------ 334| | 335| 264| for (j = 6; j < 32; j += par_width) { ------------------ | | 30| 176|#define par_width 13 ------------------ | Branch (335:17): [True: 176, False: 88] ------------------ 336| 2.46k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 2.46k|#define GFBITS 13 ------------------ | Branch (336:21): [True: 2.28k, False: 176] ------------------ 337| 32.0k| for (b = 0; b < par_width; b++) { ------------------ | | 30| 32.0k|#define par_width 13 ------------------ | Branch (337:25): [True: 29.7k, False: 2.28k] ------------------ 338| 29.7k| par.v[ k ][ b ] = prod[ j + b ][ k ]; 339| 29.7k| } 340| 2.28k| } 341| | 342| 22.5k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 22.5k|#define SYS_T 128 ------------------ | Branch (342:21): [True: 22.3k, False: 176] ------------------ 343| 312k| for (b = 0; b < par_width; b++) { ------------------ | | 30| 312k|#define par_width 13 ------------------ | Branch (343:25): [True: 290k, False: 22.3k] ------------------ 344| 290k| vec256_mul(prod[j + b], prod[j + b], consts[j + b]); 345| 290k| } 346| | 347| 312k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 312k|#define GFBITS 13 ------------------ | Branch (347:25): [True: 290k, False: 22.3k] ------------------ 348| 4.06M| for (b = 0; b < par_width; b++) { ------------------ | | 30| 4.06M|#define par_width 13 ------------------ | Branch (348:29): [True: 3.77M, False: 290k] ------------------ 349| 3.77M| par.v[ i * GFBITS + k ][ b ] = prod[ j + b ][ k ]; ------------------ | | 6| 3.77M|#define GFBITS 13 ------------------ 350| 3.77M| } 351| 290k| } 352| 22.3k| } 353| | 354| | // apply P 355| | 356| 293k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 293k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 293k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 293k|#define GFBITS 13 | | ------------------ ------------------ | Branch (356:21): [True: 292k, False: 176] ------------------ 357| 292k| ind[i] = ind_inv[i]; 358| 292k| } 359| | 360| 176| sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 6| 176|#define GFBITS 13 ------------------ sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 13| 176|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 176|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 176|#define GFBITS 13 | | ------------------ ------------------ 361| | 362| | // apply L 363| | 364| 293k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 176|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 176|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 176|#define GFBITS 13 | | ------------------ ------------------ | Branch (364:34): [True: 292k, False: 176] ------------------ 365| 243M| for (i = row - 1; i >= 0; i--) { ------------------ | Branch (365:31): [True: 243M, False: 292k] ------------------ 366| 243M| mm = extract_mask256(mat.w[row], i); 367| | 368| 3.40G| for (k = 0; k < par_width; k++) { ------------------ | | 30| 3.40G|#define par_width 13 ------------------ | Branch (368:29): [True: 3.16G, False: 243M] ------------------ 369| 3.16G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 370| 3.16G| } 371| 243M| } 372| 292k| } 373| | 374| | // apply U^-1 375| | 376| 176| if (j == 6) { ------------------ | Branch (376:13): [True: 88, False: 88] ------------------ 377| 146k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 146k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 146k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 146k|#define GFBITS 13 | | ------------------ ------------------ | Branch (377:25): [True: 146k, False: 88] ------------------ 378| 146k| par.v[i][0] = mat.v[i][nBlocks_I - 1]; ------------------ | | 200| 146k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 146k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 146k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 146k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 379| 146k| } 380| 88| } 381| | 382| 293k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 176|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 176|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 176|#define GFBITS 13 | | ------------------ ------------------ | Branch (382:34): [True: 292k, False: 176] ------------------ 383| 243M| for (i = PK_NROWS - 1; i > row; i--) { ------------------ | | 13| 292k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 292k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 292k|#define GFBITS 13 | | ------------------ ------------------ | Branch (383:36): [True: 243M, False: 292k] ------------------ 384| 243M| mm = extract_mask256(mat.w[row], i); 385| | 386| 3.40G| for (k = 0; k < par_width; k++) { ------------------ | | 30| 3.40G|#define par_width 13 ------------------ | Branch (386:29): [True: 3.16G, False: 243M] ------------------ 387| 3.16G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 388| 3.16G| } 389| 243M| } 390| 292k| } 391| | 392| 176| if (j == 6) { ------------------ | Branch (392:13): [True: 88, False: 88] ------------------ 393| 146k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 146k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 146k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 146k|#define GFBITS 13 | | ------------------ ------------------ | Branch (393:27): [True: 146k, False: 88] ------------------ 394| 7.46M| for (k = 2; k < par_width * 4; k++) { ------------------ | | 30| 7.46M|#define par_width 13 ------------------ | Branch (394:29): [True: 7.32M, False: 146k] ------------------ 395| 7.32M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 16, par.w[row][k]); ------------------ | | 15| 7.32M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 7.32M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 7.32M|#define SYS_N 8192 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 7.32M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 7.32M|#define SYS_T 128 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 7.32M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 396| 7.32M| } 397| 146k| } 398| 88| } else { 399| 146k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 146k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 146k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 146k|#define GFBITS 13 | | ------------------ ------------------ | Branch (399:27): [True: 146k, False: 88] ------------------ 400| 7.76M| for (k = 0; k < par_width * 4; k++) { ------------------ | | 30| 7.76M|#define par_width 13 ------------------ | Branch (400:29): [True: 7.61M, False: 146k] ------------------ 401| 7.61M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 16, par.w[row][k]); ------------------ | | 15| 7.61M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 7.61M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 7.61M|#define SYS_N 8192 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 7.61M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 7.61M|#define SYS_T 128 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 7.61M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 402| 7.61M| } 403| 146k| } 404| 88| } 405| 176| } 406| | 407| | // 408| | 409| 88| return 0; 410| 702|} PQCLEAN_MCELIECE8192128_AVX2_genpoly_gen: 88| 737|int genpoly_gen(gf *out, gf *f) { 89| 737| int i, j, k; 90| | 91| 737| gf t, inv; 92| | 93| 737| uint64_t m; 94| 737| vec128 mask; 95| | 96| 737| union { 97| 737| uint64_t d[ GFBITS ][ 128 ][2]; 98| 737| vec128 v[ GFBITS ][ 128 ]; 99| 737| } buf; 100| | 101| 737| union { 102| 737| uint64_t d[GFBITS][2]; 103| 737| vec128 v[GFBITS]; 104| 737| } v; 105| | 106| 737| union { 107| 737| uint64_t d[SYS_T][GFBITS][2]; 108| 737| vec128 v[SYS_T][GFBITS]; 109| 737| } mat; 110| | 111| | // fill matrix 112| | 113| 737| buf.v[0][0] = vec128_set2x(1, 0); 114| 9.58k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 9.58k|#define GFBITS 13 ------------------ | Branch (114:17): [True: 8.84k, False: 737] ------------------ 115| 8.84k| buf.v[i][0] = vec128_setzero(); 116| 8.84k| } 117| | 118| 10.3k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 10.3k|#define GFBITS 13 ------------------ | Branch (118:17): [True: 9.58k, False: 737] ------------------ 119| 9.58k| v.v[j] = vec128_setzero(); 120| | 121| 1.23M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 9.58k|#define SYS_T 128 ------------------ | Branch (121:29): [True: 1.22M, False: 9.58k] ------------------ 122| 1.22M| v.d[j][1] <<= 1; 123| 1.22M| v.d[j][1] |= v.d[j][0] >> 63; 124| 1.22M| v.d[j][0] <<= 1; 125| 1.22M| v.d[j][0] |= (f[i] >> j) & 1; 126| 1.22M| } 127| 9.58k| } 128| | 129| 10.3k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 10.3k|#define GFBITS 13 ------------------ | Branch (129:17): [True: 9.58k, False: 737] ------------------ 130| 9.58k| buf.v[i][1] = v.v[i]; 131| 9.58k| } 132| | 133| 94.3k| for (k = 2; k <= SYS_T; k++) { ------------------ | | 8| 94.3k|#define SYS_T 128 ------------------ | Branch (133:17): [True: 93.5k, False: 737] ------------------ 134| 93.5k| vec128_mul_GF(v.v, v.v, f); ------------------ | | 11| 93.5k|#define vec128_mul_GF CRYPTO_NAMESPACE(vec128_mul_GF) | | ------------------ | | | | 4| 93.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 135| | 136| 93.5k| if (k < SYS_T) { ------------------ | | 8| 93.5k|#define SYS_T 128 ------------------ | Branch (136:13): [True: 92.8k, False: 737] ------------------ 137| 1.30M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.30M|#define GFBITS 13 ------------------ | Branch (137:25): [True: 1.20M, False: 92.8k] ------------------ 138| 1.20M| buf.v[i][k] = v.v[i]; 139| 1.20M| } 140| 92.8k| } else { 141| 95.0k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 95.0k|#define SYS_T 128 ------------------ | Branch (141:25): [True: 94.3k, False: 737] ------------------ 142| 94.3k| out[i] = extract_gf(v.d, i); 143| 94.3k| } 144| 737| } 145| 93.5k| } 146| | 147| 10.3k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 10.3k|#define GFBITS 13 ------------------ | Branch (147:17): [True: 9.58k, False: 737] ------------------ 148| 9.58k| transpose_128x128(buf.d[i]); 149| 9.58k| } 150| | 151| 95.0k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 95.0k|#define SYS_T 128 ------------------ | Branch (151:17): [True: 94.3k, False: 737] ------------------ 152| 1.32M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.32M|#define GFBITS 13 ------------------ | Branch (152:21): [True: 1.22M, False: 94.3k] ------------------ 153| 1.22M| mat.v[j][i] = buf.v[i][j]; 154| 1.22M| } 155| 94.3k| } 156| | 157| | // gaussian 158| | 159| 95.0k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 95.0k|#define SYS_T 128 ------------------ | Branch (159:17): [True: 94.3k, False: 737] ------------------ 160| 6.08M| for (j = i + 1; j < SYS_T; j++) { ------------------ | | 8| 6.08M|#define SYS_T 128 ------------------ | Branch (160:25): [True: 5.99M, False: 94.3k] ------------------ 161| 5.99M| m = extract_bit(mat.d[i], i); 162| 5.99M| m -= 1; 163| 5.99M| mask = vec128_set2x(m, m); 164| | 165| 83.8M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 83.8M|#define GFBITS 13 ------------------ | Branch (165:25): [True: 77.8M, False: 5.99M] ------------------ 166| 77.8M| mat.v[i][k] ^= mat.v[j][k] & mask; 167| 77.8M| } 168| | 169| 5.99M| out[i] ^= out[j] & m; 170| 5.99M| } 171| | 172| | // 173| | 174| 94.3k| t = extract_gf(mat.d[i], i); 175| | 176| 94.3k| if (gf_is_zero_declassify(t)) { ------------------ | Branch (176:13): [True: 0, False: 94.3k] ------------------ 177| 0| return -1; // return if not systematic 178| 0| } 179| | 180| | // 181| | 182| 94.3k| inv = gf_inv(t); ------------------ | | 11| 94.3k|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 94.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 183| 94.3k| vec128_mul_gf(mat.v[i], mat.v[i], inv); 184| | 185| 94.3k| out[i] = gf_mul(out[i], inv); ------------------ | | 14| 94.3k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 94.3k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 186| | 187| 12.1M| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 12.1M|#define SYS_T 128 ------------------ | Branch (187:21): [True: 12.0M, False: 94.3k] ------------------ 188| 12.0M| if (j != i) { ------------------ | Branch (188:17): [True: 11.9M, False: 94.3k] ------------------ 189| 11.9M| t = extract_gf(mat.d[j], i); 190| | 191| 11.9M| vec128_mul_gf(v.v, mat.v[i], t); 192| 11.9M| vec128_add(mat.v[j], mat.v[j], v.v); 193| | 194| 11.9M| out[j] ^= gf_mul(out[i], t); ------------------ | | 14| 11.9M|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 11.9M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 195| 11.9M| } 196| 12.0M| } 197| 94.3k| } 198| | 199| 737| return 0; 200| 737|} decrypt.c:store16: 90| 9.85k|static inline void store16(unsigned char *out, vec128 in) { 91| 9.85k| store8(out + 0, vec128_extract(in, 0)); ------------------ | | 29| 9.85k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 92| | store8(out + 8, vec128_extract(in, 1)); ------------------ | | 29| 9.85k|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 93| 9.85k|} PQCLEAN_MCELIECE8192128_AVX2_vec128_mul_GF: 6| 93.5k|void vec128_mul_GF(vec128 out[ GFBITS ], vec128 v[ GFBITS ], gf a[ SYS_T ]) { 7| 93.5k| int i, j; 8| 93.5k| uint64_t buf[GFBITS][4]; 9| 93.5k| vec128 prod[GFBITS]; 10| 93.5k| uint64_t p[GFBITS]; 11| | 12| | // polynomial multiplication 13| | 14| 1.31M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.31M|#define GFBITS 13 ------------------ | Branch (14:17): [True: 1.21M, False: 93.5k] ------------------ 15| 1.21M| buf[i][0] = 0; 16| 1.21M| buf[i][1] = 0; 17| 1.21M| buf[i][2] = 0; 18| 1.21M| buf[i][3] = 0; 19| 1.21M| } 20| | 21| 12.0M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 93.5k|#define SYS_T 128 ------------------ | Branch (21:25): [True: 11.9M, False: 93.5k] ------------------ 22| 167M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 167M|#define GFBITS 13 ------------------ | Branch (22:21): [True: 155M, False: 11.9M] ------------------ 23| 155M| buf[j][3] <<= 1; 24| 155M| buf[j][3] |= buf[j][2] >> 63; 25| 155M| buf[j][2] <<= 1; 26| 155M| buf[j][2] |= buf[j][1] >> 63; 27| 155M| buf[j][1] <<= 1; 28| 155M| buf[j][1] |= buf[j][0] >> 63; 29| 155M| buf[j][0] <<= 1; 30| 155M| } 31| | 32| 11.9M| vec128_mul_gf(prod, v, a[i]); 33| | 34| 167M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 167M|#define GFBITS 13 ------------------ | Branch (34:21): [True: 155M, False: 11.9M] ------------------ 35| 155M| buf[j][0] ^= vec128_extract(prod[j], 0); ------------------ | | 29| 155M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 36| 155M| buf[j][1] ^= vec128_extract(prod[j], 1); ------------------ | | 29| 155M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 37| 155M| } 38| 11.9M| } 39| | 40| | // reduction modulo y^128+y^7+y^2+y+1 41| | 42| 1.31M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.31M|#define GFBITS 13 ------------------ | Branch (42:17): [True: 1.21M, False: 93.5k] ------------------ 43| 1.21M| p[i] = buf[i][3]; 44| | 45| 1.21M| buf[i][2] ^= p[i] >> (SYS_T - 7 - 64); ------------------ | | 8| 1.21M|#define SYS_T 128 ------------------ 46| 1.21M| buf[i][1] ^= p[i] << (64 - (SYS_T - 7 - 64)); ------------------ | | 8| 1.21M|#define SYS_T 128 ------------------ 47| 1.21M| buf[i][2] ^= p[i] >> (SYS_T - 2 - 64); ------------------ | | 8| 1.21M|#define SYS_T 128 ------------------ 48| 1.21M| buf[i][1] ^= p[i] << (64 - (SYS_T - 2 - 64)); ------------------ | | 8| 1.21M|#define SYS_T 128 ------------------ 49| 1.21M| buf[i][2] ^= p[i] >> (SYS_T - 1 - 64); ------------------ | | 8| 1.21M|#define SYS_T 128 ------------------ 50| 1.21M| buf[i][1] ^= p[i] << (64 - (SYS_T - 1 - 64)); ------------------ | | 8| 1.21M|#define SYS_T 128 ------------------ 51| 1.21M| buf[i][1] ^= p[i]; 52| 1.21M| } 53| | 54| | // 55| | 56| 1.31M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.31M|#define GFBITS 13 ------------------ | Branch (56:17): [True: 1.21M, False: 93.5k] ------------------ 57| 1.21M| p[i] = buf[i][2]; 58| | 59| 1.21M| buf[i][1] ^= p[i] >> (SYS_T - 7 - 64); ------------------ | | 8| 1.21M|#define SYS_T 128 ------------------ 60| 1.21M| buf[i][0] ^= p[i] << (64 - (SYS_T - 7 - 64)); ------------------ | | 8| 1.21M|#define SYS_T 128 ------------------ 61| 1.21M| buf[i][1] ^= p[i] >> (SYS_T - 2 - 64); ------------------ | | 8| 1.21M|#define SYS_T 128 ------------------ 62| 1.21M| buf[i][0] ^= p[i] << (64 - (SYS_T - 2 - 64)); ------------------ | | 8| 1.21M|#define SYS_T 128 ------------------ 63| 1.21M| buf[i][1] ^= p[i] >> (SYS_T - 1 - 64); ------------------ | | 8| 1.21M|#define SYS_T 128 ------------------ 64| 1.21M| buf[i][0] ^= p[i] << (64 - (SYS_T - 1 - 64)); ------------------ | | 8| 1.21M|#define SYS_T 128 ------------------ 65| 1.21M| buf[i][0] ^= p[i]; 66| 1.21M| } 67| | 68| | // 69| | 70| 1.31M| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.31M|#define GFBITS 13 ------------------ | Branch (70:17): [True: 1.21M, False: 93.5k] ------------------ 71| 1.21M| out[i] = vec128_set2x(buf[i][0], buf[i][1]); 72| 1.21M| } 73| 93.5k|} decrypt.c:vec128_setbits: 58| 154|static inline vec128 vec128_setbits(uint64_t a) { 59| 154| return _mm_set1_epi64x(-a); 60| 154|} PQCLEAN_MCELIECE8192128_AVX2_vec256_sq: 9| 12.7k|void vec256_sq(vec256 *out, vec256 *in) { 10| 12.7k| int i; 11| 12.7k| vec256 result[GFBITS], t; 12| | 13| 12.7k| t = vec256_xor(in[11], in[12]); 14| | 15| 12.7k| result[0] = vec256_xor(in[0], in[11]); 16| 12.7k| result[1] = vec256_xor(in[7], t); 17| 12.7k| result[2] = vec256_xor(in[1], in[7]); 18| 12.7k| result[3] = vec256_xor(in[8], t); 19| 12.7k| result[4] = vec256_xor(in[2], in[7]); 20| 12.7k| result[4] = vec256_xor(result[4], in[8]); 21| 12.7k| result[4] = vec256_xor(result[4], t); 22| 12.7k| result[5] = vec256_xor(in[7], in[9]); 23| 12.7k| result[6] = vec256_xor(in[3], in[8]); 24| 12.7k| result[6] = vec256_xor(result[6], in[9]); 25| 12.7k| result[6] = vec256_xor(result[6], in[12]); 26| 12.7k| result[7] = vec256_xor(in[8], in[10]); 27| 12.7k| result[8] = vec256_xor(in[4], in[9]); 28| 12.7k| result[8] = vec256_xor(result[8], in[10]); 29| 12.7k| result[9] = vec256_xor(in[9], in[11]); 30| 12.7k| result[10] = vec256_xor(in[5], in[10]); 31| 12.7k| result[10] = vec256_xor(result[10], in[11]); 32| 12.7k| result[11] = vec256_xor(in[10], in[12]); 33| 12.7k| result[12] = vec256_xor(in[6], t); 34| | 35| 178k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 178k|#define GFBITS 13 ------------------ | Branch (35:17): [True: 165k, False: 12.7k] ------------------ 36| 165k| out[i] = result[i]; 37| 165k| } 38| 12.7k|} PQCLEAN_MCELIECE8192128_AVX2_vec256_inv: 41| 825|void vec256_inv(vec256 *out, vec256 *in) { 42| 825| vec256 tmp_11[ GFBITS ]; 43| 825| vec256 tmp_1111[ GFBITS ]; 44| | 45| 825| vec256_copy(out, in); 46| | 47| 825| vec256_sq(out, out); ------------------ | | 14| 825|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 825|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 48| 825| vec256_mul(tmp_11, out, in); // ^11 49| | 50| 825| vec256_sq(out, tmp_11); ------------------ | | 14| 825|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 825|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 51| 825| vec256_sq(out, out); ------------------ | | 14| 825|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 825|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 52| 825| vec256_mul(tmp_1111, out, tmp_11); // ^1111 53| | 54| 825| vec256_sq(out, tmp_1111); ------------------ | | 14| 825|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 825|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 55| 825| vec256_sq(out, out); ------------------ | | 14| 825|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 825|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 56| 825| vec256_sq(out, out); ------------------ | | 14| 825|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 825|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 57| 825| vec256_sq(out, out); ------------------ | | 14| 825|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 825|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 58| 825| vec256_mul(out, out, tmp_1111); // ^11111111 59| | 60| 825| vec256_sq(out, out); ------------------ | | 14| 825|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 825|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 61| 825| vec256_sq(out, out); ------------------ | | 14| 825|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 825|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 62| 825| vec256_sq(out, out); ------------------ | | 14| 825|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 825|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 63| 825| vec256_sq(out, out); ------------------ | | 14| 825|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 825|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 64| 825| vec256_mul(out, out, tmp_1111); // ^111111111111 65| | 66| 825| vec256_sq(out, out); // ^1111111111110 ------------------ | | 14| 825|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 825|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128_AVX2_ ## fun | | ------------------ ------------------ 67| 825|} PQCLEAN_MCELIECE8192128F_AVX2_load_bits: 188| 66|void load_bits(vec128 bits_int[][32], const unsigned char *bits) { 189| 66| int i, j; 190| 66| const unsigned char *ptr = bits; 191| | 192| 66| vec128 buf[64]; 193| | 194| 264| for (i = 0; i <= 5; i += 2) { ------------------ | Branch (194:17): [True: 198, False: 66] ------------------ 195| 12.8k| for (j = 0; j < 64; j++) { ------------------ | Branch (195:21): [True: 12.6k, False: 198] ------------------ 196| 12.6k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 197| 12.6k| ptr += 8; 198| 12.6k| } 199| | 200| 198| transpose_64x128_sp( buf ); 201| | 202| 6.53k| for (j = 0; j < 32; j++) { ------------------ | Branch (202:21): [True: 6.33k, False: 198] ------------------ 203| 6.33k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 204| 6.33k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 205| 6.33k| } 206| | 207| 198| ptr += 512; 208| 198| } 209| | 210| 924| for (i = 6; i <= 18; i++) { ------------------ | Branch (210:17): [True: 858, False: 66] ------------------ 211| 28.3k| for (j = 0; j < 32; j++) { ------------------ | Branch (211:21): [True: 27.4k, False: 858] ------------------ 212| 27.4k| bits_int[i][j] = load16(ptr); 213| 27.4k| ptr += 16; 214| 27.4k| } 215| 858| } 216| | 217| 264| for (i = 19; i < 25; i += 2) { ------------------ | Branch (217:18): [True: 198, False: 66] ------------------ 218| 12.8k| for (j = 0; j < 64; j++) { ------------------ | Branch (218:21): [True: 12.6k, False: 198] ------------------ 219| 12.6k| buf[j] = vec128_set2x(load8(ptr), load8(ptr + 512)); 220| 12.6k| ptr += 8; 221| 12.6k| } 222| | 223| 198| transpose_64x128_sp( buf ); 224| | 225| 6.53k| for (j = 0; j < 32; j++) { ------------------ | Branch (225:21): [True: 6.33k, False: 198] ------------------ 226| 6.33k| bits_int[i + 0][j] = vec128_unpack_low(buf[j], buf[j + 32]); 227| 6.33k| bits_int[i + 1][j] = vec128_unpack_high(buf[j], buf[j + 32]); 228| 6.33k| } 229| | 230| 198| ptr += 512; 231| 198| } 232| 66|} PQCLEAN_MCELIECE8192128F_AVX2_benes: 238| 132|void benes(vec128 *r, vec128 b[][32], int rev) { 239| 132| int inc; 240| | 241| 132| vec128 *b_ptr; 242| | 243| 132| if (rev == 0) { ------------------ | Branch (243:9): [True: 66, False: 66] ------------------ 244| 66| inc = 32; 245| 66| b_ptr = b[ 0]; 246| 66| } else { 247| 66| inc = -32; 248| 66| b_ptr = b[24]; 249| 66| } 250| | 251| | // 252| | 253| 132| transpose_64x128_sp( r ); 254| | 255| 132| layer_0(r, b_ptr); 256| 132| b_ptr += inc; 257| 132| layer_1(r, b_ptr); 258| 132| b_ptr += inc; 259| 132| layer_2(r, b_ptr); 260| 132| b_ptr += inc; 261| 132| layer_3(r, b_ptr); 262| 132| b_ptr += inc; 263| 132| layer_4(r, b_ptr); 264| 132| b_ptr += inc; 265| 132| layer_5(r, b_ptr); 266| 132| b_ptr += inc; 267| | 268| 132| transpose_64x128_sp( r ); 269| | 270| 132| layer_x(r, b_ptr); 271| 132| b_ptr += inc; 272| 132| layer_0(r, b_ptr); 273| 132| b_ptr += inc; 274| 132| layer_1(r, b_ptr); 275| 132| b_ptr += inc; 276| 132| layer_2(r, b_ptr); 277| 132| b_ptr += inc; 278| 132| layer_3(r, b_ptr); 279| 132| b_ptr += inc; 280| 132| layer_4(r, b_ptr); 281| 132| b_ptr += inc; 282| 132| layer_5(r, b_ptr); 283| 132| b_ptr += inc; 284| 132| layer_4(r, b_ptr); 285| 132| b_ptr += inc; 286| 132| layer_3(r, b_ptr); 287| 132| b_ptr += inc; 288| 132| layer_2(r, b_ptr); 289| 132| b_ptr += inc; 290| 132| layer_1(r, b_ptr); 291| 132| b_ptr += inc; 292| 132| layer_0(r, b_ptr); 293| 132| b_ptr += inc; 294| 132| layer_x(r, b_ptr); 295| 132| b_ptr += inc; 296| | 297| 132| transpose_64x128_sp( r ); 298| | 299| 132| layer_5(r, b_ptr); 300| 132| b_ptr += inc; 301| 132| layer_4(r, b_ptr); 302| 132| b_ptr += inc; 303| 132| layer_3(r, b_ptr); 304| 132| b_ptr += inc; 305| 132| layer_2(r, b_ptr); 306| 132| b_ptr += inc; 307| 132| layer_1(r, b_ptr); 308| 132| b_ptr += inc; 309| 132| layer_0(r, b_ptr); 310| | 311| 132| transpose_64x128_sp( r ); 312| 132|} PQCLEAN_MCELIECE8192128F_AVX2_bm: 147| 66|void bm(vec128 *out, vec256 *in) { 148| 66| int i; 149| 66| uint16_t N, L; 150| 66| uint16_t mask; 151| 66| uint64_t one = 1, t; 152| | 153| 66| vec128 prod[ GFBITS ]; 154| 66| vec128 interval[GFBITS]; 155| | 156| 66| typedef union { 157| 66| vec128 v[GFBITS][2]; 158| 66| vec256 V[GFBITS]; 159| 66| } db_t; 160| | 161| 66| db_t db; 162| 66| db_t BC_tmp; 163| 66| db_t BC; 164| | 165| 66| gf d, b, c0 = 1; 166| 66| gf coefs[256]; 167| | 168| | // initialization 169| | 170| 66| get_coefs(coefs, in); 171| | 172| 66| BC.v[0][0] = vec128_set2x(0, one << 63); 173| 66| BC.v[0][1] = vec128_setzero(); 174| | 175| 858| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 858|#define GFBITS 13 ------------------ | Branch (175:17): [True: 792, False: 66] ------------------ 176| 792| BC.v[i][0] = BC.v[i][1] = vec128_setzero(); 177| 792| } 178| | 179| 66| b = 1; 180| 66| L = 0; 181| | 182| | // 183| | 184| 924| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 924|#define GFBITS 13 ------------------ | Branch (184:17): [True: 858, False: 66] ------------------ 185| 858| interval[i] = vec128_setzero(); 186| 858| } 187| | 188| 16.9k| for (N = 0; N < 256; N++) { ------------------ | Branch (188:17): [True: 16.8k, False: 66] ------------------ 189| 16.8k| vec128_mul_asm(prod, interval, BC.v[0] + 1, 32); ------------------ | | 10| 16.8k|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 16.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 190| 16.8k| update_asm(interval, coefs[N], 16); ------------------ | | 1| 16.8k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 16.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 191| | 192| 16.8k| d = vec_reduce_asm(prod); ------------------ | | 3| 16.8k|#define vec_reduce_asm CRYPTO_NAMESPACE(vec_reduce_asm) | | ------------------ | | | | 4| 16.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 193| | 194| 16.8k| t = gf_mul2(c0, coefs[N], b); ------------------ | | 13| 16.8k|#define gf_mul2 CRYPTO_NAMESPACE(gf_mul2) | | ------------------ | | | | 4| 16.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 195| 16.8k| d ^= t & 0xFFFFFFFF; 196| | 197| 16.8k| mask = mask_nonzero(d) & mask_leq(L * 2, N); 198| | 199| 236k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 236k|#define GFBITS 13 ------------------ | Branch (199:21): [True: 219k, False: 16.8k] ------------------ 200| 219k| db.v[i][0] = vec128_setbits((d >> i) & 1); 201| 219k| db.v[i][1] = vec128_setbits((b >> i) & 1); 202| 219k| } 203| | 204| 16.8k| vec256_mul((vec256 *) BC_tmp.V, (vec256 *) db.V, (vec256 *) BC.V); 205| | 206| 16.8k| vec128_cmov(BC.v, mask); 207| 16.8k| update_asm(BC.v, c0 & mask, 32); ------------------ | | 1| 16.8k|#define update_asm CRYPTO_NAMESPACE(update_asm) | | ------------------ | | | | 4| 16.8k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 208| | 209| 236k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 236k|#define GFBITS 13 ------------------ | Branch (209:21): [True: 219k, False: 16.8k] ------------------ 210| 219k| BC.v[i][1] = vec128_xor(BC_tmp.v[i][0], BC_tmp.v[i][1]); 211| 219k| } 212| | 213| 16.8k| c0 = t >> 32; 214| 16.8k| b = (d & mask) | (b & ~mask); 215| 16.8k| L = ((N + 1 - L) & mask) | (L & ~mask); 216| 16.8k| } 217| | 218| 66| c0 = gf_inv(c0); ------------------ | | 11| 66|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 219| | 220| 924| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 924|#define GFBITS 13 ------------------ | Branch (220:17): [True: 858, False: 66] ------------------ 221| 858| prod[i] = vec128_setbits((c0 >> i) & 1); 222| 858| } 223| | 224| 66| vec128_mul_asm(out, prod, BC.v[0] + 1, 32); ------------------ | | 10| 66|#define vec128_mul_asm CRYPTO_NAMESPACE(vec128_mul_asm) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 225| 66|} PQCLEAN_MCELIECE8192128F_AVX2_controlbitsfrompermutation: 205| 66|void controlbitsfrompermutation(unsigned char *out, const int16 *pi, long long w, long long n) { 206| 66| PQCLEAN_VLA(int32, temp, (size_t)(2 * n)); ------------------ | | 57| 66|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 207| 66| PQCLEAN_VLA(int16, pi_test, (size_t)n); ------------------ | | 57| 66|# define PQCLEAN_VLA(__t,__x,__s) __t __x[__s] ------------------ 208| 66| int16 diff; 209| 66| int i; 210| 66| unsigned char *ptr; 211| | 212| 66| OQS_MEM_cleanse(temp, (size_t)n * 2); 213| 66| OQS_MEM_cleanse(pi_test, (size_t)n); 214| | 215| 66| while (1) { ------------------ | Branch (215:12): [True: 66, Folded] ------------------ 216| 66| OQS_MEM_cleanse(out, (size_t)((((2 * w - 1)*n / 2) + 7) / 8)); 217| 66| cbrecursion(out, 0, 1, pi, w, n, temp); 218| | 219| | // check for correctness 220| | 221| 540k| for (i = 0; i < n; i++) { ------------------ | Branch (221:21): [True: 540k, False: 66] ------------------ 222| 540k| pi_test[i] = (int16)i; 223| 540k| } 224| | 225| 66| ptr = out; 226| 924| for (i = 0; i < w; i++) { ------------------ | Branch (226:21): [True: 858, False: 66] ------------------ 227| 858| layer(pi_test, ptr, i, (int32)n); 228| 858| ptr += n >> 4; 229| 858| } 230| | 231| 858| for (i = (int)(w - 2); i >= 0; i--) { ------------------ | Branch (231:32): [True: 792, False: 66] ------------------ 232| 792| layer(pi_test, ptr, i, (int32)n); 233| 792| ptr += n >> 4; 234| 792| } 235| | 236| 66| diff = 0; 237| 540k| for (i = 0; i < n; i++) { ------------------ | Branch (237:21): [True: 540k, False: 66] ------------------ 238| 540k| diff |= pi[i] ^ pi_test[i]; 239| 540k| } 240| | 241| 66| diff = crypto_int16_nonzero_mask(diff); ------------------ | | 12| 66|#define crypto_int16_nonzero_mask CRYPTO_NAMESPACE(crypto_int16_nonzero_mask) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 242| 66| crypto_declassify(&diff, sizeof diff); 243| 66| if (diff == 0) { ------------------ | Branch (243:13): [True: 66, False: 0] ------------------ 244| 66| break; 245| 66| } 246| 66| } 247| 66|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_int16_negative_mask: 3| 132|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 4| 132| return crypto_int16_x >> 15; 5| 132|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_int16_nonzero_mask: 7| 66|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 8| 66| return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 66|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ return crypto_int16_negative_mask(crypto_int16_x) | crypto_int16_negative_mask(-crypto_int16_x); ------------------ | | 10| 66|#define crypto_int16_negative_mask CRYPTO_NAMESPACE(crypto_int16_negative_mask) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 9| 66|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_int32_negative_mask: 3| 42.1M|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 4| 42.1M| return crypto_int32_x >> 31; 5| 42.1M|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_int32_min: 37| 42.1M|crypto_int32 crypto_int32_min(crypto_int32 crypto_int32_x, crypto_int32 crypto_int32_y) { 38| 42.1M| crypto_int32 crypto_int32_xy = crypto_int32_y ^ crypto_int32_x; 39| 42.1M| crypto_int32 crypto_int32_z = crypto_int32_y - crypto_int32_x; 40| 42.1M| crypto_int32_z ^= crypto_int32_xy & (crypto_int32_z ^ crypto_int32_y); 41| 42.1M| crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); ------------------ | | 9| 42.1M|#define crypto_int32_negative_mask CRYPTO_NAMESPACE(crypto_int32_negative_mask) | | ------------------ | | | | 4| 42.1M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 42| 42.1M| crypto_int32_z &= crypto_int32_xy; 43| 42.1M| return crypto_int32_x ^ crypto_int32_z; 44| 42.1M|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint16_signed_negative_mask: 3| 21.2k|crypto_uint16_signed crypto_uint16_signed_negative_mask(crypto_uint16_signed crypto_uint16_signed_x) { 4| 21.2k| return crypto_uint16_signed_x >> 15; 5| 21.2k|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint16_nonzero_mask: 7| 10.6k|crypto_uint16 crypto_uint16_nonzero_mask(crypto_uint16 crypto_uint16_x) { 8| 10.6k| return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 10.6k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 10.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint16_signed_negative_mask(crypto_uint16_x) | crypto_uint16_signed_negative_mask(-crypto_uint16_x); ------------------ | | 11| 10.6k|#define crypto_uint16_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint16_signed_negative_mask) | | ------------------ | | | | 4| 10.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 9| 10.6k|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint16_zero_mask: 11| 10.6k|crypto_uint16 crypto_uint16_zero_mask(crypto_uint16 crypto_uint16_x) { 12| 10.6k| return ~crypto_uint16_nonzero_mask(crypto_uint16_x); ------------------ | | 13| 10.6k|#define crypto_uint16_nonzero_mask CRYPTO_NAMESPACE(crypto_uint16_nonzero_mask) | | ------------------ | | | | 4| 10.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 13| 10.6k|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint32_signed_negative_mask: 3| 90.1k|crypto_uint32_signed crypto_uint32_signed_negative_mask(crypto_uint32_signed crypto_uint32_signed_x) { 4| 90.1k| return crypto_uint32_signed_x >> 31; 5| 90.1k|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint32_nonzero_mask: 7| 45.0k|crypto_uint32 crypto_uint32_nonzero_mask(crypto_uint32 crypto_uint32_x) { 8| 45.0k| return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 45.0k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 45.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint32_signed_negative_mask(crypto_uint32_x) | crypto_uint32_signed_negative_mask(-crypto_uint32_x); ------------------ | | 11| 45.0k|#define crypto_uint32_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint32_signed_negative_mask) | | ------------------ | | | | 4| 45.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 9| 45.0k|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint32_unequal_mask: 15| 45.0k|crypto_uint32 crypto_uint32_unequal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 16| 45.0k| crypto_uint32 crypto_uint32_xy = crypto_uint32_x ^ crypto_uint32_y; 17| 45.0k| return crypto_uint32_nonzero_mask(crypto_uint32_xy); ------------------ | | 13| 45.0k|#define crypto_uint32_nonzero_mask CRYPTO_NAMESPACE(crypto_uint32_nonzero_mask) | | ------------------ | | | | 4| 45.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 18| 45.0k|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint32_equal_mask: 20| 45.0k|crypto_uint32 crypto_uint32_equal_mask(crypto_uint32 crypto_uint32_x, crypto_uint32 crypto_uint32_y) { 21| 45.0k| return ~crypto_uint32_unequal_mask(crypto_uint32_x, crypto_uint32_y); ------------------ | | 17| 45.0k|#define crypto_uint32_unequal_mask CRYPTO_NAMESPACE(crypto_uint32_unequal_mask) | | ------------------ | | | | 4| 45.0k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 22| 45.0k|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint64_signed_negative_mask: 3| 1.44M|crypto_uint64_signed crypto_uint64_signed_negative_mask(crypto_uint64_signed crypto_uint64_signed_x) { 4| 1.44M| return crypto_uint64_signed_x >> 63; 5| 1.44M|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint64_nonzero_mask: 7| 720k|crypto_uint64 crypto_uint64_nonzero_mask(crypto_uint64 crypto_uint64_x) { 8| 720k| return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 720k|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 720k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ return crypto_uint64_signed_negative_mask(crypto_uint64_x) | crypto_uint64_signed_negative_mask(-crypto_uint64_x); ------------------ | | 11| 720k|#define crypto_uint64_signed_negative_mask CRYPTO_NAMESPACE(crypto_uint64_signed_negative_mask) | | ------------------ | | | | 4| 720k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 9| 720k|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint64_zero_mask: 11| 111k|crypto_uint64 crypto_uint64_zero_mask(crypto_uint64 crypto_uint64_x) { 12| 111k| return ~crypto_uint64_nonzero_mask(crypto_uint64_x); ------------------ | | 13| 111k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 111k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 13| 111k|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint64_unequal_mask: 15| 608k|crypto_uint64 crypto_uint64_unequal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 16| 608k| crypto_uint64 crypto_uint64_xy = crypto_uint64_x ^ crypto_uint64_y; 17| 608k| return crypto_uint64_nonzero_mask(crypto_uint64_xy); ------------------ | | 13| 608k|#define crypto_uint64_nonzero_mask CRYPTO_NAMESPACE(crypto_uint64_nonzero_mask) | | ------------------ | | | | 4| 608k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 18| 608k|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_uint64_equal_mask: 20| 608k|crypto_uint64 crypto_uint64_equal_mask(crypto_uint64 crypto_uint64_x, crypto_uint64 crypto_uint64_y) { 21| 608k| return ~crypto_uint64_unequal_mask(crypto_uint64_x, crypto_uint64_y); ------------------ | | 17| 608k|#define crypto_uint64_unequal_mask CRYPTO_NAMESPACE(crypto_uint64_unequal_mask) | | ------------------ | | | | 4| 608k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 22| 608k|} PQCLEAN_MCELIECE8192128F_AVX2_decrypt: 141| 66|int decrypt(unsigned char *e, const unsigned char *sk, const unsigned char *s) { 142| 66| int i; 143| | 144| 66| uint16_t check_synd; 145| 66| uint16_t check_weight; 146| | 147| 66| vec256 inv[ 64 ][ GFBITS ]; 148| 66| vec256 scaled[ 64 ][ GFBITS ]; 149| 66| vec256 eval[ 64 ][ GFBITS ]; 150| | 151| 66| vec128 error128[ 64 ]; 152| 66| vec256 error256[ 32 ]; 153| | 154| 66| vec256 s_priv[ GFBITS ]; 155| 66| vec256 s_priv_cmp[ GFBITS ]; 156| 66| vec128 locator[ GFBITS ]; 157| | 158| 66| vec128 recv128[ 64 ]; 159| 66| vec256 recv256[ 32 ]; 160| 66| vec256 allone; 161| | 162| 66| vec128 bits_int[25][32]; 163| | 164| | // Berlekamp decoder 165| | 166| 66| preprocess(recv128, s); 167| | 168| 66| load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 10| 66|#define load_bits CRYPTO_NAMESPACE(load_bits) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ load_bits(bits_int, sk + IRR_BYTES); ------------------ | | 11| 66|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 66|#define SYS_T 128 | | ------------------ ------------------ 169| 66| benes(recv128, bits_int, 1); ------------------ | | 9| 66|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 170| 66| reformat_128to256(recv256, recv128); 171| | 172| 66| scaling(scaled, inv, sk, recv256); // scaling 173| 66| fft_tr(s_priv, scaled); // transposed FFT ------------------ | | 9| 66|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 174| 66| bm(locator, s_priv); // Berlekamp Massey ------------------ | | 10| 66|#define bm CRYPTO_NAMESPACE(bm) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 175| | 176| 66| fft(eval, locator); // FFT ------------------ | | 10| 66|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 177| | 178| | // reencryption and weight check 179| | 180| 66| allone = vec256_set1_16b(0xFFFF); 181| | 182| 2.17k| for (i = 0; i < 32; i++) { ------------------ | Branch (182:17): [True: 2.11k, False: 66] ------------------ 183| 2.11k| error256[i] = vec256_or_reduce(eval[i]); 184| 2.11k| error256[i] = vec256_xor(error256[i], allone); 185| 2.11k| } 186| | 187| 66| check_weight = weight(error256) ^ SYS_T; ------------------ | | 8| 66|#define SYS_T 128 ------------------ 188| 66| check_weight -= 1; 189| 66| check_weight >>= 15; 190| | 191| 66| scaling_inv(scaled, inv, error256); 192| 66| fft_tr(s_priv_cmp, scaled); ------------------ | | 9| 66|#define fft_tr CRYPTO_NAMESPACE(fft_tr) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 193| | 194| 66| check_synd = synd_cmp(s_priv, s_priv_cmp); 195| | 196| | // 197| | 198| 66| reformat_256to128(error128, error256); 199| 66| benes(error128, bits_int, 0); ------------------ | | 9| 66|#define benes CRYPTO_NAMESPACE(benes) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 200| | 201| 4.29k| for (i = 0; i < 64; i++) { ------------------ | Branch (201:17): [True: 4.22k, False: 66] ------------------ 202| 4.22k| store16(e + i * 16, error128[i]); 203| 4.22k| } 204| | 205| 66| return 1 - (check_synd & check_weight); 206| 66|} PQCLEAN_MCELIECE8192128F_AVX2_encrypt: 87| 66|void encrypt(unsigned char *s, const unsigned char *pk, unsigned char *e) { 88| 66| gen_e(e); 89| | 90| 66| syndrome_asm(s, pk, e); ------------------ | | 1| 66|#define syndrome_asm CRYPTO_NAMESPACE(syndrome_asm) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 91| 66|} PQCLEAN_MCELIECE8192128F_AVX2_fft: 277| 215|void fft(vec256 out[][GFBITS], vec128 *in) { 278| 215| radix_conversions(in); 279| 215| butterflies(out, in); 280| 215|} PQCLEAN_MCELIECE8192128F_AVX2_fft_tr: 380| 132|void fft_tr(vec256 *out, vec256 in[][ GFBITS ]) { 381| 132| butterflies_tr(out, in); 382| 132| radix_conversions_tr(out); 383| 132|} PQCLEAN_MCELIECE8192128F_AVX2_gf_mul: 12| 1.35M|gf gf_mul(gf in0, gf in1) { 13| 1.35M| int i; 14| | 15| 1.35M| uint64_t tmp; 16| 1.35M| uint64_t t0; 17| 1.35M| uint64_t t1; 18| 1.35M| uint64_t t; 19| | 20| 1.35M| t0 = in0; 21| 1.35M| t1 = in1; 22| | 23| 1.35M| tmp = t0 * (t1 & 1); 24| | 25| 17.6M| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 17.6M|#define GFBITS 13 ------------------ | Branch (25:17): [True: 16.3M, False: 1.35M] ------------------ 26| 16.3M| tmp ^= (t0 * (t1 & (1 << i))); 27| 16.3M| } 28| | 29| | // 30| | 31| 1.35M| t = tmp & 0x1FF0000; 32| 1.35M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 33| | 34| 1.35M| t = tmp & 0x000E000; 35| 1.35M| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 36| | 37| 1.35M| return tmp & GFMASK; ------------------ | | 19| 1.35M|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 1.35M|#define GFBITS 13 | | ------------------ ------------------ 38| 1.35M|} PQCLEAN_MCELIECE8192128F_AVX2_gf_frac: 148| 10.6k|gf gf_frac(gf den, gf num) { 149| 10.6k| gf tmp_11; 150| 10.6k| gf tmp_1111; 151| 10.6k| gf out; 152| | 153| 10.6k| tmp_11 = gf_sqmul(den, den); // 11 154| 10.6k| tmp_1111 = gf_sq2mul(tmp_11, tmp_11); // 1111 155| 10.6k| out = gf_sq2(tmp_1111); 156| 10.6k| out = gf_sq2mul(out, tmp_1111); // 11111111 157| 10.6k| out = gf_sq2(out); 158| 10.6k| out = gf_sq2mul(out, tmp_1111); // 111111111111 159| | 160| 10.6k| return gf_sqmul(out, num); // 1111111111110 161| 10.6k|} PQCLEAN_MCELIECE8192128F_AVX2_gf_inv: 164| 10.6k|gf gf_inv(gf den) { 165| 10.6k| return gf_frac(den, ((gf) 1)); ------------------ | | 10| 10.6k|#define gf_frac CRYPTO_NAMESPACE(gf_frac) | | ------------------ | | | | 4| 10.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 166| 10.6k|} bm.c:PQCLEAN_MCELIECE8192128F_AVX2_gf_mul2: 31| 16.8k|static inline uint64_t gf_mul2(gf a, gf b0, gf b1) { 32| 16.8k| int i; 33| | 34| 16.8k| uint64_t tmp = 0; 35| 16.8k| uint64_t t0; 36| 16.8k| uint64_t t1; 37| 16.8k| uint64_t t; 38| 16.8k| uint64_t mask = 0x0000000100000001; 39| | 40| 16.8k| t0 = a; 41| 16.8k| t1 = b1; 42| 16.8k| t1 = (t1 << 32) | b0; 43| | 44| 236k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 236k|#define GFBITS 13 ------------------ | Branch (44:17): [True: 219k, False: 16.8k] ------------------ 45| 219k| tmp ^= t0 * (t1 & mask); 46| 219k| mask += mask; 47| 219k| } 48| | 49| | // 50| | 51| 16.8k| t = tmp & 0x01FF000001FF0000; 52| 16.8k| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 53| | 54| 16.8k| t = tmp & 0x0000E0000000E000; 55| 16.8k| tmp ^= (t >> 9) ^ (t >> 10) ^ (t >> 12) ^ (t >> 13); 56| | 57| 16.8k| return tmp & 0x00001FFF00001FFF; 58| 16.8k|} pk_gen.c:PQCLEAN_MCELIECE8192128F_AVX2_int32_sort: 21| 66|static void int32_sort(int32_t *x, long long n) { 22| 66| long long top, p, q, r, i; 23| | 24| 66| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 66] ------------------ 25| 0| return; 26| 0| } 27| 66| top = 1; 28| 726| while (top < n - top) { ------------------ | Branch (28:12): [True: 660, False: 66] ------------------ 29| 660| top += top; 30| 660| } 31| | 32| 792| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 726, False: 66] ------------------ 33| 1.07M| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.07M, False: 726] ------------------ 34| 1.07M| if (!(i & p)) { ------------------ | Branch (34:17): [True: 570k, False: 502k] ------------------ 35| 570k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 570k| do { \ | | 12| 570k| int32_t ab = (b) ^ (a); \ | | 13| 570k| int32_t c = (b) - (a); \ | | 14| 570k| c ^= ab & ((c) ^ (b)); \ | | 15| 570k| c >>= 31; \ | | 16| 570k| c &= ab; \ | | 17| 570k| (a) ^= c; \ | | 18| 570k| (b) ^= c; \ | | 19| 570k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 570k] | | ------------------ ------------------ 36| 570k| } 37| 1.07M| } 38| 726| i = 0; 39| 4.35k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 3.63k, False: 726] ------------------ 40| 966k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 963k, False: 3.63k] ------------------ 41| 963k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 502k, False: 460k] ------------------ 42| 502k| int32_t a = x[i + p]; 43| 2.94M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 2.44M, False: 502k] ------------------ 44| 2.44M| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 2.44M| do { \ | | 12| 2.44M| int32_t ab = (b) ^ (a); \ | | 13| 2.44M| int32_t c = (b) - (a); \ | | 14| 2.44M| c ^= ab & ((c) ^ (b)); \ | | 15| 2.44M| c >>= 31; \ | | 16| 2.44M| c &= ab; \ | | 17| 2.44M| (a) ^= c; \ | | 18| 2.44M| (b) ^= c; \ | | 19| 2.44M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.44M] | | ------------------ ------------------ 45| 2.44M| } 46| 502k| x[i + p] = a; 47| 502k| } 48| 963k| } 49| 3.63k| } 50| 726| } 51| 66|} controlbits.c:PQCLEAN_MCELIECE8192128F_AVX2_int32_sort: 21| 2.16M|static void int32_sort(int32_t *x, long long n) { 22| 2.16M| long long top, p, q, r, i; 23| | 24| 2.16M| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 2.16M] ------------------ 25| 0| return; 26| 0| } 27| 2.16M| top = 1; 28| 7.58M| while (top < n - top) { ------------------ | Branch (28:12): [True: 5.41M, False: 2.16M] ------------------ 29| 5.41M| top += top; 30| 5.41M| } 31| | 32| 9.74M| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 7.58M, False: 2.16M] ------------------ 33| 1.04G| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 1.03G, False: 7.58M] ------------------ 34| 1.03G| if (!(i & p)) { ------------------ | Branch (34:17): [True: 579M, False: 456M] ------------------ 35| 579M| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 579M| do { \ | | 12| 579M| int32_t ab = (b) ^ (a); \ | | 13| 579M| int32_t c = (b) - (a); \ | | 14| 579M| c ^= ab & ((c) ^ (b)); \ | | 15| 579M| c >>= 31; \ | | 16| 579M| c &= ab; \ | | 17| 579M| (a) ^= c; \ | | 18| 579M| (b) ^= c; \ | | 19| 579M| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 579M] | | ------------------ ------------------ 36| 579M| } 37| 1.03G| } 38| 7.58M| i = 0; 39| 20.5M| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 12.9M, False: 7.58M] ------------------ 40| 925M| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 912M, False: 12.9M] ------------------ 41| 912M| if (!(i & p)) { ------------------ | Branch (41:21): [True: 456M, False: 456M] ------------------ 42| 456M| int32_t a = x[i + p]; 43| 2.70G| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 2.24G, False: 456M] ------------------ 44| 2.24G| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 2.24G| do { \ | | 12| 2.24G| int32_t ab = (b) ^ (a); \ | | 13| 2.24G| int32_t c = (b) - (a); \ | | 14| 2.24G| c ^= ab & ((c) ^ (b)); \ | | 15| 2.24G| c >>= 31; \ | | 16| 2.24G| c &= ab; \ | | 17| 2.24G| (a) ^= c; \ | | 18| 2.24G| (b) ^= c; \ | | 19| 2.24G| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.24G] | | ------------------ ------------------ 45| 2.24G| } 46| 456M| x[i + p] = a; 47| 456M| } 48| 912M| } 49| 12.9M| } 50| 7.58M| } 51| 2.16M|} encrypt.c:PQCLEAN_MCELIECE8192128F_AVX2_int32_sort: 21| 355|static void int32_sort(int32_t *x, long long n) { 22| 355| long long top, p, q, r, i; 23| | 24| 355| if (n < 2) { ------------------ | Branch (24:9): [True: 0, False: 355] ------------------ 25| 0| return; 26| 0| } 27| 355| top = 1; 28| 2.48k| while (top < n - top) { ------------------ | Branch (28:12): [True: 2.13k, False: 355] ------------------ 29| 2.13k| top += top; 30| 2.13k| } 31| | 32| 2.84k| for (p = top; p > 0; p >>= 1) { ------------------ | Branch (32:19): [True: 2.48k, False: 355] ------------------ 33| 275k| for (i = 0; i < n - p; ++i) { ------------------ | Branch (33:21): [True: 272k, False: 2.48k] ------------------ 34| 272k| if (!(i & p)) { ------------------ | Branch (34:17): [True: 159k, False: 113k] ------------------ 35| 159k| int32_MINMAX(x[i], x[i + p]); ------------------ | | 11| 159k| do { \ | | 12| 159k| int32_t ab = (b) ^ (a); \ | | 13| 159k| int32_t c = (b) - (a); \ | | 14| 159k| c ^= ab & ((c) ^ (b)); \ | | 15| 159k| c >>= 31; \ | | 16| 159k| c &= ab; \ | | 17| 159k| (a) ^= c; \ | | 18| 159k| (b) ^= c; \ | | 19| 159k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 159k] | | ------------------ ------------------ 36| 159k| } 37| 272k| } 38| 2.48k| i = 0; 39| 9.94k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (39:23): [True: 7.45k, False: 2.48k] ------------------ 40| 235k| for (; i < n - q; ++i) { ------------------ | Branch (40:20): [True: 227k, False: 7.45k] ------------------ 41| 227k| if (!(i & p)) { ------------------ | Branch (41:21): [True: 113k, False: 113k] ------------------ 42| 113k| int32_t a = x[i + p]; 43| 477k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (43:33): [True: 363k, False: 113k] ------------------ 44| 363k| int32_MINMAX(a, x[i + r]); ------------------ | | 11| 363k| do { \ | | 12| 363k| int32_t ab = (b) ^ (a); \ | | 13| 363k| int32_t c = (b) - (a); \ | | 14| 363k| c ^= ab & ((c) ^ (b)); \ | | 15| 363k| c >>= 31; \ | | 16| 363k| c &= ab; \ | | 17| 363k| (a) ^= c; \ | | 18| 363k| (b) ^= c; \ | | 19| 363k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 363k] | | ------------------ ------------------ 45| 363k| } 46| 113k| x[i + p] = a; 47| 113k| } 48| 227k| } 49| 7.45k| } 50| 2.48k| } 51| 355|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_kem_enc: 22| 66|) { 23| 66| unsigned char e[ SYS_N / 8 ]; 24| 66| unsigned char one_ec[ 1 + SYS_N / 8 + SYND_BYTES ] = {1}; 25| | 26| | // 27| | 28| 66| encrypt(c, pk, e); ------------------ | | 9| 66|#define encrypt CRYPTO_NAMESPACE(encrypt) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 29| | 30| 66| memcpy(one_ec + 1, e, SYS_N / 8); ------------------ | | 7| 66|#define SYS_N 8192 ------------------ 31| 66| memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 7| 66|#define SYS_N 8192 ------------------ memcpy(one_ec + 1 + SYS_N / 8, c, SYND_BYTES); ------------------ | | 17| 66|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 66|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 66|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 66|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 32| | 33| 66| crypto_hash_32b(key, one_ec, sizeof(one_ec)); ------------------ | | 7| 66| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 66|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 34| | 35| 66| return 0; 36| 66|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_kem_dec: 42| 66|) { 43| 66| int i; 44| | 45| 66| unsigned char ret_decrypt = 0; 46| | 47| 66| uint16_t m; 48| | 49| 66| unsigned char e[ SYS_N / 8 ]; 50| 66| unsigned char preimage[ 1 + SYS_N / 8 + SYND_BYTES ]; 51| 66| unsigned char *x = preimage; 52| 66| const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 11| 66|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 66|#define SYS_T 128 | | ------------------ ------------------ const unsigned char *s = sk + 40 + IRR_BYTES + COND_BYTES; ------------------ | | 10| 66|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 66|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 66|#define GFBITS 13 | | ------------------ ------------------ 53| | 54| | // 55| | 56| 66| ret_decrypt = (unsigned char)decrypt(e, sk + 40, c); ------------------ | | 9| 66|#define decrypt CRYPTO_NAMESPACE(decrypt) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 57| | 58| 66| m = ret_decrypt; 59| 66| m -= 1; 60| 66| m >>= 8; 61| | 62| 66| *x++ = m & 1; 63| 67.6k| for (i = 0; i < SYS_N / 8; i++) { ------------------ | | 7| 67.6k|#define SYS_N 8192 ------------------ | Branch (63:17): [True: 67.5k, False: 66] ------------------ 64| 67.5k| *x++ = (~m & s[i]) | (m & e[i]); 65| 67.5k| } 66| | 67| 13.7k| for (i = 0; i < SYND_BYTES; i++) { ------------------ | | 17| 13.7k|#define SYND_BYTES ((PK_NROWS + 7)/8) | | ------------------ | | | | 13| 13.7k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 13.7k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 13.7k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (67:17): [True: 13.7k, False: 66] ------------------ 68| 13.7k| *x++ = c[i]; 69| 13.7k| } 70| | 71| 66| crypto_hash_32b(key, preimage, sizeof(preimage)); ------------------ | | 7| 66| shake256(out, 32, in, inlen) | | ------------------ | | | | 12| 66|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 72| | 73| 66| return 0; 74| 66|} PQCLEAN_MCELIECE8192128F_AVX2_crypto_kem_keypair: 80| 66|) { 81| 66| int i; 82| 66| unsigned char seed[ 33 ] = {64}; 83| 66| unsigned char r[ SYS_N / 8 + (1 << GFBITS)*sizeof(uint32_t) + SYS_T * 2 + 32 ]; 84| 66| unsigned char *rp, *skp; 85| 66| uint64_t pivots; 86| | 87| 66| gf f[ SYS_T ]; // element in GF(2^mt) 88| 66| gf irr[ SYS_T ]; // Goppa polynomial 89| 66| uint32_t perm[ 1 << GFBITS ]; // random permutation as 32-bit integers 90| 66| int16_t pi[ 1 << GFBITS ]; // random permutation 91| | 92| 66| randombytes(seed + 1, 32); ------------------ | | 8| 66|#define randombytes OQS_randombytes ------------------ 93| | 94| 83| while (1) { ------------------ | Branch (94:12): [True: 83, Folded] ------------------ 95| 83| rp = &r[ sizeof(r) - 32 ]; 96| 83| skp = sk; 97| | 98| | // expanding and updating the seed 99| | 100| 83| shake(r, sizeof(r), seed, 33); ------------------ | | 10| 83| shake256(out, outlen, in, inlen) | | ------------------ | | | | 12| 83|#define shake256 OQS_SHA3_shake256 | | ------------------ ------------------ 101| 83| memcpy(skp, seed + 1, 32); 102| 83| skp += 32 + 8; 103| 83| memcpy(seed + 1, &r[ sizeof(r) - 32 ], 32); 104| | 105| | // generating irreducible polynomial 106| | 107| 83| rp -= sizeof(f); 108| | 109| 10.7k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 10.7k|#define SYS_T 128 ------------------ | Branch (109:21): [True: 10.6k, False: 83] ------------------ 110| 10.6k| f[i] = load_gf(rp + i * 2); 111| 10.6k| } 112| | 113| 83| if (genpoly_gen(irr, f)) { ------------------ | | 9| 83|#define genpoly_gen CRYPTO_NAMESPACE(genpoly_gen) | | ------------------ | | | | 4| 83|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ | Branch (113:13): [True: 0, False: 83] ------------------ 114| 0| continue; 115| 0| } 116| | 117| 10.7k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 10.7k|#define SYS_T 128 ------------------ | Branch (117:21): [True: 10.6k, False: 83] ------------------ 118| 10.6k| store_gf(skp + i * 2, irr[i]); 119| 10.6k| } 120| | 121| 83| skp += IRR_BYTES; ------------------ | | 11| 83|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 83|#define SYS_T 128 | | ------------------ ------------------ 122| | 123| | // generating permutation 124| | 125| 83| rp -= sizeof(perm); 126| | 127| 680k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 680k|#define GFBITS 13 ------------------ | Branch (127:21): [True: 679k, False: 83] ------------------ 128| 679k| perm[i] = load4(rp + i * 4); 129| 679k| } 130| | 131| 83| if (pk_gen(pk, skp - IRR_BYTES, perm, pi, &pivots)) { ------------------ | | 9| 83|#define pk_gen CRYPTO_NAMESPACE(pk_gen) | | ------------------ | | | | 4| 83|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ if (pk_gen(pk, skp - IRR_BYTES, perm, pi, &pivots)) { ------------------ | | 11| 83|#define IRR_BYTES (SYS_T * 2) | | ------------------ | | | | 8| 83|#define SYS_T 128 | | ------------------ ------------------ | Branch (131:13): [True: 17, False: 66] ------------------ 132| 17| continue; 133| 17| } 134| | 135| 66| controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 10| 66|#define controlbitsfrompermutation CRYPTO_NAMESPACE(controlbitsfrompermutation) | | ------------------ | | | | 4| 66|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 66|#define GFBITS 13 ------------------ controlbitsfrompermutation(skp, pi, GFBITS, 1 << GFBITS); ------------------ | | 6| 66|#define GFBITS 13 ------------------ 136| 66| skp += COND_BYTES; ------------------ | | 10| 66|#define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 66|#define GFBITS 13 | | ------------------ | | #define COND_BYTES ((1 << (GFBITS-4))*(2*GFBITS - 1)) | | ------------------ | | | | 6| 66|#define GFBITS 13 | | ------------------ ------------------ 137| | 138| | // storing the random string s 139| | 140| 66| rp -= SYS_N / 8; ------------------ | | 7| 66|#define SYS_N 8192 ------------------ 141| 66| memcpy(skp, rp, SYS_N / 8); ------------------ | | 7| 66|#define SYS_N 8192 ------------------ 142| | 143| | // storing positions of the 32 pivots 144| | 145| 66| store8(sk + 32, pivots); 146| | 147| 66| break; 148| 83| } 149| | 150| 66| return 0; 151| 66|} PQCLEAN_MCELIECE8192128F_AVX2_pk_gen: 315| 83|int pk_gen(unsigned char *pk, const unsigned char *irr, const uint32_t *perm, int16_t *pi, uint64_t *pivots) { 316| 83| int i, j, k, b; 317| 83| int row, c; 318| | 319| 83| union { 320| 83| uint64_t w[ PK_NROWS ][ nBlocks_I * 4 ]; 321| 83| vec256 v[ PK_NROWS ][ nBlocks_I ]; 322| 83| } mat; 323| | 324| 83| union { 325| 83| uint64_t w[ PK_NROWS ][ 52 ]; 326| 83| vec256 v[ PK_NROWS ][ 13 ]; 327| 83| } par; 328| | 329| 83| uint16_t m; 330| 83| vec256 mm; 331| | 332| 83| vec128 sk_int[ GFBITS ]; 333| | 334| 83| vec256 consts[ 32 ][ GFBITS ]; 335| 83| vec256 eval[ 32 ][ GFBITS ]; 336| 83| vec256 prod[ 32 ][ GFBITS ]; 337| 83| vec256 tmp[ GFBITS ]; 338| | 339| 83| uint64_t list[1 << GFBITS]; 340| 83| uint64_t one = 1; 341| 83| uint64_t t; 342| | 343| 83| uint16_t ind[ PK_NROWS ]; 344| 83| uint16_t ind_inv[ PK_NROWS ]; 345| | 346| | // compute the inverses 347| | 348| 83| irr_load(sk_int, irr); 349| | 350| 83| fft(eval, sk_int); ------------------ | | 10| 83|#define fft CRYPTO_NAMESPACE(fft) | | ------------------ | | | | 4| 83|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 351| | 352| 83| vec256_copy(prod[0], eval[0]); 353| | 354| 2.65k| for (i = 1; i < 32; i++) { ------------------ | Branch (354:17): [True: 2.57k, False: 83] ------------------ 355| 2.57k| vec256_mul(prod[i], prod[i - 1], eval[i]); 356| 2.57k| } 357| | 358| 83| vec256_inv(tmp, prod[31]); ------------------ | | 11| 83|#define vec256_inv CRYPTO_NAMESPACE(vec256_inv) | | ------------------ | | | | 4| 83|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 359| | 360| 2.65k| for (i = 30; i >= 0; i--) { ------------------ | Branch (360:18): [True: 2.57k, False: 83] ------------------ 361| 2.57k| vec256_mul(prod[i + 1], prod[i], tmp); 362| 2.57k| vec256_mul(tmp, tmp, eval[i + 1]); 363| 2.57k| } 364| | 365| 83| vec256_copy(prod[0], tmp); 366| | 367| | // fill matrix 368| | 369| 83| de_bitslicing(list, prod); 370| | 371| 680k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 680k|#define GFBITS 13 ------------------ | Branch (371:17): [True: 679k, False: 83] ------------------ 372| 679k| list[i] <<= GFBITS; ------------------ | | 6| 679k|#define GFBITS 13 ------------------ 373| 679k| list[i] |= i; 374| 679k| list[i] |= ((uint64_t) perm[i]) << 31; 375| 679k| } 376| | 377| 83| uint64_sort(list, 1 << GFBITS); ------------------ | | 6| 83|#define GFBITS 13 ------------------ 378| | 379| 608k| for (i = 1; i < (1 << GFBITS); i++) { ------------------ | | 6| 608k|#define GFBITS 13 ------------------ | Branch (379:17): [True: 608k, False: 66] ------------------ 380| 608k| if (uint64_is_equal_declassify(list[i - 1] >> 31, list[i] >> 31)) { ------------------ | Branch (380:13): [True: 17, False: 608k] ------------------ 381| 17| return -1; 382| 17| } 383| 608k| } 384| | 385| 66| to_bitslicing_2x(consts, prod, list); 386| | 387| 540k| for (i = 0; i < (1 << GFBITS); i++) { ------------------ | | 6| 540k|#define GFBITS 13 ------------------ | Branch (387:17): [True: 540k, False: 66] ------------------ 388| 540k| pi[i] = list[i] & GFMASK; ------------------ | | 19| 540k|#define GFMASK ((1 << GFBITS) - 1) | | ------------------ | | | | 6| 540k|#define GFBITS 13 | | ------------------ ------------------ 389| 540k| } 390| | 391| 528| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 32| 528|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 528|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 528|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 528|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (391:17): [True: 462, False: 66] ------------------ 392| 6.46k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 6.46k|#define GFBITS 13 ------------------ | Branch (392:21): [True: 6.00k, False: 462] ------------------ 393| 6.00k| mat.v[ k ][ j ] = prod[ j ][ k ]; 394| 6.00k| } 395| 462| } 396| | 397| 8.44k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 8.44k|#define SYS_T 128 ------------------ | Branch (397:17): [True: 8.38k, False: 66] ------------------ 398| 67.0k| for (j = 0; j < nBlocks_I; j++) { ------------------ | | 32| 67.0k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 67.0k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 67.0k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 67.0k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (398:21): [True: 58.6k, False: 8.38k] ------------------ 399| 58.6k| vec256_mul(prod[j], prod[j], consts[j]); 400| | 401| 821k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 821k|#define GFBITS 13 ------------------ | Branch (401:25): [True: 762k, False: 58.6k] ------------------ 402| 762k| mat.v[ i * GFBITS + k ][ j ] = prod[ j ][ k ]; ------------------ | | 6| 762k|#define GFBITS 13 ------------------ 403| 762k| } 404| 58.6k| } 405| 8.38k| } 406| | 407| | // gaussian elimination to obtain L, U, and P such that LP M = U 408| | // L and U are stored in the space of M 409| | // P is stored in ind 410| | 411| 109k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 109k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 109k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 109k|#define GFBITS 13 | | ------------------ ------------------ | Branch (411:17): [True: 109k, False: 66] ------------------ 412| 109k| ind_inv[i] = ind[ i ] = i; 413| 109k| } 414| | 415| 109k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 109k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 109k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 109k|#define GFBITS 13 | | ------------------ ------------------ | Branch (415:19): [True: 109k, False: 66] ------------------ 416| 109k| i = row >> 6; 417| 109k| j = row & 63; 418| | 419| 109k| if (row == PK_NROWS - 32) { ------------------ | | 13| 109k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 109k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 109k|#define GFBITS 13 | | ------------------ ------------------ | Branch (419:13): [True: 66, False: 109k] ------------------ 420| 66| if (mov_columns(mat.w, pi, pivots)) { ------------------ | Branch (420:17): [True: 0, False: 66] ------------------ 421| 0| return -1; 422| 0| } 423| 66| } 424| | 425| 91.4M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 91.4M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 91.4M|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 91.4M|#define GFBITS 13 | | ------------------ ------------------ | Branch (425:27): [True: 91.3M, False: 109k] ------------------ 426| 91.3M| extract_01_masks(&m, mat.w[ row ], mat.w[ k ], row); 427| | 428| 91.3M| uint16_cswap(&ind[row], &ind[k], m); 429| | 430| 91.3M| mm = vec256_set1_16b(m); 431| 730M| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 32| 730M|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 730M|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 730M|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 730M|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (431:25): [True: 639M, False: 91.3M] ------------------ 432| 639M| vec256_cswap(&mat.v[ row ][ c ], &mat.v[ k ][ c ], mm); 433| 639M| } 434| 91.3M| } 435| | 436| 109k| if ( uint64_is_zero_declassify((mat.w[ row ][ i ] >> j) & 1) ) { // return if not systematic ------------------ | Branch (436:14): [True: 0, False: 109k] ------------------ 437| 0| return -1; 438| 0| } 439| | 440| 91.4M| for (k = row + 1; k < PK_NROWS; k++) { ------------------ | | 13| 91.4M|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 91.4M|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 91.4M|#define GFBITS 13 | | ------------------ ------------------ | Branch (440:27): [True: 91.3M, False: 109k] ------------------ 441| 91.3M| t = mat.w[ k ][ i ] & (one << j); 442| 91.3M| mm = extract_mask256(mat.w[k], row); 443| | 444| 730M| for (c = 0; c < nBlocks_I; c++) { ------------------ | | 32| 730M|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 730M|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 730M|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 730M|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ | Branch (444:25): [True: 639M, False: 91.3M] ------------------ 445| 639M| mat.v[ k ][ c ] ^= mat.v[ row ][ c ] & mm; 446| 639M| } 447| | 448| 91.3M| mat.w[ k ][ i ] |= t; 449| 91.3M| } 450| 109k| } 451| | 452| | // apply M^-1 to the remaining columns 453| | 454| 66| composeinv(PK_NROWS, ind_inv, ind_inv, ind); ------------------ | | 13| 66|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 66|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 66|#define GFBITS 13 | | ------------------ ------------------ 455| | 456| 198| for (j = 6; j < 32; j += 13) { ------------------ | Branch (456:17): [True: 132, False: 66] ------------------ 457| 1.84k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 1.84k|#define GFBITS 13 ------------------ | Branch (457:21): [True: 1.71k, False: 132] ------------------ 458| 24.0k| for (b = 0; b < 13; b++) { ------------------ | Branch (458:25): [True: 22.3k, False: 1.71k] ------------------ 459| 22.3k| par.v[ k ][ b ] = prod[ j + b ][ k ]; 460| 22.3k| } 461| 1.71k| } 462| | 463| 16.8k| for (i = 1; i < SYS_T; i++) { ------------------ | | 8| 16.8k|#define SYS_T 128 ------------------ | Branch (463:21): [True: 16.7k, False: 132] ------------------ 464| 234k| for (b = 0; b < 13; b++) { ------------------ | Branch (464:25): [True: 217k, False: 16.7k] ------------------ 465| 217k| vec256_mul(prod[j + b], prod[j + b], consts[j + b]); 466| 217k| } 467| | 468| 234k| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 234k|#define GFBITS 13 ------------------ | Branch (468:25): [True: 217k, False: 16.7k] ------------------ 469| 3.05M| for (b = 0; b < 13; b++) { ------------------ | Branch (469:29): [True: 2.83M, False: 217k] ------------------ 470| 2.83M| par.v[ i * GFBITS + k ][ b ] = prod[ j + b ][ k ]; ------------------ | | 6| 2.83M|#define GFBITS 13 ------------------ 471| 2.83M| } 472| 217k| } 473| 16.7k| } 474| | 475| | // apply P 476| | 477| 219k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 219k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 219k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 219k|#define GFBITS 13 | | ------------------ ------------------ | Branch (477:21): [True: 219k, False: 132] ------------------ 478| 219k| ind[i] = ind_inv[i]; 479| 219k| } 480| | 481| 132| sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 6| 132|#define GFBITS 13 ------------------ sort_rows((1 << GFBITS) / 4, PK_NROWS, ind, par.v, 0); ------------------ | | 13| 132|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 132|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 132|#define GFBITS 13 | | ------------------ ------------------ 482| | 483| | // apply L 484| | 485| 219k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 132|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 132|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 132|#define GFBITS 13 | | ------------------ ------------------ | Branch (485:34): [True: 219k, False: 132] ------------------ 486| 182M| for (i = row - 1; i >= 0; i--) { ------------------ | Branch (486:31): [True: 182M, False: 219k] ------------------ 487| 182M| mm = extract_mask256(mat.w[row], i); 488| | 489| 2.55G| for (k = 0; k < 13; k++) { ------------------ | Branch (489:29): [True: 2.37G, False: 182M] ------------------ 490| 2.37G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 491| 2.37G| } 492| 182M| } 493| 219k| } 494| | 495| | // apply U^-1 496| | 497| 132| if (j == 6) { ------------------ | Branch (497:13): [True: 66, False: 66] ------------------ 498| 109k| for (i = 0; i < PK_NROWS; i++) { ------------------ | | 13| 109k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 109k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 109k|#define GFBITS 13 | | ------------------ ------------------ | Branch (498:25): [True: 109k, False: 66] ------------------ 499| 109k| par.v[i][0] = mat.v[ i ][ nBlocks_I - 1 ]; ------------------ | | 32| 109k|#define nBlocks_I ((PK_NROWS + 255) / 256) | | ------------------ | | | | 13| 109k|#define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 8| 109k|#define SYS_T 128 | | | | ------------------ | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | ------------------ | | | | | | 6| 109k|#define GFBITS 13 | | | | ------------------ | | ------------------ ------------------ 500| 109k| } 501| 66| } 502| | 503| 219k| for (row = PK_NROWS - 1; row >= 0; row--) { ------------------ | | 13| 132|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 132|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 132|#define GFBITS 13 | | ------------------ ------------------ | Branch (503:34): [True: 219k, False: 132] ------------------ 504| 182M| for (i = PK_NROWS - 1; i > row; i--) { ------------------ | | 13| 219k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 219k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 219k|#define GFBITS 13 | | ------------------ ------------------ | Branch (504:36): [True: 182M, False: 219k] ------------------ 505| 182M| mm = extract_mask256(mat.w[row], i); 506| | 507| 2.55G| for (k = 0; k < 13; k++) { ------------------ | Branch (507:29): [True: 2.37G, False: 182M] ------------------ 508| 2.37G| par.v[ row ][ k ] ^= par.v[ i ][ k ] & mm; 509| 2.37G| } 510| 182M| } 511| 219k| } 512| | 513| 132| if (j == 6) { ------------------ | Branch (513:13): [True: 66, False: 66] ------------------ 514| 109k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 109k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 109k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 109k|#define GFBITS 13 | | ------------------ ------------------ | Branch (514:27): [True: 109k, False: 66] ------------------ 515| 5.60M| for (k = 2; k < 52; k++) { ------------------ | Branch (515:29): [True: 5.49M, False: 109k] ------------------ 516| 5.49M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 16, par.w[row][k]); ------------------ | | 15| 5.49M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 5.49M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 5.49M|#define SYS_N 8192 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 5.49M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 5.49M|#define SYS_T 128 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 5.49M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 517| 5.49M| } 518| 109k| } 519| 66| } else { 520| 109k| for (row = 0; row < PK_NROWS; row++) { ------------------ | | 13| 109k|#define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 8| 109k|#define SYS_T 128 | | ------------------ | | #define PK_NROWS (SYS_T*GFBITS) | | ------------------ | | | | 6| 109k|#define GFBITS 13 | | ------------------ ------------------ | Branch (520:27): [True: 109k, False: 66] ------------------ 521| 5.82M| for (k = 0; k < 52; k++) { ------------------ | Branch (521:29): [True: 5.71M, False: 109k] ------------------ 522| 5.71M| store8(pk + PK_ROW_BYTES * row + j * 32 + k * 8 - 13 * 16, par.w[row][k]); ------------------ | | 15| 5.71M|#define PK_ROW_BYTES ((PK_NCOLS + 7)/8) | | ------------------ | | | | 14| 5.71M|#define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 7| 5.71M|#define SYS_N 8192 | | | | ------------------ | | | | #define PK_NCOLS (SYS_N - PK_NROWS) | | | | ------------------ | | | | | | 13| 5.71M|#define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 8| 5.71M|#define SYS_T 128 | | | | | | ------------------ | | | | | | #define PK_NROWS (SYS_T*GFBITS) | | | | | | ------------------ | | | | | | | | 6| 5.71M|#define GFBITS 13 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 523| 5.71M| } 524| 109k| } 525| 66| } 526| 132| } 527| | 528| | // 529| | 530| 66| return 0; 531| 66|} PQCLEAN_MCELIECE8192128F_AVX2_genpoly_gen: 88| 83|int genpoly_gen(gf *out, gf *f) { 89| 83| int i, j, k; 90| | 91| 83| gf t, inv; 92| | 93| 83| uint64_t m; 94| 83| vec128 mask; 95| | 96| 83| union { 97| 83| uint64_t d[ GFBITS ][ 128 ][2]; 98| 83| vec128 v[ GFBITS ][ 128 ]; 99| 83| } buf; 100| | 101| 83| union { 102| 83| uint64_t d[GFBITS][2]; 103| 83| vec128 v[GFBITS]; 104| 83| } v; 105| | 106| 83| union { 107| 83| uint64_t d[SYS_T][GFBITS][2]; 108| 83| vec128 v[SYS_T][GFBITS]; 109| 83| } mat; 110| | 111| | // fill matrix 112| | 113| 83| buf.v[0][0] = vec128_set2x(1, 0); 114| 1.07k| for (i = 1; i < GFBITS; i++) { ------------------ | | 6| 1.07k|#define GFBITS 13 ------------------ | Branch (114:17): [True: 996, False: 83] ------------------ 115| 996| buf.v[i][0] = vec128_setzero(); 116| 996| } 117| | 118| 1.16k| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 1.16k|#define GFBITS 13 ------------------ | Branch (118:17): [True: 1.07k, False: 83] ------------------ 119| 1.07k| v.v[j] = vec128_setzero(); 120| | 121| 139k| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 1.07k|#define SYS_T 128 ------------------ | Branch (121:29): [True: 138k, False: 1.07k] ------------------ 122| 138k| v.d[j][1] <<= 1; 123| 138k| v.d[j][1] |= v.d[j][0] >> 63; 124| 138k| v.d[j][0] <<= 1; 125| 138k| v.d[j][0] |= (f[i] >> j) & 1; 126| 138k| } 127| 1.07k| } 128| | 129| 1.16k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.16k|#define GFBITS 13 ------------------ | Branch (129:17): [True: 1.07k, False: 83] ------------------ 130| 1.07k| buf.v[i][1] = v.v[i]; 131| 1.07k| } 132| | 133| 10.6k| for (k = 2; k <= SYS_T; k++) { ------------------ | | 8| 10.6k|#define SYS_T 128 ------------------ | Branch (133:17): [True: 10.5k, False: 83] ------------------ 134| 10.5k| vec128_mul_GF(v.v, v.v, f); ------------------ | | 11| 10.5k|#define vec128_mul_GF CRYPTO_NAMESPACE(vec128_mul_GF) | | ------------------ | | | | 4| 10.5k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 135| | 136| 10.5k| if (k < SYS_T) { ------------------ | | 8| 10.5k|#define SYS_T 128 ------------------ | Branch (136:13): [True: 10.4k, False: 83] ------------------ 137| 146k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 146k|#define GFBITS 13 ------------------ | Branch (137:25): [True: 135k, False: 10.4k] ------------------ 138| 135k| buf.v[i][k] = v.v[i]; 139| 135k| } 140| 10.4k| } else { 141| 10.7k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 10.7k|#define SYS_T 128 ------------------ | Branch (141:25): [True: 10.6k, False: 83] ------------------ 142| 10.6k| out[i] = extract_gf(v.d, i); 143| 10.6k| } 144| 83| } 145| 10.5k| } 146| | 147| 1.16k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 1.16k|#define GFBITS 13 ------------------ | Branch (147:17): [True: 1.07k, False: 83] ------------------ 148| 1.07k| transpose_128x128(buf.d[i]); 149| 1.07k| } 150| | 151| 10.7k| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 10.7k|#define SYS_T 128 ------------------ | Branch (151:17): [True: 10.6k, False: 83] ------------------ 152| 148k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 148k|#define GFBITS 13 ------------------ | Branch (152:21): [True: 138k, False: 10.6k] ------------------ 153| 138k| mat.v[j][i] = buf.v[i][j]; 154| 138k| } 155| 10.6k| } 156| | 157| | // gaussian 158| | 159| 10.7k| for (i = 0; i < SYS_T; i++) { ------------------ | | 8| 10.7k|#define SYS_T 128 ------------------ | Branch (159:17): [True: 10.6k, False: 83] ------------------ 160| 685k| for (j = i + 1; j < SYS_T; j++) { ------------------ | | 8| 685k|#define SYS_T 128 ------------------ | Branch (160:25): [True: 674k, False: 10.6k] ------------------ 161| 674k| m = extract_bit(mat.d[i], i); 162| 674k| m -= 1; 163| 674k| mask = vec128_set2x(m, m); 164| | 165| 9.44M| for (k = 0; k < GFBITS; k++) { ------------------ | | 6| 9.44M|#define GFBITS 13 ------------------ | Branch (165:25): [True: 8.77M, False: 674k] ------------------ 166| 8.77M| mat.v[i][k] ^= mat.v[j][k] & mask; 167| 8.77M| } 168| | 169| 674k| out[i] ^= out[j] & m; 170| 674k| } 171| | 172| | // 173| | 174| 10.6k| t = extract_gf(mat.d[i], i); 175| | 176| 10.6k| if (gf_is_zero_declassify(t)) { ------------------ | Branch (176:13): [True: 0, False: 10.6k] ------------------ 177| 0| return -1; // return if not systematic 178| 0| } 179| | 180| | // 181| | 182| 10.6k| inv = gf_inv(t); ------------------ | | 11| 10.6k|#define gf_inv CRYPTO_NAMESPACE(gf_inv) | | ------------------ | | | | 4| 10.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 183| 10.6k| vec128_mul_gf(mat.v[i], mat.v[i], inv); 184| | 185| 10.6k| out[i] = gf_mul(out[i], inv); ------------------ | | 14| 10.6k|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 10.6k|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 186| | 187| 1.37M| for (j = 0; j < SYS_T; j++) { ------------------ | | 8| 1.37M|#define SYS_T 128 ------------------ | Branch (187:21): [True: 1.35M, False: 10.6k] ------------------ 188| 1.35M| if (j != i) { ------------------ | Branch (188:17): [True: 1.34M, False: 10.6k] ------------------ 189| 1.34M| t = extract_gf(mat.d[j], i); 190| | 191| 1.34M| vec128_mul_gf(v.v, mat.v[i], t); 192| 1.34M| vec128_add(mat.v[j], mat.v[j], v.v); 193| | 194| 1.34M| out[j] ^= gf_mul(out[i], t); ------------------ | | 14| 1.34M|#define gf_mul CRYPTO_NAMESPACE(gf_mul) | | ------------------ | | | | 4| 1.34M|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 195| 1.34M| } 196| 1.35M| } 197| 10.6k| } 198| | 199| 83| return 0; 200| 83|} PQCLEAN_MCELIECE8192128F_AVX2_vec128_mul_GF: 6| 10.5k|void vec128_mul_GF(vec128 out[ GFBITS ], vec128 v[ GFBITS ], gf a[ SYS_T ]) { 7| 10.5k| int i, j; 8| 10.5k| uint64_t buf[GFBITS][4]; 9| 10.5k| vec128 prod[GFBITS]; 10| 10.5k| uint64_t p[GFBITS]; 11| | 12| | // polynomial multiplication 13| | 14| 147k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 147k|#define GFBITS 13 ------------------ | Branch (14:17): [True: 137k, False: 10.5k] ------------------ 15| 137k| buf[i][0] = 0; 16| 137k| buf[i][1] = 0; 17| 137k| buf[i][2] = 0; 18| 137k| buf[i][3] = 0; 19| 137k| } 20| | 21| 1.35M| for (i = SYS_T - 1; i >= 0; i--) { ------------------ | | 8| 10.5k|#define SYS_T 128 ------------------ | Branch (21:25): [True: 1.34M, False: 10.5k] ------------------ 22| 18.8M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 18.8M|#define GFBITS 13 ------------------ | Branch (22:21): [True: 17.5M, False: 1.34M] ------------------ 23| 17.5M| buf[j][3] <<= 1; 24| 17.5M| buf[j][3] |= buf[j][2] >> 63; 25| 17.5M| buf[j][2] <<= 1; 26| 17.5M| buf[j][2] |= buf[j][1] >> 63; 27| 17.5M| buf[j][1] <<= 1; 28| 17.5M| buf[j][1] |= buf[j][0] >> 63; 29| 17.5M| buf[j][0] <<= 1; 30| 17.5M| } 31| | 32| 1.34M| vec128_mul_gf(prod, v, a[i]); 33| | 34| 18.8M| for (j = 0; j < GFBITS; j++) { ------------------ | | 6| 18.8M|#define GFBITS 13 ------------------ | Branch (34:21): [True: 17.5M, False: 1.34M] ------------------ 35| 17.5M| buf[j][0] ^= vec128_extract(prod[j], 0); ------------------ | | 29| 17.5M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 36| 17.5M| buf[j][1] ^= vec128_extract(prod[j], 1); ------------------ | | 29| 17.5M|#define vec128_extract(a, i) ((uint64_t) _mm_extract_epi64((vec128) (a), (i))) ------------------ 37| 17.5M| } 38| 1.34M| } 39| | 40| | // reduction modulo y^128+y^7+y^2+y+1 41| | 42| 147k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 147k|#define GFBITS 13 ------------------ | Branch (42:17): [True: 137k, False: 10.5k] ------------------ 43| 137k| p[i] = buf[i][3]; 44| | 45| 137k| buf[i][2] ^= p[i] >> (SYS_T - 7 - 64); ------------------ | | 8| 137k|#define SYS_T 128 ------------------ 46| 137k| buf[i][1] ^= p[i] << (64 - (SYS_T - 7 - 64)); ------------------ | | 8| 137k|#define SYS_T 128 ------------------ 47| 137k| buf[i][2] ^= p[i] >> (SYS_T - 2 - 64); ------------------ | | 8| 137k|#define SYS_T 128 ------------------ 48| 137k| buf[i][1] ^= p[i] << (64 - (SYS_T - 2 - 64)); ------------------ | | 8| 137k|#define SYS_T 128 ------------------ 49| 137k| buf[i][2] ^= p[i] >> (SYS_T - 1 - 64); ------------------ | | 8| 137k|#define SYS_T 128 ------------------ 50| 137k| buf[i][1] ^= p[i] << (64 - (SYS_T - 1 - 64)); ------------------ | | 8| 137k|#define SYS_T 128 ------------------ 51| 137k| buf[i][1] ^= p[i]; 52| 137k| } 53| | 54| | // 55| | 56| 147k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 147k|#define GFBITS 13 ------------------ | Branch (56:17): [True: 137k, False: 10.5k] ------------------ 57| 137k| p[i] = buf[i][2]; 58| | 59| 137k| buf[i][1] ^= p[i] >> (SYS_T - 7 - 64); ------------------ | | 8| 137k|#define SYS_T 128 ------------------ 60| 137k| buf[i][0] ^= p[i] << (64 - (SYS_T - 7 - 64)); ------------------ | | 8| 137k|#define SYS_T 128 ------------------ 61| 137k| buf[i][1] ^= p[i] >> (SYS_T - 2 - 64); ------------------ | | 8| 137k|#define SYS_T 128 ------------------ 62| 137k| buf[i][0] ^= p[i] << (64 - (SYS_T - 2 - 64)); ------------------ | | 8| 137k|#define SYS_T 128 ------------------ 63| 137k| buf[i][1] ^= p[i] >> (SYS_T - 1 - 64); ------------------ | | 8| 137k|#define SYS_T 128 ------------------ 64| 137k| buf[i][0] ^= p[i] << (64 - (SYS_T - 1 - 64)); ------------------ | | 8| 137k|#define SYS_T 128 ------------------ 65| 137k| buf[i][0] ^= p[i]; 66| 137k| } 67| | 68| | // 69| | 70| 147k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 147k|#define GFBITS 13 ------------------ | Branch (70:17): [True: 137k, False: 10.5k] ------------------ 71| 137k| out[i] = vec128_set2x(buf[i][0], buf[i][1]); 72| 137k| } 73| 10.5k|} PQCLEAN_MCELIECE8192128F_AVX2_vec256_sq: 9| 3.90k|void vec256_sq(vec256 *out, vec256 *in) { 10| 3.90k| int i; 11| 3.90k| vec256 result[GFBITS], t; 12| | 13| 3.90k| t = vec256_xor(in[11], in[12]); 14| | 15| 3.90k| result[0] = vec256_xor(in[0], in[11]); 16| 3.90k| result[1] = vec256_xor(in[7], t); 17| 3.90k| result[2] = vec256_xor(in[1], in[7]); 18| 3.90k| result[3] = vec256_xor(in[8], t); 19| 3.90k| result[4] = vec256_xor(in[2], in[7]); 20| 3.90k| result[4] = vec256_xor(result[4], in[8]); 21| 3.90k| result[4] = vec256_xor(result[4], t); 22| 3.90k| result[5] = vec256_xor(in[7], in[9]); 23| 3.90k| result[6] = vec256_xor(in[3], in[8]); 24| 3.90k| result[6] = vec256_xor(result[6], in[9]); 25| 3.90k| result[6] = vec256_xor(result[6], in[12]); 26| 3.90k| result[7] = vec256_xor(in[8], in[10]); 27| 3.90k| result[8] = vec256_xor(in[4], in[9]); 28| 3.90k| result[8] = vec256_xor(result[8], in[10]); 29| 3.90k| result[9] = vec256_xor(in[9], in[11]); 30| 3.90k| result[10] = vec256_xor(in[5], in[10]); 31| 3.90k| result[10] = vec256_xor(result[10], in[11]); 32| 3.90k| result[11] = vec256_xor(in[10], in[12]); 33| 3.90k| result[12] = vec256_xor(in[6], t); 34| | 35| 54.6k| for (i = 0; i < GFBITS; i++) { ------------------ | | 6| 54.6k|#define GFBITS 13 ------------------ | Branch (35:17): [True: 50.7k, False: 3.90k] ------------------ 36| 50.7k| out[i] = result[i]; 37| 50.7k| } 38| 3.90k|} PQCLEAN_MCELIECE8192128F_AVX2_vec256_inv: 41| 149|void vec256_inv(vec256 *out, vec256 *in) { 42| 149| vec256 tmp_11[ GFBITS ]; 43| 149| vec256 tmp_1111[ GFBITS ]; 44| | 45| 149| vec256_copy(out, in); 46| | 47| 149| vec256_sq(out, out); ------------------ | | 14| 149|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 149|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 48| 149| vec256_mul(tmp_11, out, in); // ^11 49| | 50| 149| vec256_sq(out, tmp_11); ------------------ | | 14| 149|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 149|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 51| 149| vec256_sq(out, out); ------------------ | | 14| 149|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 149|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 52| 149| vec256_mul(tmp_1111, out, tmp_11); // ^1111 53| | 54| 149| vec256_sq(out, tmp_1111); ------------------ | | 14| 149|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 149|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 55| 149| vec256_sq(out, out); ------------------ | | 14| 149|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 149|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 56| 149| vec256_sq(out, out); ------------------ | | 14| 149|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 149|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 57| 149| vec256_sq(out, out); ------------------ | | 14| 149|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 149|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 58| 149| vec256_mul(out, out, tmp_1111); // ^11111111 59| | 60| 149| vec256_sq(out, out); ------------------ | | 14| 149|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 149|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 61| 149| vec256_sq(out, out); ------------------ | | 14| 149|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 149|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 62| 149| vec256_sq(out, out); ------------------ | | 14| 149|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 149|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 63| 149| vec256_sq(out, out); ------------------ | | 14| 149|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 149|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 64| 149| vec256_mul(out, out, tmp_1111); // ^111111111111 65| | 66| 149| vec256_sq(out, out); // ^1111111111110 ------------------ | | 14| 149|#define vec256_sq CRYPTO_NAMESPACE(vec256_sq) | | ------------------ | | | | 4| 149|#define CRYPTO_NAMESPACE(fun) PQCLEAN_MCELIECE8192128F_AVX2_ ## fun | | ------------------ ------------------ 67| 149|} OQS_KEM_efrodokem_640_aes_keypair: 19| 4|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 4| uint8_t *pk_seedA = &pk[0]; 23| 4| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ 24| 4| uint8_t *sk_s = &sk[0]; 25| 4| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 26| 4| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 4|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_aes_length_public_key | | ------------------ | | | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ 27| 4| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 4|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_aes_length_public_key | | ------------------ | | | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 28| 4| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 4| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 4| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 31| 4| uint8_t randomness[2*CRYPTO_BYTES + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 4| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 4| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 34| 4| uint8_t *randomness_z = &randomness[2*CRYPTO_BYTES]; ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 35| 4| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 4| randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 26| 4|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ 39| 4| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 29| 4|#define shake OQS_SHA3_shake128 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 4| shake_input_seedSE[0] = 0x5F; 43| 4| memcpy(&shake_input_seedSE[1], randomness_seedSE, CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 44| 4| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 4|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 45| 40.9k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 40.9k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 40.9k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 40.9k, False: 4] ------------------ 46| 40.9k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 40.9k| #define LE_TO_UINT16(n) (n) ------------------ 47| 40.9k| } 48| 4| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 4|#define frodo_sample_n oqs_kem_efrodokem_640_aes_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 49| 4| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 4|#define frodo_sample_n oqs_kem_efrodokem_640_aes_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 50| 4| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 44| 4|#define frodo_mul_add_as_plus_e oqs_kem_efrodokem_640_aes_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 4| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 4|#define frodo_pack oqs_kem_efrodokem_640_aes_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 4|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_aes_length_public_key | | ------------------ | | | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 4| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 57| 4| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 4|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_aes_length_public_key | | ------------------ | | | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ 58| 20.4k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 20.4k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 20.4k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 20.4k, False: 4] ------------------ 59| 20.4k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 20.4k| #define UINT16_TO_LE(n) (n) ------------------ 60| 20.4k| } 61| 4| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 4| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 4|#define shake OQS_SHA3_shake128 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 4|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 4|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_aes_length_public_key | | ------------------ | | | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 4| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 68| 4| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 69| 4| clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 70| 4| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 71| 4| return OQS_SUCCESS; 72| 4|} OQS_KEM_efrodokem_640_aes_encaps: 86| 4|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 4| const uint8_t *pk_seedA = &pk[0]; 91| 4| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ 92| 4| uint8_t *ct_c1 = &ct[0]; 93| 4| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 94| 4| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 4| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 4| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 4| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 4| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 4| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 100| 4| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 101| 4| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via mu 102| 4| uint8_t *pkh = &G2in[0]; 103| 4| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 4|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 104| 4| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 105| 4| uint8_t *seedSE = &G2out[0]; // contains secret data 106| 4| uint8_t *k = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 107| 4| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 108| 4| uint8_t *Fin_ct = &Fin[0]; 109| 4| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 4|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_aes_length_ciphertext | | ------------------ | | | | 101| 4|#define OQS_KEM_efrodokem_640_aes_length_ciphertext 9720 | | ------------------ ------------------ 110| 4| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 111| | 112| | // pkh <- G_1(pk), generate random mu, compute (seedSE || k) = G_2(pkh || mu) 113| 4| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 4|#define shake OQS_SHA3_shake128 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 4|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 4|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_aes_length_public_key | | ------------------ | | | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ 114| 4| randombytes(mu, BYTES_MU); ------------------ | | 26| 4|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU); ------------------ | | 19| 4|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 4|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 4|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 4|#define PARAMS_NBAR 8 | | ------------------ ------------------ 115| 4| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 4|#define shake OQS_SHA3_shake128 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 4|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 4|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 4|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 4|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 4|#define PARAMS_NBAR 8 | | ------------------ ------------------ 116| | 117| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 118| 4| shake_input_seedSE[0] = 0x96; 119| 4| memcpy(&shake_input_seedSE[1], seedSE, CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 120| 4| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 4|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 121| 41.2k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 41.2k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 41.2k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 41.2k|#define PARAMS_NBAR 8 ------------------ | Branch (121:24): [True: 41.2k, False: 4] ------------------ 122| 41.2k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 41.2k| #define LE_TO_UINT16(n) (n) ------------------ 123| 41.2k| } 124| 4| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 4|#define frodo_sample_n oqs_kem_efrodokem_640_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 125| 4| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 4|#define frodo_sample_n oqs_kem_efrodokem_640_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 126| 4| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 47| 4|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_640_aes_mul_add_sa_plus_e ------------------ 127| 4| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 4|#define frodo_pack oqs_kem_efrodokem_640_aes_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ 128| | 129| | // Generate Epp, and compute V = Sp*B + Epp 130| 4| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 4|#define frodo_sample_n oqs_kem_efrodokem_640_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 131| 4| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 4|#define frodo_unpack oqs_kem_efrodokem_640_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 4|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_aes_length_public_key | | ------------------ | | | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ 132| 4| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 50| 4|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_640_aes_mul_add_sb_plus_e ------------------ 133| | 134| | // Encode mu, and compute C = V + enc(mu) (mod q) 135| 4| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 55| 4|#define frodo_key_encode oqs_kem_efrodokem_640_aes_key_encode ------------------ 136| 4| frodo_add(C, V, C); ------------------ | | 53| 4|#define frodo_add oqs_kem_efrodokem_640_aes_add ------------------ 137| 4| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 4|#define frodo_pack oqs_kem_efrodokem_640_aes_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ 138| | 139| | // Compute ss = F(ct||KK) 140| 4| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 4|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_aes_length_ciphertext | | ------------------ | | | | 101| 4|#define OQS_KEM_efrodokem_640_aes_length_ciphertext 9720 | | ------------------ ------------------ 141| 4| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 142| 4| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 4|#define shake OQS_SHA3_shake128 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 4|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_aes_length_ciphertext | | ------------------ | | | | 101| 4|#define OQS_KEM_efrodokem_640_aes_length_ciphertext 9720 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 143| | 144| | // Cleanup: 145| 4| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 146| 4| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 147| 4| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 148| 4| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 149| 4| clear_bytes(mu, BYTES_MU); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 4|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 4|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 4|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 4|#define PARAMS_NBAR 8 | | ------------------ ------------------ 150| 4| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 151| 4| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 152| 4| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 153| 4| return OQS_SUCCESS; 154| 4|} OQS_KEM_efrodokem_640_aes_decaps: 158| 4|{ // FrodoKEM's key decapsulation 159| | // Inputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 160| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 161| | // Output: shared key ss (CRYPTO_BYTES bytes) 162| 4| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 163| 4| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 164| 4| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 165| 4| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 166| 4| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 167| 4| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 168| 4| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 169| 4| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 170| 4| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 171| 4| const uint8_t *ct_c1 = &ct[0]; 172| 4| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 173| 4| const uint8_t *sk_s = &sk[0]; 174| 4| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 175| 4| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 4|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_aes_length_public_key | | ------------------ | | | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ 176| 4| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 177| 4| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 4|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_aes_length_public_key | | ------------------ | | | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 178| 4| const uint8_t *pk_seedA = &sk_pk[0]; 179| 4| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ 180| 4| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via muprime 181| 4| uint8_t *pkh = &G2in[0]; 182| 4| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 4|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 183| 4| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 184| 4| uint8_t *seedSEprime = &G2out[0]; // contains secret data 185| 4| uint8_t *kprime = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 186| 4| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 187| 4| uint8_t *Fin_ct = &Fin[0]; 188| 4| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 4|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_aes_length_ciphertext | | ------------------ | | | | 101| 4|#define OQS_KEM_efrodokem_640_aes_length_ciphertext 9720 | | ------------------ ------------------ 189| 4| uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES]; // contains secret data 190| | 191| 20.4k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 20.4k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 20.4k|#define PARAMS_NBAR 8 ------------------ | Branch (191:24): [True: 20.4k, False: 4] ------------------ 192| 20.4k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 20.4k| #define LE_TO_UINT16(n) (n) ------------------ 193| 20.4k| } 194| | 195| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 196| 4| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 4|#define frodo_unpack oqs_kem_efrodokem_640_aes_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ 197| 4| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 4|#define frodo_unpack oqs_kem_efrodokem_640_aes_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ 198| 4| frodo_mul_bs(W, Bp, S); ------------------ | | 51| 4|#define frodo_mul_bs oqs_kem_efrodokem_640_aes_mul_bs ------------------ 199| 4| frodo_sub(W, C, W); ------------------ | | 54| 4|#define frodo_sub oqs_kem_efrodokem_640_aes_sub ------------------ 200| 4| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 56| 4|#define frodo_key_decode oqs_kem_efrodokem_640_aes_key_decode ------------------ 201| | 202| | // Generate (seedSE' || k') = G_2(pkh || mu') 203| 4| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 20| 4|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 204| 4| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 4|#define shake OQS_SHA3_shake128 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 4|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 4|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 4|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 4|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 4|#define PARAMS_NBAR 8 | | ------------------ ------------------ 205| | 206| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 207| 4| shake_input_seedSEprime[0] = 0x96; 208| 4| memcpy(&shake_input_seedSEprime[1], seedSEprime, CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 209| 4| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 29| 4|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 210| 41.2k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 41.2k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 41.2k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 41.2k|#define PARAMS_NBAR 8 ------------------ | Branch (210:24): [True: 41.2k, False: 4] ------------------ 211| 41.2k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 41.2k| #define LE_TO_UINT16(n) (n) ------------------ 212| 41.2k| } 213| 4| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 4|#define frodo_sample_n oqs_kem_efrodokem_640_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 214| 4| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 4|#define frodo_sample_n oqs_kem_efrodokem_640_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 215| 4| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 47| 4|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_640_aes_mul_add_sa_plus_e ------------------ 216| | 217| | // Generate Epp, and compute W = Sp*B + Epp 218| 4| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 4|#define frodo_sample_n oqs_kem_efrodokem_640_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 219| 4| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 4|#define frodo_unpack oqs_kem_efrodokem_640_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 4|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_aes_length_public_key | | ------------------ | | | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ 220| 4| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 50| 4|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_640_aes_mul_add_sb_plus_e ------------------ 221| | 222| | // Encode mu, and compute CC = W + enc(mu') (mod q) 223| 4| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 55| 4|#define frodo_key_encode oqs_kem_efrodokem_640_aes_key_encode ------------------ 224| 4| frodo_add(CC, W, CC); ------------------ | | 53| 4|#define frodo_add oqs_kem_efrodokem_640_aes_add ------------------ 225| | 226| | // Prepare input to F 227| 4| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 4|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_aes_length_ciphertext | | ------------------ | | | | 101| 4|#define OQS_KEM_efrodokem_640_aes_length_ciphertext 9720 | | ------------------ ------------------ 228| | 229| | // Reducing BBp modulo q 230| 20.4k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 20.4k|#define PARAMS_N 640 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 20.4k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 20.4k|#define PARAMS_LOGQ 15 ------------------ | Branch (230:21): [True: 20.4k, False: 4] ------------------ 231| | 232| | // Needs to avoid branching on secret data using constant-time implementation. 233| 4| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 4|#define ct_verify oqs_kem_efrodokem_640_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 4|#define ct_verify oqs_kem_efrodokem_640_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 234| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 235| 4| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 41| 4|#define ct_select oqs_kem_efrodokem_640_aes_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 236| 4| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 4|#define shake OQS_SHA3_shake128 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 4|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_aes_length_ciphertext | | ------------------ | | | | 101| 4|#define OQS_KEM_efrodokem_640_aes_length_ciphertext 9720 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 237| | 238| | // Cleanup: 239| 4| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 240| 4| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 241| 4| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 242| 4| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 4|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 243| 4| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 244| 4| clear_bytes(muprime, BYTES_MU); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 4|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 4|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 4|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 4|#define PARAMS_NBAR 8 | | ------------------ ------------------ 245| 4| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 246| 4| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 247| 4| clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 27| 4|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 4|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_aes_length_shared_secret | | ------------------ | | | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 248| 4| return OQS_SUCCESS; 249| 4|} OQS_KEM_efrodokem_640_shake_keypair: 19| 2|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 2| uint8_t *pk_seedA = &pk[0]; 23| 2| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 24| 2| uint8_t *sk_s = &sk[0]; 25| 2| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 26| 2| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_shake_length_public_key | | ------------------ | | | | 114| 2|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ 27| 2| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_shake_length_public_key | | ------------------ | | | | 114| 2|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 28| 2| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 2| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 2| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 31| 2| uint8_t randomness[2*CRYPTO_BYTES + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 2| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 2| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 34| 2| uint8_t *randomness_z = &randomness[2*CRYPTO_BYTES]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 35| 2| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 2| randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 26| 2|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 39| 2| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 29| 2|#define shake OQS_SHA3_shake128 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 2| shake_input_seedSE[0] = 0x5F; 43| 2| memcpy(&shake_input_seedSE[1], randomness_seedSE, CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 44| 2| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 2|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 45| 20.4k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 20.4k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 20.4k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 20.4k, False: 2] ------------------ 46| 20.4k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 20.4k| #define LE_TO_UINT16(n) (n) ------------------ 47| 20.4k| } 48| 2| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 2|#define frodo_sample_n oqs_kem_efrodokem_640_shake_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 49| 2| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 2|#define frodo_sample_n oqs_kem_efrodokem_640_shake_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 50| 2| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 44| 2|#define frodo_mul_add_as_plus_e oqs_kem_efrodokem_640_shake_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 2| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 2|#define frodo_pack oqs_kem_efrodokem_640_shake_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_shake_length_public_key | | ------------------ | | | | 114| 2|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 2| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 57| 2| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_shake_length_public_key | | ------------------ | | | | 114| 2|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ 58| 10.2k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 10.2k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 10.2k, False: 2] ------------------ 59| 10.2k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 10.2k| #define UINT16_TO_LE(n) (n) ------------------ 60| 10.2k| } 61| 2| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 2| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 2|#define shake OQS_SHA3_shake128 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_shake_length_public_key | | ------------------ | | | | 114| 2|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 2| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 68| 2| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 69| 2| clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 70| 2| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 71| 2| return OQS_SUCCESS; 72| 2|} OQS_KEM_efrodokem_640_shake_encaps: 86| 2|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 2| const uint8_t *pk_seedA = &pk[0]; 91| 2| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 92| 2| uint8_t *ct_c1 = &ct[0]; 93| 2| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 94| 2| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 2| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 2| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 2| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 2| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 2| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 100| 2| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 101| 2| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via mu 102| 2| uint8_t *pkh = &G2in[0]; 103| 2| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 104| 2| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 105| 2| uint8_t *seedSE = &G2out[0]; // contains secret data 106| 2| uint8_t *k = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 107| 2| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 108| 2| uint8_t *Fin_ct = &Fin[0]; 109| 2| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_shake_length_ciphertext | | ------------------ | | | | 116| 2|#define OQS_KEM_efrodokem_640_shake_length_ciphertext 9720 | | ------------------ ------------------ 110| 2| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 111| | 112| | // pkh <- G_1(pk), generate random mu, compute (seedSE || k) = G_2(pkh || mu) 113| 2| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 2|#define shake OQS_SHA3_shake128 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_shake_length_public_key | | ------------------ | | | | 114| 2|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ 114| 2| randombytes(mu, BYTES_MU); ------------------ | | 26| 2|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU); ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ 115| 2| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 2|#define shake OQS_SHA3_shake128 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ 116| | 117| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 118| 2| shake_input_seedSE[0] = 0x96; 119| 2| memcpy(&shake_input_seedSE[1], seedSE, CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 120| 2| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 2|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 121| 20.6k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 20.6k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 20.6k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 20.6k|#define PARAMS_NBAR 8 ------------------ | Branch (121:24): [True: 20.6k, False: 2] ------------------ 122| 20.6k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 20.6k| #define LE_TO_UINT16(n) (n) ------------------ 123| 20.6k| } 124| 2| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 2|#define frodo_sample_n oqs_kem_efrodokem_640_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 125| 2| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 2|#define frodo_sample_n oqs_kem_efrodokem_640_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 126| 2| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 47| 2|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_640_shake_mul_add_sa_plus_e ------------------ 127| 2| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 2|#define frodo_pack oqs_kem_efrodokem_640_shake_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 128| | 129| | // Generate Epp, and compute V = Sp*B + Epp 130| 2| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 2|#define frodo_sample_n oqs_kem_efrodokem_640_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 131| 2| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 2|#define frodo_unpack oqs_kem_efrodokem_640_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_shake_length_public_key | | ------------------ | | | | 114| 2|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 132| 2| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 50| 2|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_640_shake_mul_add_sb_plus_e ------------------ 133| | 134| | // Encode mu, and compute C = V + enc(mu) (mod q) 135| 2| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 55| 2|#define frodo_key_encode oqs_kem_efrodokem_640_shake_key_encode ------------------ 136| 2| frodo_add(C, V, C); ------------------ | | 53| 2|#define frodo_add oqs_kem_efrodokem_640_shake_add ------------------ 137| 2| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 2|#define frodo_pack oqs_kem_efrodokem_640_shake_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 138| | 139| | // Compute ss = F(ct||KK) 140| 2| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_shake_length_ciphertext | | ------------------ | | | | 116| 2|#define OQS_KEM_efrodokem_640_shake_length_ciphertext 9720 | | ------------------ ------------------ 141| 2| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 142| 2| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 2|#define shake OQS_SHA3_shake128 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_shake_length_ciphertext | | ------------------ | | | | 116| 2|#define OQS_KEM_efrodokem_640_shake_length_ciphertext 9720 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 143| | 144| | // Cleanup: 145| 2| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 146| 2| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 147| 2| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 148| 2| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 149| 2| clear_bytes(mu, BYTES_MU); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ 150| 2| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 151| 2| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 152| 2| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 153| 2| return OQS_SUCCESS; 154| 2|} OQS_KEM_efrodokem_640_shake_decaps: 158| 2|{ // FrodoKEM's key decapsulation 159| | // Inputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 160| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 161| | // Output: shared key ss (CRYPTO_BYTES bytes) 162| 2| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 163| 2| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 164| 2| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 165| 2| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 166| 2| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 167| 2| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 168| 2| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 169| 2| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 170| 2| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 171| 2| const uint8_t *ct_c1 = &ct[0]; 172| 2| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 173| 2| const uint8_t *sk_s = &sk[0]; 174| 2| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 175| 2| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_shake_length_public_key | | ------------------ | | | | 114| 2|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ 176| 2| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 177| 2| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_shake_length_public_key | | ------------------ | | | | 114| 2|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 178| 2| const uint8_t *pk_seedA = &sk_pk[0]; 179| 2| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 180| 2| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via muprime 181| 2| uint8_t *pkh = &G2in[0]; 182| 2| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 183| 2| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 184| 2| uint8_t *seedSEprime = &G2out[0]; // contains secret data 185| 2| uint8_t *kprime = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 186| 2| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 187| 2| uint8_t *Fin_ct = &Fin[0]; 188| 2| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_shake_length_ciphertext | | ------------------ | | | | 116| 2|#define OQS_KEM_efrodokem_640_shake_length_ciphertext 9720 | | ------------------ ------------------ 189| 2| uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES]; // contains secret data 190| | 191| 10.2k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 10.2k|#define PARAMS_NBAR 8 ------------------ | Branch (191:24): [True: 10.2k, False: 2] ------------------ 192| 10.2k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 10.2k| #define LE_TO_UINT16(n) (n) ------------------ 193| 10.2k| } 194| | 195| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 196| 2| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 2|#define frodo_unpack oqs_kem_efrodokem_640_shake_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 197| 2| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 2|#define frodo_unpack oqs_kem_efrodokem_640_shake_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 198| 2| frodo_mul_bs(W, Bp, S); ------------------ | | 51| 2|#define frodo_mul_bs oqs_kem_efrodokem_640_shake_mul_bs ------------------ 199| 2| frodo_sub(W, C, W); ------------------ | | 54| 2|#define frodo_sub oqs_kem_efrodokem_640_shake_sub ------------------ 200| 2| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 56| 2|#define frodo_key_decode oqs_kem_efrodokem_640_shake_key_decode ------------------ 201| | 202| | // Generate (seedSE' || k') = G_2(pkh || mu') 203| 2| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 20| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 204| 2| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 2|#define shake OQS_SHA3_shake128 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ 205| | 206| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 207| 2| shake_input_seedSEprime[0] = 0x96; 208| 2| memcpy(&shake_input_seedSEprime[1], seedSEprime, CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 209| 2| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 29| 2|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 210| 20.6k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 20.6k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 20.6k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 20.6k|#define PARAMS_NBAR 8 ------------------ | Branch (210:24): [True: 20.6k, False: 2] ------------------ 211| 20.6k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 20.6k| #define LE_TO_UINT16(n) (n) ------------------ 212| 20.6k| } 213| 2| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 2|#define frodo_sample_n oqs_kem_efrodokem_640_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 214| 2| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 2|#define frodo_sample_n oqs_kem_efrodokem_640_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 215| 2| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 47| 2|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_640_shake_mul_add_sa_plus_e ------------------ 216| | 217| | // Generate Epp, and compute W = Sp*B + Epp 218| 2| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 2|#define frodo_sample_n oqs_kem_efrodokem_640_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 219| 2| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 2|#define frodo_unpack oqs_kem_efrodokem_640_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_640_shake_length_public_key | | ------------------ | | | | 114| 2|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 220| 2| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 50| 2|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_640_shake_mul_add_sb_plus_e ------------------ 221| | 222| | // Encode mu, and compute CC = W + enc(mu') (mod q) 223| 2| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 55| 2|#define frodo_key_encode oqs_kem_efrodokem_640_shake_key_encode ------------------ 224| 2| frodo_add(CC, W, CC); ------------------ | | 53| 2|#define frodo_add oqs_kem_efrodokem_640_shake_add ------------------ 225| | 226| | // Prepare input to F 227| 2| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_shake_length_ciphertext | | ------------------ | | | | 116| 2|#define OQS_KEM_efrodokem_640_shake_length_ciphertext 9720 | | ------------------ ------------------ 228| | 229| | // Reducing BBp modulo q 230| 10.2k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 10.2k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 10.2k|#define PARAMS_LOGQ 15 ------------------ | Branch (230:21): [True: 10.2k, False: 2] ------------------ 231| | 232| | // Needs to avoid branching on secret data using constant-time implementation. 233| 2| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 2|#define ct_verify oqs_kem_efrodokem_640_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 2|#define ct_verify oqs_kem_efrodokem_640_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 234| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 235| 2| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 41| 2|#define ct_select oqs_kem_efrodokem_640_shake_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 236| 2| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 2|#define shake OQS_SHA3_shake128 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_640_shake_length_ciphertext | | ------------------ | | | | 116| 2|#define OQS_KEM_efrodokem_640_shake_length_ciphertext 9720 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 237| | 238| | // Cleanup: 239| 2| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 240| 2| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 241| 2| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 242| 2| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 243| 2| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 244| 2| clear_bytes(muprime, BYTES_MU); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ 245| 2| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 246| 2| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 247| 2| clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 27| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_efrodokem_640_shake_length_shared_secret | | ------------------ | | | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 248| 2| return OQS_SUCCESS; 249| 2|} OQS_KEM_efrodokem_976_aes_keypair: 19| 9|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 9| uint8_t *pk_seedA = &pk[0]; 23| 9| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 24| 9| uint8_t *sk_s = &sk[0]; 25| 9| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 26| 9| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_aes_length_public_key | | ------------------ | | | | 129| 9|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ 27| 9| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_aes_length_public_key | | ------------------ | | | | 129| 9|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 28| 9| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 9| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 9| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 31| 9| uint8_t randomness[2*CRYPTO_BYTES + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 9| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 9| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 34| 9| uint8_t *randomness_z = &randomness[2*CRYPTO_BYTES]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 35| 9| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 9| randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 26| 9|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 39| 9| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 29| 9|#define shake OQS_SHA3_shake256 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 9| shake_input_seedSE[0] = 0x5F; 43| 9| memcpy(&shake_input_seedSE[1], randomness_seedSE, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 44| 9| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 9|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 45| 140k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 140k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 140k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 140k, False: 9] ------------------ 46| 140k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 140k| #define LE_TO_UINT16(n) (n) ------------------ 47| 140k| } 48| 9| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 9|#define frodo_sample_n oqs_kem_efrodokem_976_aes_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 49| 9| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 9|#define frodo_sample_n oqs_kem_efrodokem_976_aes_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 50| 9| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 44| 9|#define frodo_mul_add_as_plus_e oqs_kem_efrodokem_976_aes_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 9| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 9|#define frodo_pack oqs_kem_efrodokem_976_aes_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_aes_length_public_key | | ------------------ | | | | 129| 9|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 9| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 57| 9| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_aes_length_public_key | | ------------------ | | | | 129| 9|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ 58| 70.2k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 70.2k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 70.2k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 70.2k, False: 9] ------------------ 59| 70.2k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 70.2k| #define UINT16_TO_LE(n) (n) ------------------ 60| 70.2k| } 61| 9| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 9| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 9|#define shake OQS_SHA3_shake256 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_aes_length_public_key | | ------------------ | | | | 129| 9|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 9| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 68| 9| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 69| 9| clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 70| 9| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 71| 9| return OQS_SUCCESS; 72| 9|} OQS_KEM_efrodokem_976_aes_encaps: 86| 9|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 9| const uint8_t *pk_seedA = &pk[0]; 91| 9| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 92| 9| uint8_t *ct_c1 = &ct[0]; 93| 9| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 94| 9| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 9| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 9| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 9| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 9| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 9| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 100| 9| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 101| 9| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via mu 102| 9| uint8_t *pkh = &G2in[0]; 103| 9| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 104| 9| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 105| 9| uint8_t *seedSE = &G2out[0]; // contains secret data 106| 9| uint8_t *k = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 107| 9| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 108| 9| uint8_t *Fin_ct = &Fin[0]; 109| 9| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_aes_length_ciphertext | | ------------------ | | | | 131| 9|#define OQS_KEM_efrodokem_976_aes_length_ciphertext 15744 | | ------------------ ------------------ 110| 9| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 111| | 112| | // pkh <- G_1(pk), generate random mu, compute (seedSE || k) = G_2(pkh || mu) 113| 9| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 9|#define shake OQS_SHA3_shake256 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_aes_length_public_key | | ------------------ | | | | 129| 9|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ 114| 9| randombytes(mu, BYTES_MU); ------------------ | | 26| 9|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ 115| 9| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 9|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ 116| | 117| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 118| 9| shake_input_seedSE[0] = 0x96; 119| 9| memcpy(&shake_input_seedSE[1], seedSE, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 120| 9| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 9|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 121| 141k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 141k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 141k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 141k|#define PARAMS_NBAR 8 ------------------ | Branch (121:24): [True: 141k, False: 9] ------------------ 122| 141k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 141k| #define LE_TO_UINT16(n) (n) ------------------ 123| 141k| } 124| 9| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 9|#define frodo_sample_n oqs_kem_efrodokem_976_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 125| 9| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 9|#define frodo_sample_n oqs_kem_efrodokem_976_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 126| 9| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 47| 9|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_976_aes_mul_add_sa_plus_e ------------------ 127| 9| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 9|#define frodo_pack oqs_kem_efrodokem_976_aes_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 128| | 129| | // Generate Epp, and compute V = Sp*B + Epp 130| 9| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 9|#define frodo_sample_n oqs_kem_efrodokem_976_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 131| 9| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 9|#define frodo_unpack oqs_kem_efrodokem_976_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_aes_length_public_key | | ------------------ | | | | 129| 9|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 132| 9| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 50| 9|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_976_aes_mul_add_sb_plus_e ------------------ 133| | 134| | // Encode mu, and compute C = V + enc(mu) (mod q) 135| 9| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 55| 9|#define frodo_key_encode oqs_kem_efrodokem_976_aes_key_encode ------------------ 136| 9| frodo_add(C, V, C); ------------------ | | 53| 9|#define frodo_add oqs_kem_efrodokem_976_aes_add ------------------ 137| 9| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 9|#define frodo_pack oqs_kem_efrodokem_976_aes_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 138| | 139| | // Compute ss = F(ct||KK) 140| 9| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_aes_length_ciphertext | | ------------------ | | | | 131| 9|#define OQS_KEM_efrodokem_976_aes_length_ciphertext 15744 | | ------------------ ------------------ 141| 9| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 142| 9| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 9|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_aes_length_ciphertext | | ------------------ | | | | 131| 9|#define OQS_KEM_efrodokem_976_aes_length_ciphertext 15744 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 143| | 144| | // Cleanup: 145| 9| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 146| 9| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 147| 9| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 148| 9| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 149| 9| clear_bytes(mu, BYTES_MU); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ 150| 9| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 151| 9| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 152| 9| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 153| 9| return OQS_SUCCESS; 154| 9|} OQS_KEM_efrodokem_976_aes_decaps: 158| 9|{ // FrodoKEM's key decapsulation 159| | // Inputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 160| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 161| | // Output: shared key ss (CRYPTO_BYTES bytes) 162| 9| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 163| 9| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 164| 9| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 165| 9| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 166| 9| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 167| 9| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 168| 9| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 169| 9| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 170| 9| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 171| 9| const uint8_t *ct_c1 = &ct[0]; 172| 9| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 173| 9| const uint8_t *sk_s = &sk[0]; 174| 9| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 175| 9| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_aes_length_public_key | | ------------------ | | | | 129| 9|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ 176| 9| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 177| 9| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_aes_length_public_key | | ------------------ | | | | 129| 9|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 178| 9| const uint8_t *pk_seedA = &sk_pk[0]; 179| 9| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 180| 9| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via muprime 181| 9| uint8_t *pkh = &G2in[0]; 182| 9| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 183| 9| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 184| 9| uint8_t *seedSEprime = &G2out[0]; // contains secret data 185| 9| uint8_t *kprime = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 186| 9| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 187| 9| uint8_t *Fin_ct = &Fin[0]; 188| 9| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_aes_length_ciphertext | | ------------------ | | | | 131| 9|#define OQS_KEM_efrodokem_976_aes_length_ciphertext 15744 | | ------------------ ------------------ 189| 9| uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES]; // contains secret data 190| | 191| 70.2k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 70.2k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 70.2k|#define PARAMS_NBAR 8 ------------------ | Branch (191:24): [True: 70.2k, False: 9] ------------------ 192| 70.2k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 70.2k| #define LE_TO_UINT16(n) (n) ------------------ 193| 70.2k| } 194| | 195| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 196| 9| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 9|#define frodo_unpack oqs_kem_efrodokem_976_aes_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 197| 9| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 9|#define frodo_unpack oqs_kem_efrodokem_976_aes_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 198| 9| frodo_mul_bs(W, Bp, S); ------------------ | | 51| 9|#define frodo_mul_bs oqs_kem_efrodokem_976_aes_mul_bs ------------------ 199| 9| frodo_sub(W, C, W); ------------------ | | 54| 9|#define frodo_sub oqs_kem_efrodokem_976_aes_sub ------------------ 200| 9| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 56| 9|#define frodo_key_decode oqs_kem_efrodokem_976_aes_key_decode ------------------ 201| | 202| | // Generate (seedSE' || k') = G_2(pkh || mu') 203| 9| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 20| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 204| 9| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 9|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ 205| | 206| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 207| 9| shake_input_seedSEprime[0] = 0x96; 208| 9| memcpy(&shake_input_seedSEprime[1], seedSEprime, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 209| 9| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 29| 9|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 210| 141k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 141k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 141k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 141k|#define PARAMS_NBAR 8 ------------------ | Branch (210:24): [True: 141k, False: 9] ------------------ 211| 141k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 141k| #define LE_TO_UINT16(n) (n) ------------------ 212| 141k| } 213| 9| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 9|#define frodo_sample_n oqs_kem_efrodokem_976_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 214| 9| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 9|#define frodo_sample_n oqs_kem_efrodokem_976_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 215| 9| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 47| 9|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_976_aes_mul_add_sa_plus_e ------------------ 216| | 217| | // Generate Epp, and compute W = Sp*B + Epp 218| 9| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 9|#define frodo_sample_n oqs_kem_efrodokem_976_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 219| 9| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 9|#define frodo_unpack oqs_kem_efrodokem_976_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_aes_length_public_key | | ------------------ | | | | 129| 9|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 220| 9| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 50| 9|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_976_aes_mul_add_sb_plus_e ------------------ 221| | 222| | // Encode mu, and compute CC = W + enc(mu') (mod q) 223| 9| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 55| 9|#define frodo_key_encode oqs_kem_efrodokem_976_aes_key_encode ------------------ 224| 9| frodo_add(CC, W, CC); ------------------ | | 53| 9|#define frodo_add oqs_kem_efrodokem_976_aes_add ------------------ 225| | 226| | // Prepare input to F 227| 9| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_aes_length_ciphertext | | ------------------ | | | | 131| 9|#define OQS_KEM_efrodokem_976_aes_length_ciphertext 15744 | | ------------------ ------------------ 228| | 229| | // Reducing BBp modulo q 230| 70.2k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 70.2k|#define PARAMS_N 976 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 70.2k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 70.2k|#define PARAMS_LOGQ 16 ------------------ | Branch (230:21): [True: 70.2k, False: 9] ------------------ 231| | 232| | // Needs to avoid branching on secret data using constant-time implementation. 233| 9| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 9|#define ct_verify oqs_kem_efrodokem_976_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 9|#define ct_verify oqs_kem_efrodokem_976_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 234| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 235| 9| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 41| 9|#define ct_select oqs_kem_efrodokem_976_aes_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 236| 9| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 9|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_aes_length_ciphertext | | ------------------ | | | | 131| 9|#define OQS_KEM_efrodokem_976_aes_length_ciphertext 15744 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 237| | 238| | // Cleanup: 239| 9| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 240| 9| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 241| 9| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 242| 9| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 243| 9| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 244| 9| clear_bytes(muprime, BYTES_MU); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ 245| 9| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 246| 9| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 247| 9| clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_aes_length_shared_secret | | ------------------ | | | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 248| 9| return OQS_SUCCESS; 249| 9|} OQS_KEM_efrodokem_976_shake_keypair: 19| 8|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 8| uint8_t *pk_seedA = &pk[0]; 23| 8| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 24| 8| uint8_t *sk_s = &sk[0]; 25| 8| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 26| 8| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_shake_length_public_key | | ------------------ | | | | 144| 8|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ 27| 8| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_shake_length_public_key | | ------------------ | | | | 144| 8|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 28| 8| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 8| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 8| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 31| 8| uint8_t randomness[2*CRYPTO_BYTES + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 8| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 8| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 34| 8| uint8_t *randomness_z = &randomness[2*CRYPTO_BYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 35| 8| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 8| randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 26| 8|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 39| 8| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 8| shake_input_seedSE[0] = 0x5F; 43| 8| memcpy(&shake_input_seedSE[1], randomness_seedSE, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 44| 8| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 45| 124k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 124k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 124k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 124k, False: 8] ------------------ 46| 124k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 124k| #define LE_TO_UINT16(n) (n) ------------------ 47| 124k| } 48| 8| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_976_shake_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 49| 8| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_976_shake_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 50| 8| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 44| 8|#define frodo_mul_add_as_plus_e oqs_kem_efrodokem_976_shake_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 8| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 8|#define frodo_pack oqs_kem_efrodokem_976_shake_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_shake_length_public_key | | ------------------ | | | | 144| 8|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 8| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 57| 8| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_shake_length_public_key | | ------------------ | | | | 144| 8|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ 58| 62.4k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 62.4k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 62.4k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 62.4k, False: 8] ------------------ 59| 62.4k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 62.4k| #define UINT16_TO_LE(n) (n) ------------------ 60| 62.4k| } 61| 8| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 8| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_shake_length_public_key | | ------------------ | | | | 144| 8|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 8| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 68| 8| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 69| 8| clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 70| 8| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 71| 8| return OQS_SUCCESS; 72| 8|} OQS_KEM_efrodokem_976_shake_encaps: 86| 8|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 8| const uint8_t *pk_seedA = &pk[0]; 91| 8| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 92| 8| uint8_t *ct_c1 = &ct[0]; 93| 8| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 94| 8| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 8| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 8| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 8| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 8| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 8| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 100| 8| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 101| 8| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via mu 102| 8| uint8_t *pkh = &G2in[0]; 103| 8| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 104| 8| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 105| 8| uint8_t *seedSE = &G2out[0]; // contains secret data 106| 8| uint8_t *k = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 107| 8| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 108| 8| uint8_t *Fin_ct = &Fin[0]; 109| 8| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_shake_length_ciphertext | | ------------------ | | | | 146| 8|#define OQS_KEM_efrodokem_976_shake_length_ciphertext 15744 | | ------------------ ------------------ 110| 8| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 111| | 112| | // pkh <- G_1(pk), generate random mu, compute (seedSE || k) = G_2(pkh || mu) 113| 8| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_shake_length_public_key | | ------------------ | | | | 144| 8|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ 114| 8| randombytes(mu, BYTES_MU); ------------------ | | 26| 8|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 115| 8| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 116| | 117| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 118| 8| shake_input_seedSE[0] = 0x96; 119| 8| memcpy(&shake_input_seedSE[1], seedSE, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 120| 8| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 121| 125k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 125k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 125k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 125k|#define PARAMS_NBAR 8 ------------------ | Branch (121:24): [True: 125k, False: 8] ------------------ 122| 125k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 125k| #define LE_TO_UINT16(n) (n) ------------------ 123| 125k| } 124| 8| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_976_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 125| 8| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_976_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 126| 8| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 47| 8|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_976_shake_mul_add_sa_plus_e ------------------ 127| 8| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 8|#define frodo_pack oqs_kem_efrodokem_976_shake_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 128| | 129| | // Generate Epp, and compute V = Sp*B + Epp 130| 8| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_976_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 131| 8| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 8|#define frodo_unpack oqs_kem_efrodokem_976_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_shake_length_public_key | | ------------------ | | | | 144| 8|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 132| 8| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 50| 8|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_976_shake_mul_add_sb_plus_e ------------------ 133| | 134| | // Encode mu, and compute C = V + enc(mu) (mod q) 135| 8| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 55| 8|#define frodo_key_encode oqs_kem_efrodokem_976_shake_key_encode ------------------ 136| 8| frodo_add(C, V, C); ------------------ | | 53| 8|#define frodo_add oqs_kem_efrodokem_976_shake_add ------------------ 137| 8| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 8|#define frodo_pack oqs_kem_efrodokem_976_shake_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 138| | 139| | // Compute ss = F(ct||KK) 140| 8| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_shake_length_ciphertext | | ------------------ | | | | 146| 8|#define OQS_KEM_efrodokem_976_shake_length_ciphertext 15744 | | ------------------ ------------------ 141| 8| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 142| 8| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_shake_length_ciphertext | | ------------------ | | | | 146| 8|#define OQS_KEM_efrodokem_976_shake_length_ciphertext 15744 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 143| | 144| | // Cleanup: 145| 8| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 146| 8| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 147| 8| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 148| 8| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 149| 8| clear_bytes(mu, BYTES_MU); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 150| 8| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 151| 8| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 152| 8| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 153| 8| return OQS_SUCCESS; 154| 8|} OQS_KEM_efrodokem_976_shake_decaps: 158| 8|{ // FrodoKEM's key decapsulation 159| | // Inputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 160| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 161| | // Output: shared key ss (CRYPTO_BYTES bytes) 162| 8| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 163| 8| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 164| 8| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 165| 8| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 166| 8| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 167| 8| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 168| 8| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 169| 8| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 170| 8| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 171| 8| const uint8_t *ct_c1 = &ct[0]; 172| 8| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 173| 8| const uint8_t *sk_s = &sk[0]; 174| 8| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 175| 8| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_shake_length_public_key | | ------------------ | | | | 144| 8|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ 176| 8| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 177| 8| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_shake_length_public_key | | ------------------ | | | | 144| 8|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 178| 8| const uint8_t *pk_seedA = &sk_pk[0]; 179| 8| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 180| 8| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via muprime 181| 8| uint8_t *pkh = &G2in[0]; 182| 8| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 183| 8| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 184| 8| uint8_t *seedSEprime = &G2out[0]; // contains secret data 185| 8| uint8_t *kprime = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 186| 8| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 187| 8| uint8_t *Fin_ct = &Fin[0]; 188| 8| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_shake_length_ciphertext | | ------------------ | | | | 146| 8|#define OQS_KEM_efrodokem_976_shake_length_ciphertext 15744 | | ------------------ ------------------ 189| 8| uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES]; // contains secret data 190| | 191| 62.4k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 62.4k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 62.4k|#define PARAMS_NBAR 8 ------------------ | Branch (191:24): [True: 62.4k, False: 8] ------------------ 192| 62.4k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 62.4k| #define LE_TO_UINT16(n) (n) ------------------ 193| 62.4k| } 194| | 195| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 196| 8| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 8|#define frodo_unpack oqs_kem_efrodokem_976_shake_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 197| 8| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 8|#define frodo_unpack oqs_kem_efrodokem_976_shake_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 198| 8| frodo_mul_bs(W, Bp, S); ------------------ | | 51| 8|#define frodo_mul_bs oqs_kem_efrodokem_976_shake_mul_bs ------------------ 199| 8| frodo_sub(W, C, W); ------------------ | | 54| 8|#define frodo_sub oqs_kem_efrodokem_976_shake_sub ------------------ 200| 8| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 56| 8|#define frodo_key_decode oqs_kem_efrodokem_976_shake_key_decode ------------------ 201| | 202| | // Generate (seedSE' || k') = G_2(pkh || mu') 203| 8| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 204| 8| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 8|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 205| | 206| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 207| 8| shake_input_seedSEprime[0] = 0x96; 208| 8| memcpy(&shake_input_seedSEprime[1], seedSEprime, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 209| 8| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 210| 125k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 125k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 125k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 125k|#define PARAMS_NBAR 8 ------------------ | Branch (210:24): [True: 125k, False: 8] ------------------ 211| 125k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 125k| #define LE_TO_UINT16(n) (n) ------------------ 212| 125k| } 213| 8| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_976_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 214| 8| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_976_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 215| 8| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 47| 8|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_976_shake_mul_add_sa_plus_e ------------------ 216| | 217| | // Generate Epp, and compute W = Sp*B + Epp 218| 8| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 8|#define frodo_sample_n oqs_kem_efrodokem_976_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 219| 8| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 8|#define frodo_unpack oqs_kem_efrodokem_976_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 8|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_976_shake_length_public_key | | ------------------ | | | | 144| 8|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 220| 8| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 50| 8|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_976_shake_mul_add_sb_plus_e ------------------ 221| | 222| | // Encode mu, and compute CC = W + enc(mu') (mod q) 223| 8| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 55| 8|#define frodo_key_encode oqs_kem_efrodokem_976_shake_key_encode ------------------ 224| 8| frodo_add(CC, W, CC); ------------------ | | 53| 8|#define frodo_add oqs_kem_efrodokem_976_shake_add ------------------ 225| | 226| | // Prepare input to F 227| 8| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_shake_length_ciphertext | | ------------------ | | | | 146| 8|#define OQS_KEM_efrodokem_976_shake_length_ciphertext 15744 | | ------------------ ------------------ 228| | 229| | // Reducing BBp modulo q 230| 62.4k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 62.4k|#define PARAMS_N 976 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 62.4k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 62.4k|#define PARAMS_LOGQ 16 ------------------ | Branch (230:21): [True: 62.4k, False: 8] ------------------ 231| | 232| | // Needs to avoid branching on secret data using constant-time implementation. 233| 8| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 8|#define ct_verify oqs_kem_efrodokem_976_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 8|#define ct_verify oqs_kem_efrodokem_976_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 234| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 235| 8| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 41| 8|#define ct_select oqs_kem_efrodokem_976_shake_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 236| 8| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 8|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 8|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_976_shake_length_ciphertext | | ------------------ | | | | 146| 8|#define OQS_KEM_efrodokem_976_shake_length_ciphertext 15744 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 237| | 238| | // Cleanup: 239| 8| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 240| 8| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 241| 8| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 242| 8| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 8|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 243| 8| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 244| 8| clear_bytes(muprime, BYTES_MU); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 8|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 8|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 8|#define PARAMS_NBAR 8 | | ------------------ ------------------ 245| 8| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 246| 8| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 247| 8| clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 27| 8|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 8|#define CRYPTO_BYTES OQS_KEM_efrodokem_976_shake_length_shared_secret | | ------------------ | | | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 248| 8| return OQS_SUCCESS; 249| 8|} OQS_KEM_efrodokem_1344_aes_keypair: 19| 9|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 9| uint8_t *pk_seedA = &pk[0]; 23| 9| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 24| 9| uint8_t *sk_s = &sk[0]; 25| 9| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 26| 9| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_aes_length_public_key | | ------------------ | | | | 159| 9|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ 27| 9| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_aes_length_public_key | | ------------------ | | | | 159| 9|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 28| 9| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 9| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 9| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 31| 9| uint8_t randomness[2*CRYPTO_BYTES + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 9| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 9| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 34| 9| uint8_t *randomness_z = &randomness[2*CRYPTO_BYTES]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 35| 9| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 9| randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 26| 9|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 39| 9| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 29| 9|#define shake OQS_SHA3_shake256 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 9| shake_input_seedSE[0] = 0x5F; 43| 9| memcpy(&shake_input_seedSE[1], randomness_seedSE, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 44| 9| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 9|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 45| 193k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 193k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 193k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 193k, False: 9] ------------------ 46| 193k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 193k| #define LE_TO_UINT16(n) (n) ------------------ 47| 193k| } 48| 9| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 9|#define frodo_sample_n oqs_kem_efrodokem_1344_aes_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 49| 9| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 9|#define frodo_sample_n oqs_kem_efrodokem_1344_aes_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 50| 9| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 44| 9|#define frodo_mul_add_as_plus_e oqs_kem_efrodokem_1344_aes_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 9| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 9|#define frodo_pack oqs_kem_efrodokem_1344_aes_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_aes_length_public_key | | ------------------ | | | | 159| 9|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 9| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 57| 9| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_aes_length_public_key | | ------------------ | | | | 159| 9|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ 58| 96.7k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 96.7k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 96.7k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 96.7k, False: 9] ------------------ 59| 96.7k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 96.7k| #define UINT16_TO_LE(n) (n) ------------------ 60| 96.7k| } 61| 9| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 9| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 9|#define shake OQS_SHA3_shake256 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_aes_length_public_key | | ------------------ | | | | 159| 9|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 9| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 68| 9| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 69| 9| clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 70| 9| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 71| 9| return OQS_SUCCESS; 72| 9|} OQS_KEM_efrodokem_1344_aes_encaps: 86| 9|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 9| const uint8_t *pk_seedA = &pk[0]; 91| 9| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 92| 9| uint8_t *ct_c1 = &ct[0]; 93| 9| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 94| 9| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 9| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 9| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 9| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 9| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 9| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 100| 9| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 101| 9| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via mu 102| 9| uint8_t *pkh = &G2in[0]; 103| 9| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 104| 9| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 105| 9| uint8_t *seedSE = &G2out[0]; // contains secret data 106| 9| uint8_t *k = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 107| 9| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 108| 9| uint8_t *Fin_ct = &Fin[0]; 109| 9| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_aes_length_ciphertext | | ------------------ | | | | 161| 9|#define OQS_KEM_efrodokem_1344_aes_length_ciphertext 21632 | | ------------------ ------------------ 110| 9| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 111| | 112| | // pkh <- G_1(pk), generate random mu, compute (seedSE || k) = G_2(pkh || mu) 113| 9| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 9|#define shake OQS_SHA3_shake256 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_aes_length_public_key | | ------------------ | | | | 159| 9|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ 114| 9| randombytes(mu, BYTES_MU); ------------------ | | 26| 9|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ 115| 9| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 9|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ 116| | 117| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 118| 9| shake_input_seedSE[0] = 0x96; 119| 9| memcpy(&shake_input_seedSE[1], seedSE, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 120| 9| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 9|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 121| 194k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 194k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 194k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 194k|#define PARAMS_NBAR 8 ------------------ | Branch (121:24): [True: 194k, False: 9] ------------------ 122| 194k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 194k| #define LE_TO_UINT16(n) (n) ------------------ 123| 194k| } 124| 9| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 9|#define frodo_sample_n oqs_kem_efrodokem_1344_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 125| 9| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 9|#define frodo_sample_n oqs_kem_efrodokem_1344_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 126| 9| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 47| 9|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_1344_aes_mul_add_sa_plus_e ------------------ 127| 9| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 9|#define frodo_pack oqs_kem_efrodokem_1344_aes_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 128| | 129| | // Generate Epp, and compute V = Sp*B + Epp 130| 9| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 9|#define frodo_sample_n oqs_kem_efrodokem_1344_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 131| 9| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 9|#define frodo_unpack oqs_kem_efrodokem_1344_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_aes_length_public_key | | ------------------ | | | | 159| 9|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 132| 9| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 50| 9|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_1344_aes_mul_add_sb_plus_e ------------------ 133| | 134| | // Encode mu, and compute C = V + enc(mu) (mod q) 135| 9| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 55| 9|#define frodo_key_encode oqs_kem_efrodokem_1344_aes_key_encode ------------------ 136| 9| frodo_add(C, V, C); ------------------ | | 53| 9|#define frodo_add oqs_kem_efrodokem_1344_aes_add ------------------ 137| 9| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 9|#define frodo_pack oqs_kem_efrodokem_1344_aes_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 138| | 139| | // Compute ss = F(ct||KK) 140| 9| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_aes_length_ciphertext | | ------------------ | | | | 161| 9|#define OQS_KEM_efrodokem_1344_aes_length_ciphertext 21632 | | ------------------ ------------------ 141| 9| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 142| 9| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 9|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_aes_length_ciphertext | | ------------------ | | | | 161| 9|#define OQS_KEM_efrodokem_1344_aes_length_ciphertext 21632 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 143| | 144| | // Cleanup: 145| 9| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 146| 9| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 147| 9| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 148| 9| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 149| 9| clear_bytes(mu, BYTES_MU); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ 150| 9| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 151| 9| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 152| 9| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 153| 9| return OQS_SUCCESS; 154| 9|} OQS_KEM_efrodokem_1344_aes_decaps: 158| 9|{ // FrodoKEM's key decapsulation 159| | // Inputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 160| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 161| | // Output: shared key ss (CRYPTO_BYTES bytes) 162| 9| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 163| 9| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 164| 9| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 165| 9| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 166| 9| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 167| 9| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 168| 9| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 169| 9| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 170| 9| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 171| 9| const uint8_t *ct_c1 = &ct[0]; 172| 9| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 173| 9| const uint8_t *sk_s = &sk[0]; 174| 9| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 175| 9| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_aes_length_public_key | | ------------------ | | | | 159| 9|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ 176| 9| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 177| 9| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_aes_length_public_key | | ------------------ | | | | 159| 9|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 178| 9| const uint8_t *pk_seedA = &sk_pk[0]; 179| 9| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 180| 9| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via muprime 181| 9| uint8_t *pkh = &G2in[0]; 182| 9| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 183| 9| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 184| 9| uint8_t *seedSEprime = &G2out[0]; // contains secret data 185| 9| uint8_t *kprime = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 186| 9| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 187| 9| uint8_t *Fin_ct = &Fin[0]; 188| 9| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_aes_length_ciphertext | | ------------------ | | | | 161| 9|#define OQS_KEM_efrodokem_1344_aes_length_ciphertext 21632 | | ------------------ ------------------ 189| 9| uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES]; // contains secret data 190| | 191| 96.7k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 96.7k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 96.7k|#define PARAMS_NBAR 8 ------------------ | Branch (191:24): [True: 96.7k, False: 9] ------------------ 192| 96.7k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 96.7k| #define LE_TO_UINT16(n) (n) ------------------ 193| 96.7k| } 194| | 195| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 196| 9| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 9|#define frodo_unpack oqs_kem_efrodokem_1344_aes_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 197| 9| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 9|#define frodo_unpack oqs_kem_efrodokem_1344_aes_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 198| 9| frodo_mul_bs(W, Bp, S); ------------------ | | 51| 9|#define frodo_mul_bs oqs_kem_efrodokem_1344_aes_mul_bs ------------------ 199| 9| frodo_sub(W, C, W); ------------------ | | 54| 9|#define frodo_sub oqs_kem_efrodokem_1344_aes_sub ------------------ 200| 9| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 56| 9|#define frodo_key_decode oqs_kem_efrodokem_1344_aes_key_decode ------------------ 201| | 202| | // Generate (seedSE' || k') = G_2(pkh || mu') 203| 9| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 20| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 204| 9| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 9|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ 205| | 206| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 207| 9| shake_input_seedSEprime[0] = 0x96; 208| 9| memcpy(&shake_input_seedSEprime[1], seedSEprime, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 209| 9| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 29| 9|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 210| 194k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 194k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 194k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 194k|#define PARAMS_NBAR 8 ------------------ | Branch (210:24): [True: 194k, False: 9] ------------------ 211| 194k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 194k| #define LE_TO_UINT16(n) (n) ------------------ 212| 194k| } 213| 9| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 9|#define frodo_sample_n oqs_kem_efrodokem_1344_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 214| 9| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 9|#define frodo_sample_n oqs_kem_efrodokem_1344_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 215| 9| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 47| 9|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_1344_aes_mul_add_sa_plus_e ------------------ 216| | 217| | // Generate Epp, and compute W = Sp*B + Epp 218| 9| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 9|#define frodo_sample_n oqs_kem_efrodokem_1344_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 219| 9| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 9|#define frodo_unpack oqs_kem_efrodokem_1344_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_aes_length_public_key | | ------------------ | | | | 159| 9|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 220| 9| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 50| 9|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_1344_aes_mul_add_sb_plus_e ------------------ 221| | 222| | // Encode mu, and compute CC = W + enc(mu') (mod q) 223| 9| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 55| 9|#define frodo_key_encode oqs_kem_efrodokem_1344_aes_key_encode ------------------ 224| 9| frodo_add(CC, W, CC); ------------------ | | 53| 9|#define frodo_add oqs_kem_efrodokem_1344_aes_add ------------------ 225| | 226| | // Prepare input to F 227| 9| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_aes_length_ciphertext | | ------------------ | | | | 161| 9|#define OQS_KEM_efrodokem_1344_aes_length_ciphertext 21632 | | ------------------ ------------------ 228| | 229| | // Reducing BBp modulo q 230| 96.7k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 96.7k|#define PARAMS_N 1344 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 96.7k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 96.7k|#define PARAMS_LOGQ 16 ------------------ | Branch (230:21): [True: 96.7k, False: 9] ------------------ 231| | 232| | // Needs to avoid branching on secret data using constant-time implementation. 233| 9| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 9|#define ct_verify oqs_kem_efrodokem_1344_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 9|#define ct_verify oqs_kem_efrodokem_1344_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 234| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 235| 9| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 41| 9|#define ct_select oqs_kem_efrodokem_1344_aes_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 236| 9| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 9|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_aes_length_ciphertext | | ------------------ | | | | 161| 9|#define OQS_KEM_efrodokem_1344_aes_length_ciphertext 21632 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 237| | 238| | // Cleanup: 239| 9| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 240| 9| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 241| 9| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 242| 9| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 243| 9| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 244| 9| clear_bytes(muprime, BYTES_MU); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ 245| 9| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 246| 9| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 247| 9| clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 27| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_aes_length_shared_secret | | ------------------ | | | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 248| 9| return OQS_SUCCESS; 249| 9|} OQS_KEM_efrodokem_1344_shake_keypair: 19| 7|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 7| uint8_t *pk_seedA = &pk[0]; 23| 7| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 7|#define BYTES_SEED_A 16 ------------------ 24| 7| uint8_t *sk_s = &sk[0]; 25| 7| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 26| 7| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 7|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_shake_length_public_key | | ------------------ | | | | 174| 7|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ 27| 7| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 7|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_shake_length_public_key | | ------------------ | | | | 174| 7|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 28| 7| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 7| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 7| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 31| 7| uint8_t randomness[2*CRYPTO_BYTES + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 7| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 7| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 34| 7| uint8_t *randomness_z = &randomness[2*CRYPTO_BYTES]; ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 35| 7| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 7| randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 26| 7|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + CRYPTO_BYTES + BYTES_SEED_A); ------------------ | | 18| 7|#define BYTES_SEED_A 16 ------------------ 39| 7| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 29| 7|#define shake OQS_SHA3_shake256 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 7|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 7|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 7| shake_input_seedSE[0] = 0x5F; 43| 7| memcpy(&shake_input_seedSE[1], randomness_seedSE, CRYPTO_BYTES); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 44| 7| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 7|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 45| 150k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 150k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 150k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 150k, False: 7] ------------------ 46| 150k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 150k| #define LE_TO_UINT16(n) (n) ------------------ 47| 150k| } 48| 7| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 7|#define frodo_sample_n oqs_kem_efrodokem_1344_shake_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 49| 7| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 7|#define frodo_sample_n oqs_kem_efrodokem_1344_shake_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 50| 7| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 44| 7|#define frodo_mul_add_as_plus_e oqs_kem_efrodokem_1344_shake_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 7| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 7|#define frodo_pack oqs_kem_efrodokem_1344_shake_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 7|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_shake_length_public_key | | ------------------ | | | | 174| 7|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 7|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 7|#define PARAMS_LOGQ 16 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 7| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 57| 7| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 7|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_shake_length_public_key | | ------------------ | | | | 174| 7|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ 58| 75.2k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 75.2k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 75.2k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 75.2k, False: 7] ------------------ 59| 75.2k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 75.2k| #define UINT16_TO_LE(n) (n) ------------------ 60| 75.2k| } 61| 7| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 7| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 7|#define shake OQS_SHA3_shake256 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 7|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 7|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_shake_length_public_key | | ------------------ | | | | 174| 7|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 7| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 68| 7| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 69| 7| clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 27| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, 2*CRYPTO_BYTES); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 70| 7| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 71| 7| return OQS_SUCCESS; 72| 7|} OQS_KEM_efrodokem_1344_shake_encaps: 86| 7|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 7| const uint8_t *pk_seedA = &pk[0]; 91| 7| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 7|#define BYTES_SEED_A 16 ------------------ 92| 7| uint8_t *ct_c1 = &ct[0]; 93| 7| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 7|#define PARAMS_LOGQ 16 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 94| 7| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 7| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 7| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 7| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 7| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 7| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 100| 7| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 101| 7| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via mu 102| 7| uint8_t *pkh = &G2in[0]; 103| 7| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 7|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 104| 7| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 105| 7| uint8_t *seedSE = &G2out[0]; // contains secret data 106| 7| uint8_t *k = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 107| 7| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 108| 7| uint8_t *Fin_ct = &Fin[0]; 109| 7| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 7|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_shake_length_ciphertext | | ------------------ | | | | 176| 7|#define OQS_KEM_efrodokem_1344_shake_length_ciphertext 21632 | | ------------------ ------------------ 110| 7| uint8_t shake_input_seedSE[1 + CRYPTO_BYTES]; // contains secret data 111| | 112| | // pkh <- G_1(pk), generate random mu, compute (seedSE || k) = G_2(pkh || mu) 113| 7| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 29| 7|#define shake OQS_SHA3_shake256 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 20| 7|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 7|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_shake_length_public_key | | ------------------ | | | | 174| 7|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ 114| 7| randombytes(mu, BYTES_MU); ------------------ | | 26| 7|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU); ------------------ | | 19| 7|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 7|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 7|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 7|#define PARAMS_NBAR 8 | | ------------------ ------------------ 115| 7| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 7|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 7|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 7|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 7|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 7|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 7|#define PARAMS_NBAR 8 | | ------------------ ------------------ 116| | 117| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 118| 7| shake_input_seedSE[0] = 0x96; 119| 7| memcpy(&shake_input_seedSE[1], seedSE, CRYPTO_BYTES); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 120| 7| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 29| 7|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 121| 150k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 150k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 150k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 150k|#define PARAMS_NBAR 8 ------------------ | Branch (121:24): [True: 150k, False: 7] ------------------ 122| 150k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 150k| #define LE_TO_UINT16(n) (n) ------------------ 123| 150k| } 124| 7| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 7|#define frodo_sample_n oqs_kem_efrodokem_1344_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 125| 7| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 7|#define frodo_sample_n oqs_kem_efrodokem_1344_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 126| 7| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 47| 7|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_1344_shake_mul_add_sa_plus_e ------------------ 127| 7| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 7|#define frodo_pack oqs_kem_efrodokem_1344_shake_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 7|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 7|#define PARAMS_LOGQ 16 ------------------ 128| | 129| | // Generate Epp, and compute V = Sp*B + Epp 130| 7| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 7|#define frodo_sample_n oqs_kem_efrodokem_1344_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 131| 7| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 7|#define frodo_unpack oqs_kem_efrodokem_1344_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 7|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_shake_length_public_key | | ------------------ | | | | 174| 7|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 7|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 7|#define PARAMS_LOGQ 16 ------------------ 132| 7| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 50| 7|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_1344_shake_mul_add_sb_plus_e ------------------ 133| | 134| | // Encode mu, and compute C = V + enc(mu) (mod q) 135| 7| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 55| 7|#define frodo_key_encode oqs_kem_efrodokem_1344_shake_key_encode ------------------ 136| 7| frodo_add(C, V, C); ------------------ | | 53| 7|#define frodo_add oqs_kem_efrodokem_1344_shake_add ------------------ 137| 7| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 39| 7|#define frodo_pack oqs_kem_efrodokem_1344_shake_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 7|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 7|#define PARAMS_LOGQ 16 ------------------ 138| | 139| | // Compute ss = F(ct||KK) 140| 7| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 7|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_shake_length_ciphertext | | ------------------ | | | | 176| 7|#define OQS_KEM_efrodokem_1344_shake_length_ciphertext 21632 | | ------------------ ------------------ 141| 7| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 142| 7| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 7|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 7|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_shake_length_ciphertext | | ------------------ | | | | 176| 7|#define OQS_KEM_efrodokem_1344_shake_length_ciphertext 21632 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 143| | 144| | // Cleanup: 145| 7| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 146| 7| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 147| 7| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 148| 7| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 149| 7| clear_bytes(mu, BYTES_MU); ------------------ | | 27| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 7|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 7|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 7|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 7|#define PARAMS_NBAR 8 | | ------------------ ------------------ 150| 7| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 151| 7| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 152| 7| clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 27| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + CRYPTO_BYTES); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 153| 7| return OQS_SUCCESS; 154| 7|} OQS_KEM_efrodokem_1344_shake_decaps: 158| 7|{ // FrodoKEM's key decapsulation 159| | // Inputs: ciphertext ct = ct_c1||ct_c2 ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 bytes) 160| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 161| | // Output: shared key ss (CRYPTO_BYTES bytes) 162| 7| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 163| 7| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 164| 7| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 165| 7| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 166| 7| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 167| 7| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 168| 7| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 169| 7| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 170| 7| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 171| 7| const uint8_t *ct_c1 = &ct[0]; 172| 7| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 7|#define PARAMS_LOGQ 16 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 173| 7| const uint8_t *sk_s = &sk[0]; 174| 7| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 175| 7| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 7|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_shake_length_public_key | | ------------------ | | | | 174| 7|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ 176| 7| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 177| 7| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 7|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_shake_length_public_key | | ------------------ | | | | 174| 7|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 178| 7| const uint8_t *pk_seedA = &sk_pk[0]; 179| 7| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 7|#define BYTES_SEED_A 16 ------------------ 180| 7| uint8_t G2in[BYTES_PKHASH + BYTES_MU]; // contains secret data via muprime 181| 7| uint8_t *pkh = &G2in[0]; 182| 7| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 20| 7|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 183| 7| uint8_t G2out[2*CRYPTO_BYTES]; // contains secret data 184| 7| uint8_t *seedSEprime = &G2out[0]; // contains secret data 185| 7| uint8_t *kprime = &G2out[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 186| 7| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 187| 7| uint8_t *Fin_ct = &Fin[0]; 188| 7| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 7|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_shake_length_ciphertext | | ------------------ | | | | 176| 7|#define OQS_KEM_efrodokem_1344_shake_length_ciphertext 21632 | | ------------------ ------------------ 189| 7| uint8_t shake_input_seedSEprime[1 + CRYPTO_BYTES]; // contains secret data 190| | 191| 75.2k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 75.2k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 75.2k|#define PARAMS_NBAR 8 ------------------ | Branch (191:24): [True: 75.2k, False: 7] ------------------ 192| 75.2k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 75.2k| #define LE_TO_UINT16(n) (n) ------------------ 193| 75.2k| } 194| | 195| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 196| 7| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 7|#define frodo_unpack oqs_kem_efrodokem_1344_shake_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 7|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 7|#define PARAMS_LOGQ 16 ------------------ 197| 7| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 40| 7|#define frodo_unpack oqs_kem_efrodokem_1344_shake_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 7|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 7|#define PARAMS_LOGQ 16 ------------------ 198| 7| frodo_mul_bs(W, Bp, S); ------------------ | | 51| 7|#define frodo_mul_bs oqs_kem_efrodokem_1344_shake_mul_bs ------------------ 199| 7| frodo_sub(W, C, W); ------------------ | | 54| 7|#define frodo_sub oqs_kem_efrodokem_1344_shake_sub ------------------ 200| 7| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 56| 7|#define frodo_key_decode oqs_kem_efrodokem_1344_shake_key_decode ------------------ 201| | 202| | // Generate (seedSE' || k') = G_2(pkh || mu') 203| 7| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 20| 7|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 204| 7| shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 29| 7|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 20| 7|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, CRYPTO_BYTES + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU); ------------------ | | 19| 7|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 7|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 7|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 7|#define PARAMS_NBAR 8 | | ------------------ ------------------ 205| | 206| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 207| 7| shake_input_seedSEprime[0] = 0x96; 208| 7| memcpy(&shake_input_seedSEprime[1], seedSEprime, CRYPTO_BYTES); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 209| 7| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 29| 7|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 210| 150k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 150k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 150k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 150k|#define PARAMS_NBAR 8 ------------------ | Branch (210:24): [True: 150k, False: 7] ------------------ 211| 150k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 150k| #define LE_TO_UINT16(n) (n) ------------------ 212| 150k| } 213| 7| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 7|#define frodo_sample_n oqs_kem_efrodokem_1344_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 214| 7| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 38| 7|#define frodo_sample_n oqs_kem_efrodokem_1344_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 215| 7| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 47| 7|#define frodo_mul_add_sa_plus_e oqs_kem_efrodokem_1344_shake_mul_add_sa_plus_e ------------------ 216| | 217| | // Generate Epp, and compute W = Sp*B + Epp 218| 7| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 38| 7|#define frodo_sample_n oqs_kem_efrodokem_1344_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 219| 7| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 40| 7|#define frodo_unpack oqs_kem_efrodokem_1344_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 7|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_efrodokem_1344_shake_length_public_key | | ------------------ | | | | 174| 7|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 7|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 7|#define PARAMS_LOGQ 16 ------------------ 220| 7| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 50| 7|#define frodo_mul_add_sb_plus_e oqs_kem_efrodokem_1344_shake_mul_add_sb_plus_e ------------------ 221| | 222| | // Encode mu, and compute CC = W + enc(mu') (mod q) 223| 7| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 55| 7|#define frodo_key_encode oqs_kem_efrodokem_1344_shake_key_encode ------------------ 224| 7| frodo_add(CC, W, CC); ------------------ | | 53| 7|#define frodo_add oqs_kem_efrodokem_1344_shake_add ------------------ 225| | 226| | // Prepare input to F 227| 7| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 7|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_shake_length_ciphertext | | ------------------ | | | | 176| 7|#define OQS_KEM_efrodokem_1344_shake_length_ciphertext 21632 | | ------------------ ------------------ 228| | 229| | // Reducing BBp modulo q 230| 75.2k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 75.2k|#define PARAMS_N 1344 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 75.2k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 75.2k|#define PARAMS_LOGQ 16 ------------------ | Branch (230:21): [True: 75.2k, False: 7] ------------------ 231| | 232| | // Needs to avoid branching on secret data using constant-time implementation. 233| 7| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 7|#define ct_verify oqs_kem_efrodokem_1344_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 42| 7|#define ct_verify oqs_kem_efrodokem_1344_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 234| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 235| 7| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 41| 7|#define ct_select oqs_kem_efrodokem_1344_shake_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 236| 7| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 29| 7|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 7|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_efrodokem_1344_shake_length_ciphertext | | ------------------ | | | | 176| 7|#define OQS_KEM_efrodokem_1344_shake_length_ciphertext 21632 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 237| | 238| | // Cleanup: 239| 7| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 240| 7| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 241| 7| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 242| 7| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 243| 7| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 27| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 244| 7| clear_bytes(muprime, BYTES_MU); ------------------ | | 27| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 7|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 7|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 7|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 7|#define PARAMS_NBAR 8 | | ------------------ ------------------ 245| 7| clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 27| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, 2*CRYPTO_BYTES); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 246| 7| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 27| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 247| 7| clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 27| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + CRYPTO_BYTES); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_efrodokem_1344_shake_length_shared_secret | | ------------------ | | | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 248| 7| return OQS_SUCCESS; 249| 7|} OQS_KEM_frodokem_640_aes_keypair: 19| 2|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 2| uint8_t *pk_seedA = &pk[0]; 23| 2| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 24| 2| uint8_t *sk_s = &sk[0]; 25| 2| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 26| 2| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_aes_length_public_key | | ------------------ | | | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ 27| 2| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_aes_length_public_key | | ------------------ | | | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 28| 2| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 2| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 2| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 31| 2| uint8_t randomness[CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 2| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 2| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 34| 2| uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 35| 2| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 2| randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 28| 2|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 39| 2| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 31| 2|#define shake OQS_SHA3_shake128 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 2| shake_input_seedSE[0] = 0x5F; 43| 2| memcpy(&shake_input_seedSE[1], randomness_seedSE, BYTES_SEED_SE); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 44| 2| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 2|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 45| 20.4k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 20.4k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 20.4k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 20.4k, False: 2] ------------------ 46| 20.4k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 20.4k| #define LE_TO_UINT16(n) (n) ------------------ 47| 20.4k| } 48| 2| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 2|#define frodo_sample_n oqs_kem_frodokem_640_aes_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 49| 2| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 2|#define frodo_sample_n oqs_kem_frodokem_640_aes_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 50| 2| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 46| 2|#define frodo_mul_add_as_plus_e oqs_kem_frodokem_640_aes_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 2| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 2|#define frodo_pack oqs_kem_frodokem_640_aes_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_aes_length_public_key | | ------------------ | | | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 2| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 57| 2| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_aes_length_public_key | | ------------------ | | | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ 58| 10.2k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 10.2k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 10.2k, False: 2] ------------------ 59| 10.2k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 10.2k| #define UINT16_TO_LE(n) (n) ------------------ 60| 10.2k| } 61| 2| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 2| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 2|#define shake OQS_SHA3_shake128 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_aes_length_public_key | | ------------------ | | | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 2| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 68| 2| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 69| 2| clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 70| 2| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 71| 2| return OQS_SUCCESS; 72| 2|} OQS_KEM_frodokem_640_aes_encaps: 86| 2|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 2| const uint8_t *pk_seedA = &pk[0]; 91| 2| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 92| 2| uint8_t *ct_c1 = &ct[0]; 93| 2| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 94| 2| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 2| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 2| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 2| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 2| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 2| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 100| 2| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 101| 2| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via mu 102| 2| uint8_t *pkh = &G2in[0]; 103| 2| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 104| 2| uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ 105| 2| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 106| 2| uint8_t *seedSE = &G2out[0]; // contains secret data 107| 2| uint8_t *k = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 108| 2| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 109| 2| uint8_t *Fin_ct = &Fin[0]; 110| 2| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_aes_length_ciphertext | | ------------------ | | | | 11| 2|#define OQS_KEM_frodokem_640_aes_length_ciphertext 9752 | | ------------------ ------------------ 111| 2| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 112| | 113| | // pkh <- G_1(pk), generate random mu and salt, compute (seedSE || k) = G_2(pkh || mu || salt) 114| 2| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 2|#define shake OQS_SHA3_shake128 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_aes_length_public_key | | ------------------ | | | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ 115| 2| randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 28| 2|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 20| 2|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 116| 2| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 2|#define shake OQS_SHA3_shake128 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 2|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 117| | 118| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 119| 2| shake_input_seedSE[0] = 0x96; 120| 2| memcpy(&shake_input_seedSE[1], seedSE, BYTES_SEED_SE); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 121| 2| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 2|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 122| 20.6k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 20.6k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 20.6k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 20.6k|#define PARAMS_NBAR 8 ------------------ | Branch (122:24): [True: 20.6k, False: 2] ------------------ 123| 20.6k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 20.6k| #define LE_TO_UINT16(n) (n) ------------------ 124| 20.6k| } 125| 2| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 2|#define frodo_sample_n oqs_kem_frodokem_640_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 126| 2| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 2|#define frodo_sample_n oqs_kem_frodokem_640_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 127| 2| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 49| 2|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_640_aes_mul_add_sa_plus_e ------------------ 128| 2| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 2|#define frodo_pack oqs_kem_frodokem_640_aes_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 129| | 130| | // Generate Epp, and compute V = Sp*B + Epp 131| 2| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 2|#define frodo_sample_n oqs_kem_frodokem_640_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 132| 2| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 2|#define frodo_unpack oqs_kem_frodokem_640_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_aes_length_public_key | | ------------------ | | | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 133| 2| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 52| 2|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_640_aes_mul_add_sb_plus_e ------------------ 134| | 135| | // Encode mu, and compute C = V + enc(mu) (mod q) 136| 2| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 57| 2|#define frodo_key_encode oqs_kem_frodokem_640_aes_key_encode ------------------ 137| 2| frodo_add(C, V, C); ------------------ | | 55| 2|#define frodo_add oqs_kem_frodokem_640_aes_add ------------------ 138| 2| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 2|#define frodo_pack oqs_kem_frodokem_640_aes_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 139| | 140| | // Append salt to ct and compute ss = F(ct_c1||ct_c2||salt||k) 141| 2| memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_aes_length_ciphertext | | ------------------ | | | | 11| 2|#define OQS_KEM_frodokem_640_aes_length_ciphertext 9752 | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 2|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 2|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 142| 2| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_aes_length_ciphertext | | ------------------ | | | | 11| 2|#define OQS_KEM_frodokem_640_aes_length_ciphertext 9752 | | ------------------ ------------------ 143| 2| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 144| 2| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 2|#define shake OQS_SHA3_shake128 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_aes_length_ciphertext | | ------------------ | | | | 11| 2|#define OQS_KEM_frodokem_640_aes_length_ciphertext 9752 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 145| | 146| | // Cleanup: 147| 2| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 148| 2| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 149| 2| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 150| 2| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 151| 2| clear_bytes(mu, BYTES_MU); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ 152| 2| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 153| 2| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 154| 2| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 155| 2| return OQS_SUCCESS; 156| 2|} OQS_KEM_frodokem_640_aes_decaps: 160| 2|{ // FrodoKEM's key decapsulation 161| | // Inputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 162| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 163| | // Output: shared key ss (CRYPTO_BYTES bytes) 164| 2| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 165| 2| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 166| 2| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 167| 2| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 168| 2| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 169| 2| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 170| 2| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 171| 2| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 172| 2| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 173| 2| const uint8_t *ct_c1 = &ct[0]; 174| 2| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 175| 2| const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_aes_length_ciphertext | | ------------------ | | | | 11| 2|#define OQS_KEM_frodokem_640_aes_length_ciphertext 9752 | | ------------------ ------------------ const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 20| 2|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 176| 2| const uint8_t *sk_s = &sk[0]; 177| 2| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 178| 2| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_aes_length_public_key | | ------------------ | | | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ 179| 2| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 180| 2| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_aes_length_public_key | | ------------------ | | | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 181| 2| const uint8_t *pk_seedA = &sk_pk[0]; 182| 2| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 183| 2| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via muprime 184| 2| uint8_t *pkh = &G2in[0]; 185| 2| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 186| 2| uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ 187| 2| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 188| 2| uint8_t *seedSEprime = &G2out[0]; // contains secret data 189| 2| uint8_t *kprime = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 190| 2| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 191| 2| uint8_t *Fin_ct = &Fin[0]; 192| 2| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_aes_length_ciphertext | | ------------------ | | | | 11| 2|#define OQS_KEM_frodokem_640_aes_length_ciphertext 9752 | | ------------------ ------------------ 193| 2| uint8_t shake_input_seedSEprime[1 + BYTES_SEED_SE]; // contains secret data 194| | 195| | 196| 10.2k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 10.2k|#define PARAMS_NBAR 8 ------------------ | Branch (196:24): [True: 10.2k, False: 2] ------------------ 197| 10.2k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 10.2k| #define LE_TO_UINT16(n) (n) ------------------ 198| 10.2k| } 199| | 200| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 201| 2| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 2|#define frodo_unpack oqs_kem_frodokem_640_aes_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 202| 2| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 2|#define frodo_unpack oqs_kem_frodokem_640_aes_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 203| 2| frodo_mul_bs(W, Bp, S); ------------------ | | 53| 2|#define frodo_mul_bs oqs_kem_frodokem_640_aes_mul_bs ------------------ 204| 2| frodo_sub(W, C, W); ------------------ | | 56| 2|#define frodo_sub oqs_kem_frodokem_640_aes_sub ------------------ 205| 2| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 58| 2|#define frodo_key_decode oqs_kem_frodokem_640_aes_key_decode ------------------ 206| | 207| | // Generate (seedSE' || k') = G_2(pkh || mu' || salt) 208| 2| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 22| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 209| 2| memcpy(G2in_salt, salt, BYTES_SALT); ------------------ | | 20| 2|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 210| 2| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 2|#define shake OQS_SHA3_shake128 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 2|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 2|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 211| | 212| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 213| 2| shake_input_seedSEprime[0] = 0x96; 214| 2| memcpy(&shake_input_seedSEprime[1], seedSEprime, BYTES_SEED_SE); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 215| 2| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 31| 2|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 216| 20.6k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 20.6k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 20.6k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 20.6k|#define PARAMS_NBAR 8 ------------------ | Branch (216:24): [True: 20.6k, False: 2] ------------------ 217| 20.6k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 20.6k| #define LE_TO_UINT16(n) (n) ------------------ 218| 20.6k| } 219| 2| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 2|#define frodo_sample_n oqs_kem_frodokem_640_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 220| 2| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 2|#define frodo_sample_n oqs_kem_frodokem_640_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 221| 2| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 49| 2|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_640_aes_mul_add_sa_plus_e ------------------ 222| | 223| | // Generate Epp, and compute W = Sp*B + Epp 224| 2| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 2|#define frodo_sample_n oqs_kem_frodokem_640_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 225| 2| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 2|#define frodo_unpack oqs_kem_frodokem_640_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 2|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_aes_length_public_key | | ------------------ | | | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 226| 2| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 52| 2|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_640_aes_mul_add_sb_plus_e ------------------ 227| | 228| | // Encode mu, and compute CC = W + enc(mu') (mod q) 229| 2| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 57| 2|#define frodo_key_encode oqs_kem_frodokem_640_aes_key_encode ------------------ 230| 2| frodo_add(CC, W, CC); ------------------ | | 55| 2|#define frodo_add oqs_kem_frodokem_640_aes_add ------------------ 231| | 232| | // Prepare input to F 233| 2| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_aes_length_ciphertext | | ------------------ | | | | 11| 2|#define OQS_KEM_frodokem_640_aes_length_ciphertext 9752 | | ------------------ ------------------ 234| | 235| | // Reducing BBp modulo q 236| 10.2k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 10.2k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 10.2k|#define PARAMS_LOGQ 15 ------------------ | Branch (236:21): [True: 10.2k, False: 2] ------------------ 237| | 238| | // Needs to avoid branching on secret data using constant-time implementation. 239| 2| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 2|#define ct_verify oqs_kem_frodokem_640_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 2|#define ct_verify oqs_kem_frodokem_640_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 240| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 241| 2| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 43| 2|#define ct_select oqs_kem_frodokem_640_aes_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 242| 2| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 2|#define shake OQS_SHA3_shake128 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 2|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_aes_length_ciphertext | | ------------------ | | | | 11| 2|#define OQS_KEM_frodokem_640_aes_length_ciphertext 9752 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 243| | 244| | // Cleanup: 245| 2| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 246| 2| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 247| 2| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 248| 2| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 2|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 249| 2| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 250| 2| clear_bytes(muprime, BYTES_MU); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 2|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 2|#define PARAMS_NBAR 8 | | ------------------ ------------------ 251| 2| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 252| 2| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | ------------------ | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | ------------------ ------------------ 253| 2| clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 29| 2|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 2|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 2|#define CRYPTO_BYTES OQS_KEM_frodokem_640_aes_length_shared_secret | | | | ------------------ | | | | | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 254| 2| return OQS_SUCCESS; 255| 2|} OQS_KEM_frodokem_640_shake_keypair: 19| 3|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 3| uint8_t *pk_seedA = &pk[0]; 23| 3| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 24| 3| uint8_t *sk_s = &sk[0]; 25| 3| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 26| 3| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_shake_length_public_key | | ------------------ | | | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ 27| 3| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_shake_length_public_key | | ------------------ | | | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 28| 3| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 3| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 3| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 31| 3| uint8_t randomness[CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 3| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 3| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 34| 3| uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 35| 3| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 3| randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 28| 3|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 39| 3| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 31| 3|#define shake OQS_SHA3_shake128 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 3| shake_input_seedSE[0] = 0x5F; 43| 3| memcpy(&shake_input_seedSE[1], randomness_seedSE, BYTES_SEED_SE); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 44| 3| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 3|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 45| 30.7k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 30.7k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 30.7k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 30.7k, False: 3] ------------------ 46| 30.7k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 30.7k| #define LE_TO_UINT16(n) (n) ------------------ 47| 30.7k| } 48| 3| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 3|#define frodo_sample_n oqs_kem_frodokem_640_shake_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 49| 3| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 3|#define frodo_sample_n oqs_kem_frodokem_640_shake_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 50| 3| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 46| 3|#define frodo_mul_add_as_plus_e oqs_kem_frodokem_640_shake_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 3| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 3|#define frodo_pack oqs_kem_frodokem_640_shake_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_shake_length_public_key | | ------------------ | | | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 3| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 57| 3| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_shake_length_public_key | | ------------------ | | | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ 58| 15.3k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 15.3k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 15.3k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 15.3k, False: 3] ------------------ 59| 15.3k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 15.3k| #define UINT16_TO_LE(n) (n) ------------------ 60| 15.3k| } 61| 3| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 3| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 3|#define shake OQS_SHA3_shake128 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_shake_length_public_key | | ------------------ | | | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 3| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 68| 3| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 69| 3| clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 70| 3| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 71| 3| return OQS_SUCCESS; 72| 3|} OQS_KEM_frodokem_640_shake_encaps: 86| 3|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 3| const uint8_t *pk_seedA = &pk[0]; 91| 3| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 92| 3| uint8_t *ct_c1 = &ct[0]; 93| 3| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 94| 3| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 3| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 3| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 3| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 3| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 3| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 100| 3| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 101| 3| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via mu 102| 3| uint8_t *pkh = &G2in[0]; 103| 3| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 104| 3| uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ 105| 3| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 106| 3| uint8_t *seedSE = &G2out[0]; // contains secret data 107| 3| uint8_t *k = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 108| 3| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 109| 3| uint8_t *Fin_ct = &Fin[0]; 110| 3| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_shake_length_ciphertext | | ------------------ | | | | 26| 3|#define OQS_KEM_frodokem_640_shake_length_ciphertext 9752 | | ------------------ ------------------ 111| 3| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 112| | 113| | // pkh <- G_1(pk), generate random mu and salt, compute (seedSE || k) = G_2(pkh || mu || salt) 114| 3| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 3|#define shake OQS_SHA3_shake128 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_shake_length_public_key | | ------------------ | | | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ 115| 3| randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 28| 3|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 20| 3|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 116| 3| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 3|#define shake OQS_SHA3_shake128 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 3|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 117| | 118| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 119| 3| shake_input_seedSE[0] = 0x96; 120| 3| memcpy(&shake_input_seedSE[1], seedSE, BYTES_SEED_SE); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 121| 3| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 3|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 122| 30.9k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 30.9k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 30.9k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 30.9k|#define PARAMS_NBAR 8 ------------------ | Branch (122:24): [True: 30.9k, False: 3] ------------------ 123| 30.9k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 30.9k| #define LE_TO_UINT16(n) (n) ------------------ 124| 30.9k| } 125| 3| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 3|#define frodo_sample_n oqs_kem_frodokem_640_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 126| 3| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 3|#define frodo_sample_n oqs_kem_frodokem_640_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 127| 3| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 49| 3|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_640_shake_mul_add_sa_plus_e ------------------ 128| 3| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 3|#define frodo_pack oqs_kem_frodokem_640_shake_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 129| | 130| | // Generate Epp, and compute V = Sp*B + Epp 131| 3| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 3|#define frodo_sample_n oqs_kem_frodokem_640_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 132| 3| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 3|#define frodo_unpack oqs_kem_frodokem_640_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_shake_length_public_key | | ------------------ | | | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 133| 3| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 52| 3|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_640_shake_mul_add_sb_plus_e ------------------ 134| | 135| | // Encode mu, and compute C = V + enc(mu) (mod q) 136| 3| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 57| 3|#define frodo_key_encode oqs_kem_frodokem_640_shake_key_encode ------------------ 137| 3| frodo_add(C, V, C); ------------------ | | 55| 3|#define frodo_add oqs_kem_frodokem_640_shake_add ------------------ 138| 3| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 3|#define frodo_pack oqs_kem_frodokem_640_shake_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 139| | 140| | // Append salt to ct and compute ss = F(ct_c1||ct_c2||salt||k) 141| 3| memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_shake_length_ciphertext | | ------------------ | | | | 26| 3|#define OQS_KEM_frodokem_640_shake_length_ciphertext 9752 | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 3|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 3|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 142| 3| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_shake_length_ciphertext | | ------------------ | | | | 26| 3|#define OQS_KEM_frodokem_640_shake_length_ciphertext 9752 | | ------------------ ------------------ 143| 3| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 144| 3| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 3|#define shake OQS_SHA3_shake128 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_shake_length_ciphertext | | ------------------ | | | | 26| 3|#define OQS_KEM_frodokem_640_shake_length_ciphertext 9752 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 145| | 146| | // Cleanup: 147| 3| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 148| 3| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 149| 3| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 150| 3| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 151| 3| clear_bytes(mu, BYTES_MU); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ 152| 3| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 153| 3| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 154| 3| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 155| 3| return OQS_SUCCESS; 156| 3|} OQS_KEM_frodokem_640_shake_decaps: 160| 3|{ // FrodoKEM's key decapsulation 161| | // Inputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 162| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 163| | // Output: shared key ss (CRYPTO_BYTES bytes) 164| 3| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 165| 3| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 166| 3| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 167| 3| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 168| 3| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 169| 3| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 170| 3| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 171| 3| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 172| 3| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 173| 3| const uint8_t *ct_c1 = &ct[0]; 174| 3| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 175| 3| const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_shake_length_ciphertext | | ------------------ | | | | 26| 3|#define OQS_KEM_frodokem_640_shake_length_ciphertext 9752 | | ------------------ ------------------ const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 20| 3|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 176| 3| const uint8_t *sk_s = &sk[0]; 177| 3| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 178| 3| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_shake_length_public_key | | ------------------ | | | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ 179| 3| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 180| 3| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_shake_length_public_key | | ------------------ | | | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 181| 3| const uint8_t *pk_seedA = &sk_pk[0]; 182| 3| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 183| 3| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via muprime 184| 3| uint8_t *pkh = &G2in[0]; 185| 3| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 186| 3| uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ 187| 3| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 188| 3| uint8_t *seedSEprime = &G2out[0]; // contains secret data 189| 3| uint8_t *kprime = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 190| 3| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 191| 3| uint8_t *Fin_ct = &Fin[0]; 192| 3| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_shake_length_ciphertext | | ------------------ | | | | 26| 3|#define OQS_KEM_frodokem_640_shake_length_ciphertext 9752 | | ------------------ ------------------ 193| 3| uint8_t shake_input_seedSEprime[1 + BYTES_SEED_SE]; // contains secret data 194| | 195| | 196| 15.3k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 15.3k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 15.3k|#define PARAMS_NBAR 8 ------------------ | Branch (196:24): [True: 15.3k, False: 3] ------------------ 197| 15.3k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 15.3k| #define LE_TO_UINT16(n) (n) ------------------ 198| 15.3k| } 199| | 200| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 201| 3| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 3|#define frodo_unpack oqs_kem_frodokem_640_shake_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 202| 3| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 3|#define frodo_unpack oqs_kem_frodokem_640_shake_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 203| 3| frodo_mul_bs(W, Bp, S); ------------------ | | 53| 3|#define frodo_mul_bs oqs_kem_frodokem_640_shake_mul_bs ------------------ 204| 3| frodo_sub(W, C, W); ------------------ | | 56| 3|#define frodo_sub oqs_kem_frodokem_640_shake_sub ------------------ 205| 3| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 58| 3|#define frodo_key_decode oqs_kem_frodokem_640_shake_key_decode ------------------ 206| | 207| | // Generate (seedSE' || k') = G_2(pkh || mu' || salt) 208| 3| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 22| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 209| 3| memcpy(G2in_salt, salt, BYTES_SALT); ------------------ | | 20| 3|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 210| 3| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 3|#define shake OQS_SHA3_shake128 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 3|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 3|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 211| | 212| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 213| 3| shake_input_seedSEprime[0] = 0x96; 214| 3| memcpy(&shake_input_seedSEprime[1], seedSEprime, BYTES_SEED_SE); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 215| 3| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 31| 3|#define shake OQS_SHA3_shake128 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 216| 30.9k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 30.9k|#define PARAMS_N 640 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 30.9k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 30.9k|#define PARAMS_NBAR 8 ------------------ | Branch (216:24): [True: 30.9k, False: 3] ------------------ 217| 30.9k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 30.9k| #define LE_TO_UINT16(n) (n) ------------------ 218| 30.9k| } 219| 3| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 3|#define frodo_sample_n oqs_kem_frodokem_640_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 220| 3| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 3|#define frodo_sample_n oqs_kem_frodokem_640_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 221| 3| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 49| 3|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_640_shake_mul_add_sa_plus_e ------------------ 222| | 223| | // Generate Epp, and compute W = Sp*B + Epp 224| 3| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 3|#define frodo_sample_n oqs_kem_frodokem_640_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 225| 3| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 3|#define frodo_unpack oqs_kem_frodokem_640_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 3|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_640_shake_length_public_key | | ------------------ | | | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 226| 3| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 52| 3|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_640_shake_mul_add_sb_plus_e ------------------ 227| | 228| | // Encode mu, and compute CC = W + enc(mu') (mod q) 229| 3| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 57| 3|#define frodo_key_encode oqs_kem_frodokem_640_shake_key_encode ------------------ 230| 3| frodo_add(CC, W, CC); ------------------ | | 55| 3|#define frodo_add oqs_kem_frodokem_640_shake_add ------------------ 231| | 232| | // Prepare input to F 233| 3| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_shake_length_ciphertext | | ------------------ | | | | 26| 3|#define OQS_KEM_frodokem_640_shake_length_ciphertext 9752 | | ------------------ ------------------ 234| | 235| | // Reducing BBp modulo q 236| 15.3k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 15.3k|#define PARAMS_N 640 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 15.3k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 15.3k|#define PARAMS_LOGQ 15 ------------------ | Branch (236:21): [True: 15.3k, False: 3] ------------------ 237| | 238| | // Needs to avoid branching on secret data using constant-time implementation. 239| 3| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 3|#define ct_verify oqs_kem_frodokem_640_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 3|#define ct_verify oqs_kem_frodokem_640_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 240| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 241| 3| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 43| 3|#define ct_select oqs_kem_frodokem_640_shake_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 242| 3| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 3|#define shake OQS_SHA3_shake128 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 3|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_640_shake_length_ciphertext | | ------------------ | | | | 26| 3|#define OQS_KEM_frodokem_640_shake_length_ciphertext 9752 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 243| | 244| | // Cleanup: 245| 3| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 246| 3| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 247| 3| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 248| 3| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 3|#define PARAMS_N 640 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 249| 3| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 250| 3| clear_bytes(muprime, BYTES_MU); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 3|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 3|#define PARAMS_EXTRACTED_BITS 2 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 3|#define PARAMS_NBAR 8 | | ------------------ ------------------ 251| 3| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 252| 3| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | ------------------ | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | ------------------ ------------------ 253| 3| clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 29| 3|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 3|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 3|#define CRYPTO_BYTES OQS_KEM_frodokem_640_shake_length_shared_secret | | | | ------------------ | | | | | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 | | | | ------------------ | | ------------------ ------------------ 254| 3| return OQS_SUCCESS; 255| 3|} OQS_KEM_frodokem_976_aes_keypair: 19| 9|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 9| uint8_t *pk_seedA = &pk[0]; 23| 9| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 24| 9| uint8_t *sk_s = &sk[0]; 25| 9| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 26| 9| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_aes_length_public_key | | ------------------ | | | | 39| 9|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ 27| 9| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_aes_length_public_key | | ------------------ | | | | 39| 9|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 28| 9| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 9| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 9| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 31| 9| uint8_t randomness[CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 9| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 9| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 34| 9| uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 35| 9| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 9| randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 28| 9|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 39| 9| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 9| shake_input_seedSE[0] = 0x5F; 43| 9| memcpy(&shake_input_seedSE[1], randomness_seedSE, BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 44| 9| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 45| 140k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 140k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 140k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 140k, False: 9] ------------------ 46| 140k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 140k| #define LE_TO_UINT16(n) (n) ------------------ 47| 140k| } 48| 9| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_976_aes_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 49| 9| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_976_aes_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 50| 9| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 46| 9|#define frodo_mul_add_as_plus_e oqs_kem_frodokem_976_aes_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 9| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 9|#define frodo_pack oqs_kem_frodokem_976_aes_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_aes_length_public_key | | ------------------ | | | | 39| 9|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 9| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 57| 9| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_aes_length_public_key | | ------------------ | | | | 39| 9|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ 58| 70.2k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 70.2k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 70.2k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 70.2k, False: 9] ------------------ 59| 70.2k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 70.2k| #define UINT16_TO_LE(n) (n) ------------------ 60| 70.2k| } 61| 9| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 9| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_aes_length_public_key | | ------------------ | | | | 39| 9|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 9| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 68| 9| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 69| 9| clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 70| 9| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 71| 9| return OQS_SUCCESS; 72| 9|} OQS_KEM_frodokem_976_aes_encaps: 86| 9|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 9| const uint8_t *pk_seedA = &pk[0]; 91| 9| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 92| 9| uint8_t *ct_c1 = &ct[0]; 93| 9| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 94| 9| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 9| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 9| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 9| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 9| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 9| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 100| 9| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 101| 9| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via mu 102| 9| uint8_t *pkh = &G2in[0]; 103| 9| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 104| 9| uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ 105| 9| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 106| 9| uint8_t *seedSE = &G2out[0]; // contains secret data 107| 9| uint8_t *k = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 108| 9| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 109| 9| uint8_t *Fin_ct = &Fin[0]; 110| 9| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_aes_length_ciphertext | | ------------------ | | | | 41| 9|#define OQS_KEM_frodokem_976_aes_length_ciphertext 15792 | | ------------------ ------------------ 111| 9| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 112| | 113| | // pkh <- G_1(pk), generate random mu and salt, compute (seedSE || k) = G_2(pkh || mu || salt) 114| 9| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_aes_length_public_key | | ------------------ | | | | 39| 9|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ 115| 9| randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 28| 9|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 116| 9| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 117| | 118| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 119| 9| shake_input_seedSE[0] = 0x96; 120| 9| memcpy(&shake_input_seedSE[1], seedSE, BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 121| 9| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 122| 141k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 141k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 141k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 141k|#define PARAMS_NBAR 8 ------------------ | Branch (122:24): [True: 141k, False: 9] ------------------ 123| 141k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 141k| #define LE_TO_UINT16(n) (n) ------------------ 124| 141k| } 125| 9| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_976_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 126| 9| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_976_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 127| 9| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 49| 9|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_976_aes_mul_add_sa_plus_e ------------------ 128| 9| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 9|#define frodo_pack oqs_kem_frodokem_976_aes_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 129| | 130| | // Generate Epp, and compute V = Sp*B + Epp 131| 9| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_976_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 132| 9| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 9|#define frodo_unpack oqs_kem_frodokem_976_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_aes_length_public_key | | ------------------ | | | | 39| 9|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 133| 9| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 52| 9|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_976_aes_mul_add_sb_plus_e ------------------ 134| | 135| | // Encode mu, and compute C = V + enc(mu) (mod q) 136| 9| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 57| 9|#define frodo_key_encode oqs_kem_frodokem_976_aes_key_encode ------------------ 137| 9| frodo_add(C, V, C); ------------------ | | 55| 9|#define frodo_add oqs_kem_frodokem_976_aes_add ------------------ 138| 9| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 9|#define frodo_pack oqs_kem_frodokem_976_aes_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 139| | 140| | // Append salt to ct and compute ss = F(ct_c1||ct_c2||salt||k) 141| 9| memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_aes_length_ciphertext | | ------------------ | | | | 41| 9|#define OQS_KEM_frodokem_976_aes_length_ciphertext 15792 | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 142| 9| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_aes_length_ciphertext | | ------------------ | | | | 41| 9|#define OQS_KEM_frodokem_976_aes_length_ciphertext 15792 | | ------------------ ------------------ 143| 9| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 144| 9| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_aes_length_ciphertext | | ------------------ | | | | 41| 9|#define OQS_KEM_frodokem_976_aes_length_ciphertext 15792 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 145| | 146| | // Cleanup: 147| 9| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 148| 9| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 149| 9| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 150| 9| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 151| 9| clear_bytes(mu, BYTES_MU); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ 152| 9| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 153| 9| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 154| 9| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 155| 9| return OQS_SUCCESS; 156| 9|} OQS_KEM_frodokem_976_aes_decaps: 160| 9|{ // FrodoKEM's key decapsulation 161| | // Inputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 162| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 163| | // Output: shared key ss (CRYPTO_BYTES bytes) 164| 9| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 165| 9| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 166| 9| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 167| 9| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 168| 9| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 169| 9| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 170| 9| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 171| 9| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 172| 9| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 173| 9| const uint8_t *ct_c1 = &ct[0]; 174| 9| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 175| 9| const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_aes_length_ciphertext | | ------------------ | | | | 41| 9|#define OQS_KEM_frodokem_976_aes_length_ciphertext 15792 | | ------------------ ------------------ const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 176| 9| const uint8_t *sk_s = &sk[0]; 177| 9| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 178| 9| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_aes_length_public_key | | ------------------ | | | | 39| 9|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ 179| 9| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 180| 9| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_aes_length_public_key | | ------------------ | | | | 39| 9|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 181| 9| const uint8_t *pk_seedA = &sk_pk[0]; 182| 9| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 183| 9| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via muprime 184| 9| uint8_t *pkh = &G2in[0]; 185| 9| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 186| 9| uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ 187| 9| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 188| 9| uint8_t *seedSEprime = &G2out[0]; // contains secret data 189| 9| uint8_t *kprime = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 190| 9| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 191| 9| uint8_t *Fin_ct = &Fin[0]; 192| 9| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_aes_length_ciphertext | | ------------------ | | | | 41| 9|#define OQS_KEM_frodokem_976_aes_length_ciphertext 15792 | | ------------------ ------------------ 193| 9| uint8_t shake_input_seedSEprime[1 + BYTES_SEED_SE]; // contains secret data 194| | 195| | 196| 70.2k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 70.2k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 70.2k|#define PARAMS_NBAR 8 ------------------ | Branch (196:24): [True: 70.2k, False: 9] ------------------ 197| 70.2k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 70.2k| #define LE_TO_UINT16(n) (n) ------------------ 198| 70.2k| } 199| | 200| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 201| 9| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 9|#define frodo_unpack oqs_kem_frodokem_976_aes_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 202| 9| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 9|#define frodo_unpack oqs_kem_frodokem_976_aes_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 203| 9| frodo_mul_bs(W, Bp, S); ------------------ | | 53| 9|#define frodo_mul_bs oqs_kem_frodokem_976_aes_mul_bs ------------------ 204| 9| frodo_sub(W, C, W); ------------------ | | 56| 9|#define frodo_sub oqs_kem_frodokem_976_aes_sub ------------------ 205| 9| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 58| 9|#define frodo_key_decode oqs_kem_frodokem_976_aes_key_decode ------------------ 206| | 207| | // Generate (seedSE' || k') = G_2(pkh || mu' || salt) 208| 9| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 209| 9| memcpy(G2in_salt, salt, BYTES_SALT); ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 210| 9| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 211| | 212| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 213| 9| shake_input_seedSEprime[0] = 0x96; 214| 9| memcpy(&shake_input_seedSEprime[1], seedSEprime, BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 215| 9| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 216| 141k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 141k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 141k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 141k|#define PARAMS_NBAR 8 ------------------ | Branch (216:24): [True: 141k, False: 9] ------------------ 217| 141k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 141k| #define LE_TO_UINT16(n) (n) ------------------ 218| 141k| } 219| 9| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_976_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 220| 9| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_976_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 221| 9| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 49| 9|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_976_aes_mul_add_sa_plus_e ------------------ 222| | 223| | // Generate Epp, and compute W = Sp*B + Epp 224| 9| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_976_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 225| 9| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 9|#define frodo_unpack oqs_kem_frodokem_976_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_aes_length_public_key | | ------------------ | | | | 39| 9|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 226| 9| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 52| 9|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_976_aes_mul_add_sb_plus_e ------------------ 227| | 228| | // Encode mu, and compute CC = W + enc(mu') (mod q) 229| 9| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 57| 9|#define frodo_key_encode oqs_kem_frodokem_976_aes_key_encode ------------------ 230| 9| frodo_add(CC, W, CC); ------------------ | | 55| 9|#define frodo_add oqs_kem_frodokem_976_aes_add ------------------ 231| | 232| | // Prepare input to F 233| 9| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_aes_length_ciphertext | | ------------------ | | | | 41| 9|#define OQS_KEM_frodokem_976_aes_length_ciphertext 15792 | | ------------------ ------------------ 234| | 235| | // Reducing BBp modulo q 236| 70.2k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 70.2k|#define PARAMS_N 976 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 70.2k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 70.2k|#define PARAMS_LOGQ 16 ------------------ | Branch (236:21): [True: 70.2k, False: 9] ------------------ 237| | 238| | // Needs to avoid branching on secret data using constant-time implementation. 239| 9| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 9|#define ct_verify oqs_kem_frodokem_976_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 9|#define ct_verify oqs_kem_frodokem_976_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 240| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 241| 9| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 43| 9|#define ct_select oqs_kem_frodokem_976_aes_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 242| 9| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_aes_length_ciphertext | | ------------------ | | | | 41| 9|#define OQS_KEM_frodokem_976_aes_length_ciphertext 15792 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 243| | 244| | // Cleanup: 245| 9| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 246| 9| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 247| 9| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 248| 9| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 249| 9| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 250| 9| clear_bytes(muprime, BYTES_MU); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ 251| 9| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 252| 9| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | ------------------ | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | ------------------ ------------------ 253| 9| clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_aes_length_shared_secret | | | | ------------------ | | | | | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 254| 9| return OQS_SUCCESS; 255| 9|} OQS_KEM_frodokem_976_shake_keypair: 19| 9|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 9| uint8_t *pk_seedA = &pk[0]; 23| 9| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 24| 9| uint8_t *sk_s = &sk[0]; 25| 9| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 26| 9| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_shake_length_public_key | | ------------------ | | | | 54| 9|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ 27| 9| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_shake_length_public_key | | ------------------ | | | | 54| 9|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 28| 9| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 9| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 9| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 31| 9| uint8_t randomness[CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 9| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 9| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 34| 9| uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 35| 9| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 9| randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 28| 9|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 39| 9| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 9| shake_input_seedSE[0] = 0x5F; 43| 9| memcpy(&shake_input_seedSE[1], randomness_seedSE, BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 44| 9| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 45| 140k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 140k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 140k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 140k, False: 9] ------------------ 46| 140k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 140k| #define LE_TO_UINT16(n) (n) ------------------ 47| 140k| } 48| 9| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_976_shake_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 49| 9| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_976_shake_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 50| 9| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 46| 9|#define frodo_mul_add_as_plus_e oqs_kem_frodokem_976_shake_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 9| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 9|#define frodo_pack oqs_kem_frodokem_976_shake_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_shake_length_public_key | | ------------------ | | | | 54| 9|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 9| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 57| 9| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_shake_length_public_key | | ------------------ | | | | 54| 9|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ 58| 70.2k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 70.2k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 70.2k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 70.2k, False: 9] ------------------ 59| 70.2k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 70.2k| #define UINT16_TO_LE(n) (n) ------------------ 60| 70.2k| } 61| 9| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 9| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_shake_length_public_key | | ------------------ | | | | 54| 9|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 9| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 68| 9| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 69| 9| clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 70| 9| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 71| 9| return OQS_SUCCESS; 72| 9|} OQS_KEM_frodokem_976_shake_encaps: 86| 9|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 9| const uint8_t *pk_seedA = &pk[0]; 91| 9| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 92| 9| uint8_t *ct_c1 = &ct[0]; 93| 9| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 94| 9| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 9| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 9| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 9| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 9| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 9| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 100| 9| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 101| 9| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via mu 102| 9| uint8_t *pkh = &G2in[0]; 103| 9| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 104| 9| uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ 105| 9| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 106| 9| uint8_t *seedSE = &G2out[0]; // contains secret data 107| 9| uint8_t *k = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 108| 9| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 109| 9| uint8_t *Fin_ct = &Fin[0]; 110| 9| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_shake_length_ciphertext | | ------------------ | | | | 56| 9|#define OQS_KEM_frodokem_976_shake_length_ciphertext 15792 | | ------------------ ------------------ 111| 9| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 112| | 113| | // pkh <- G_1(pk), generate random mu and salt, compute (seedSE || k) = G_2(pkh || mu || salt) 114| 9| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_shake_length_public_key | | ------------------ | | | | 54| 9|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ 115| 9| randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 28| 9|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 116| 9| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 117| | 118| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 119| 9| shake_input_seedSE[0] = 0x96; 120| 9| memcpy(&shake_input_seedSE[1], seedSE, BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 121| 9| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 122| 141k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 141k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 141k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 141k|#define PARAMS_NBAR 8 ------------------ | Branch (122:24): [True: 141k, False: 9] ------------------ 123| 141k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 141k| #define LE_TO_UINT16(n) (n) ------------------ 124| 141k| } 125| 9| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_976_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 126| 9| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_976_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 127| 9| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 49| 9|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_976_shake_mul_add_sa_plus_e ------------------ 128| 9| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 9|#define frodo_pack oqs_kem_frodokem_976_shake_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 129| | 130| | // Generate Epp, and compute V = Sp*B + Epp 131| 9| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_976_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 132| 9| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 9|#define frodo_unpack oqs_kem_frodokem_976_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_shake_length_public_key | | ------------------ | | | | 54| 9|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 133| 9| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 52| 9|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_976_shake_mul_add_sb_plus_e ------------------ 134| | 135| | // Encode mu, and compute C = V + enc(mu) (mod q) 136| 9| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 57| 9|#define frodo_key_encode oqs_kem_frodokem_976_shake_key_encode ------------------ 137| 9| frodo_add(C, V, C); ------------------ | | 55| 9|#define frodo_add oqs_kem_frodokem_976_shake_add ------------------ 138| 9| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 9|#define frodo_pack oqs_kem_frodokem_976_shake_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 139| | 140| | // Append salt to ct and compute ss = F(ct_c1||ct_c2||salt||k) 141| 9| memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_shake_length_ciphertext | | ------------------ | | | | 56| 9|#define OQS_KEM_frodokem_976_shake_length_ciphertext 15792 | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 142| 9| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_shake_length_ciphertext | | ------------------ | | | | 56| 9|#define OQS_KEM_frodokem_976_shake_length_ciphertext 15792 | | ------------------ ------------------ 143| 9| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 144| 9| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_shake_length_ciphertext | | ------------------ | | | | 56| 9|#define OQS_KEM_frodokem_976_shake_length_ciphertext 15792 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 145| | 146| | // Cleanup: 147| 9| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 148| 9| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 149| 9| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 150| 9| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 151| 9| clear_bytes(mu, BYTES_MU); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ 152| 9| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 153| 9| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 154| 9| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 155| 9| return OQS_SUCCESS; 156| 9|} OQS_KEM_frodokem_976_shake_decaps: 160| 9|{ // FrodoKEM's key decapsulation 161| | // Inputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 162| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 163| | // Output: shared key ss (CRYPTO_BYTES bytes) 164| 9| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 165| 9| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 166| 9| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 167| 9| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 168| 9| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 169| 9| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 170| 9| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 171| 9| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 172| 9| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 173| 9| const uint8_t *ct_c1 = &ct[0]; 174| 9| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 175| 9| const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_shake_length_ciphertext | | ------------------ | | | | 56| 9|#define OQS_KEM_frodokem_976_shake_length_ciphertext 15792 | | ------------------ ------------------ const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 176| 9| const uint8_t *sk_s = &sk[0]; 177| 9| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 178| 9| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_shake_length_public_key | | ------------------ | | | | 54| 9|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ 179| 9| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 180| 9| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_shake_length_public_key | | ------------------ | | | | 54| 9|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 181| 9| const uint8_t *pk_seedA = &sk_pk[0]; 182| 9| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 183| 9| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via muprime 184| 9| uint8_t *pkh = &G2in[0]; 185| 9| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 186| 9| uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ 187| 9| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 188| 9| uint8_t *seedSEprime = &G2out[0]; // contains secret data 189| 9| uint8_t *kprime = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 190| 9| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 191| 9| uint8_t *Fin_ct = &Fin[0]; 192| 9| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_shake_length_ciphertext | | ------------------ | | | | 56| 9|#define OQS_KEM_frodokem_976_shake_length_ciphertext 15792 | | ------------------ ------------------ 193| 9| uint8_t shake_input_seedSEprime[1 + BYTES_SEED_SE]; // contains secret data 194| | 195| | 196| 70.2k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 70.2k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 70.2k|#define PARAMS_NBAR 8 ------------------ | Branch (196:24): [True: 70.2k, False: 9] ------------------ 197| 70.2k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 70.2k| #define LE_TO_UINT16(n) (n) ------------------ 198| 70.2k| } 199| | 200| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 201| 9| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 9|#define frodo_unpack oqs_kem_frodokem_976_shake_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 202| 9| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 9|#define frodo_unpack oqs_kem_frodokem_976_shake_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 203| 9| frodo_mul_bs(W, Bp, S); ------------------ | | 53| 9|#define frodo_mul_bs oqs_kem_frodokem_976_shake_mul_bs ------------------ 204| 9| frodo_sub(W, C, W); ------------------ | | 56| 9|#define frodo_sub oqs_kem_frodokem_976_shake_sub ------------------ 205| 9| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 58| 9|#define frodo_key_decode oqs_kem_frodokem_976_shake_key_decode ------------------ 206| | 207| | // Generate (seedSE' || k') = G_2(pkh || mu' || salt) 208| 9| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 209| 9| memcpy(G2in_salt, salt, BYTES_SALT); ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 210| 9| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 9|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 9|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 211| | 212| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 213| 9| shake_input_seedSEprime[0] = 0x96; 214| 9| memcpy(&shake_input_seedSEprime[1], seedSEprime, BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 215| 9| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 216| 141k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 141k|#define PARAMS_N 976 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 141k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 141k|#define PARAMS_NBAR 8 ------------------ | Branch (216:24): [True: 141k, False: 9] ------------------ 217| 141k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 141k| #define LE_TO_UINT16(n) (n) ------------------ 218| 141k| } 219| 9| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_976_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 220| 9| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_976_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 221| 9| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 49| 9|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_976_shake_mul_add_sa_plus_e ------------------ 222| | 223| | // Generate Epp, and compute W = Sp*B + Epp 224| 9| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 9|#define frodo_sample_n oqs_kem_frodokem_976_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 225| 9| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 9|#define frodo_unpack oqs_kem_frodokem_976_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 9|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_976_shake_length_public_key | | ------------------ | | | | 54| 9|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 226| 9| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 52| 9|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_976_shake_mul_add_sb_plus_e ------------------ 227| | 228| | // Encode mu, and compute CC = W + enc(mu') (mod q) 229| 9| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 57| 9|#define frodo_key_encode oqs_kem_frodokem_976_shake_key_encode ------------------ 230| 9| frodo_add(CC, W, CC); ------------------ | | 55| 9|#define frodo_add oqs_kem_frodokem_976_shake_add ------------------ 231| | 232| | // Prepare input to F 233| 9| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_shake_length_ciphertext | | ------------------ | | | | 56| 9|#define OQS_KEM_frodokem_976_shake_length_ciphertext 15792 | | ------------------ ------------------ 234| | 235| | // Reducing BBp modulo q 236| 70.2k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 70.2k|#define PARAMS_N 976 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 70.2k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 70.2k|#define PARAMS_LOGQ 16 ------------------ | Branch (236:21): [True: 70.2k, False: 9] ------------------ 237| | 238| | // Needs to avoid branching on secret data using constant-time implementation. 239| 9| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 9|#define ct_verify oqs_kem_frodokem_976_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 9|#define ct_verify oqs_kem_frodokem_976_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 240| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 241| 9| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 43| 9|#define ct_select oqs_kem_frodokem_976_shake_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 242| 9| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 9|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 9|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_976_shake_length_ciphertext | | ------------------ | | | | 56| 9|#define OQS_KEM_frodokem_976_shake_length_ciphertext 15792 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 243| | 244| | // Cleanup: 245| 9| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 246| 9| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 247| 9| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 248| 9| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 9|#define PARAMS_N 976 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 249| 9| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 250| 9| clear_bytes(muprime, BYTES_MU); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 9|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 9|#define PARAMS_EXTRACTED_BITS 3 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 9|#define PARAMS_NBAR 8 | | ------------------ ------------------ 251| 9| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 252| 9| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | ------------------ | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | ------------------ ------------------ 253| 9| clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 29| 9|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 9|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 9|#define CRYPTO_BYTES OQS_KEM_frodokem_976_shake_length_shared_secret | | | | ------------------ | | | | | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 | | | | ------------------ | | ------------------ ------------------ 254| 9| return OQS_SUCCESS; 255| 9|} OQS_KEM_frodokem_1344_aes_keypair: 19| 7|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 7| uint8_t *pk_seedA = &pk[0]; 23| 7| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 7|#define BYTES_SEED_A 16 ------------------ 24| 7| uint8_t *sk_s = &sk[0]; 25| 7| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 26| 7| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 7|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_aes_length_public_key | | ------------------ | | | | 69| 7|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ 27| 7| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 7|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_aes_length_public_key | | ------------------ | | | | 69| 7|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 28| 7| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 7| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 7| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 31| 7| uint8_t randomness[CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 7| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 7| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 34| 7| uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 21| 7|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 35| 7| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 7| randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 28| 7|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 21| 7|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 18| 7|#define BYTES_SEED_A 16 ------------------ 39| 7| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 31| 7|#define shake OQS_SHA3_shake256 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 7|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 7|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 7| shake_input_seedSE[0] = 0x5F; 43| 7| memcpy(&shake_input_seedSE[1], randomness_seedSE, BYTES_SEED_SE); ------------------ | | 21| 7|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 44| 7| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 7|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 7|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 45| 150k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 150k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 150k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 150k, False: 7] ------------------ 46| 150k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 150k| #define LE_TO_UINT16(n) (n) ------------------ 47| 150k| } 48| 7| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 7|#define frodo_sample_n oqs_kem_frodokem_1344_aes_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 49| 7| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 7|#define frodo_sample_n oqs_kem_frodokem_1344_aes_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 50| 7| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 46| 7|#define frodo_mul_add_as_plus_e oqs_kem_frodokem_1344_aes_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 7| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 7|#define frodo_pack oqs_kem_frodokem_1344_aes_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 7|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_aes_length_public_key | | ------------------ | | | | 69| 7|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 7|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 7|#define PARAMS_LOGQ 16 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 7| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 57| 7| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 7|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_aes_length_public_key | | ------------------ | | | | 69| 7|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ 58| 75.2k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 75.2k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 75.2k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 75.2k, False: 7] ------------------ 59| 75.2k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 75.2k| #define UINT16_TO_LE(n) (n) ------------------ 60| 75.2k| } 61| 7| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 7| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 7|#define shake OQS_SHA3_shake256 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 7|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 7|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_aes_length_public_key | | ------------------ | | | | 69| 7|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 7| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 68| 7| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 69| 7| clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 29| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 21| 7|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 70| 7| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 7|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 71| 7| return OQS_SUCCESS; 72| 7|} OQS_KEM_frodokem_1344_aes_encaps: 86| 7|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 7| const uint8_t *pk_seedA = &pk[0]; 91| 7| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 7|#define BYTES_SEED_A 16 ------------------ 92| 7| uint8_t *ct_c1 = &ct[0]; 93| 7| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 7|#define PARAMS_LOGQ 16 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 94| 7| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 7| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 7| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 7| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 7| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 7| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 100| 7| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 101| 7| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via mu 102| 7| uint8_t *pkh = &G2in[0]; 103| 7| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 7|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 104| 7| uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 7|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 7|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 7|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 7|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 7|#define PARAMS_NBAR 8 | | ------------------ ------------------ 105| 7| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 106| 7| uint8_t *seedSE = &G2out[0]; // contains secret data 107| 7| uint8_t *k = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 7|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 108| 7| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 109| 7| uint8_t *Fin_ct = &Fin[0]; 110| 7| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 7|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_aes_length_ciphertext | | ------------------ | | | | 71| 7|#define OQS_KEM_frodokem_1344_aes_length_ciphertext 21696 | | ------------------ ------------------ 111| 7| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 112| | 113| | // pkh <- G_1(pk), generate random mu and salt, compute (seedSE || k) = G_2(pkh || mu || salt) 114| 7| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 7|#define shake OQS_SHA3_shake256 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 7|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 7|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_aes_length_public_key | | ------------------ | | | | 69| 7|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ 115| 7| randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 28| 7|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 19| 7|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 7|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 7|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 7|#define PARAMS_NBAR 8 | | ------------------ ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 20| 7|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 116| 7| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 7|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 7|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 7|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 7|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 7|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 7|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 7|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 7|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 117| | 118| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 119| 7| shake_input_seedSE[0] = 0x96; 120| 7| memcpy(&shake_input_seedSE[1], seedSE, BYTES_SEED_SE); ------------------ | | 21| 7|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 121| 7| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 7|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 7|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 122| 150k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 150k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 150k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 150k|#define PARAMS_NBAR 8 ------------------ | Branch (122:24): [True: 150k, False: 7] ------------------ 123| 150k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 150k| #define LE_TO_UINT16(n) (n) ------------------ 124| 150k| } 125| 7| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 7|#define frodo_sample_n oqs_kem_frodokem_1344_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 126| 7| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 7|#define frodo_sample_n oqs_kem_frodokem_1344_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 127| 7| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 49| 7|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_1344_aes_mul_add_sa_plus_e ------------------ 128| 7| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 7|#define frodo_pack oqs_kem_frodokem_1344_aes_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 7|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 7|#define PARAMS_LOGQ 16 ------------------ 129| | 130| | // Generate Epp, and compute V = Sp*B + Epp 131| 7| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 7|#define frodo_sample_n oqs_kem_frodokem_1344_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 132| 7| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 7|#define frodo_unpack oqs_kem_frodokem_1344_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 7|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_aes_length_public_key | | ------------------ | | | | 69| 7|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 7|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 7|#define PARAMS_LOGQ 16 ------------------ 133| 7| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 52| 7|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_1344_aes_mul_add_sb_plus_e ------------------ 134| | 135| | // Encode mu, and compute C = V + enc(mu) (mod q) 136| 7| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 57| 7|#define frodo_key_encode oqs_kem_frodokem_1344_aes_key_encode ------------------ 137| 7| frodo_add(C, V, C); ------------------ | | 55| 7|#define frodo_add oqs_kem_frodokem_1344_aes_add ------------------ 138| 7| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 7|#define frodo_pack oqs_kem_frodokem_1344_aes_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 7|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 7|#define PARAMS_LOGQ 16 ------------------ 139| | 140| | // Append salt to ct and compute ss = F(ct_c1||ct_c2||salt||k) 141| 7| memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 5| 7|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_aes_length_ciphertext | | ------------------ | | | | 71| 7|#define OQS_KEM_frodokem_1344_aes_length_ciphertext 21696 | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 7|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 7|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 142| 7| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 7|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_aes_length_ciphertext | | ------------------ | | | | 71| 7|#define OQS_KEM_frodokem_1344_aes_length_ciphertext 21696 | | ------------------ ------------------ 143| 7| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 144| 7| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 7|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 7|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_aes_length_ciphertext | | ------------------ | | | | 71| 7|#define OQS_KEM_frodokem_1344_aes_length_ciphertext 21696 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 145| | 146| | // Cleanup: 147| 7| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 148| 7| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 149| 7| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 150| 7| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 151| 7| clear_bytes(mu, BYTES_MU); ------------------ | | 29| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 7|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 7|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 7|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 7|#define PARAMS_NBAR 8 | | ------------------ ------------------ 152| 7| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 7|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 153| 7| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 154| 7| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 7|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 155| 7| return OQS_SUCCESS; 156| 7|} OQS_KEM_frodokem_1344_aes_decaps: 160| 7|{ // FrodoKEM's key decapsulation 161| | // Inputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 162| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 163| | // Output: shared key ss (CRYPTO_BYTES bytes) 164| 7| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 165| 7| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 166| 7| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 167| 7| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 168| 7| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 169| 7| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 170| 7| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 171| 7| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 172| 7| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 173| 7| const uint8_t *ct_c1 = &ct[0]; 174| 7| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 7|#define PARAMS_LOGQ 16 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 175| 7| const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 5| 7|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_aes_length_ciphertext | | ------------------ | | | | 71| 7|#define OQS_KEM_frodokem_1344_aes_length_ciphertext 21696 | | ------------------ ------------------ const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 20| 7|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 176| 7| const uint8_t *sk_s = &sk[0]; 177| 7| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 178| 7| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 7|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_aes_length_public_key | | ------------------ | | | | 69| 7|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ 179| 7| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 180| 7| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 7|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_aes_length_public_key | | ------------------ | | | | 69| 7|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 181| 7| const uint8_t *pk_seedA = &sk_pk[0]; 182| 7| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 7|#define BYTES_SEED_A 16 ------------------ 183| 7| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via muprime 184| 7| uint8_t *pkh = &G2in[0]; 185| 7| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 7|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 186| 7| uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 7|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 7|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 7|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 7|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 7|#define PARAMS_NBAR 8 | | ------------------ ------------------ 187| 7| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 188| 7| uint8_t *seedSEprime = &G2out[0]; // contains secret data 189| 7| uint8_t *kprime = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 7|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 190| 7| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 191| 7| uint8_t *Fin_ct = &Fin[0]; 192| 7| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 7|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_aes_length_ciphertext | | ------------------ | | | | 71| 7|#define OQS_KEM_frodokem_1344_aes_length_ciphertext 21696 | | ------------------ ------------------ 193| 7| uint8_t shake_input_seedSEprime[1 + BYTES_SEED_SE]; // contains secret data 194| | 195| | 196| 75.2k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 75.2k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 75.2k|#define PARAMS_NBAR 8 ------------------ | Branch (196:24): [True: 75.2k, False: 7] ------------------ 197| 75.2k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 75.2k| #define LE_TO_UINT16(n) (n) ------------------ 198| 75.2k| } 199| | 200| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 201| 7| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 7|#define frodo_unpack oqs_kem_frodokem_1344_aes_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 7|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 7|#define PARAMS_LOGQ 16 ------------------ 202| 7| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 7|#define frodo_unpack oqs_kem_frodokem_1344_aes_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 7|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 7|#define PARAMS_LOGQ 16 ------------------ 203| 7| frodo_mul_bs(W, Bp, S); ------------------ | | 53| 7|#define frodo_mul_bs oqs_kem_frodokem_1344_aes_mul_bs ------------------ 204| 7| frodo_sub(W, C, W); ------------------ | | 56| 7|#define frodo_sub oqs_kem_frodokem_1344_aes_sub ------------------ 205| 7| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 58| 7|#define frodo_key_decode oqs_kem_frodokem_1344_aes_key_decode ------------------ 206| | 207| | // Generate (seedSE' || k') = G_2(pkh || mu' || salt) 208| 7| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 22| 7|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 209| 7| memcpy(G2in_salt, salt, BYTES_SALT); ------------------ | | 20| 7|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 210| 7| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 7|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 7|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 7|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 7|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 7|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 7|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 7|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 7|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 211| | 212| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 213| 7| shake_input_seedSEprime[0] = 0x96; 214| 7| memcpy(&shake_input_seedSEprime[1], seedSEprime, BYTES_SEED_SE); ------------------ | | 21| 7|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 215| 7| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 31| 7|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 7|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 216| 150k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 150k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 150k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 150k|#define PARAMS_NBAR 8 ------------------ | Branch (216:24): [True: 150k, False: 7] ------------------ 217| 150k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 150k| #define LE_TO_UINT16(n) (n) ------------------ 218| 150k| } 219| 7| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 7|#define frodo_sample_n oqs_kem_frodokem_1344_aes_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 220| 7| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 7|#define frodo_sample_n oqs_kem_frodokem_1344_aes_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 221| 7| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 49| 7|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_1344_aes_mul_add_sa_plus_e ------------------ 222| | 223| | // Generate Epp, and compute W = Sp*B + Epp 224| 7| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 7|#define frodo_sample_n oqs_kem_frodokem_1344_aes_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 225| 7| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 7|#define frodo_unpack oqs_kem_frodokem_1344_aes_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 7|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_aes_length_public_key | | ------------------ | | | | 69| 7|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 7|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 7|#define PARAMS_LOGQ 16 ------------------ 226| 7| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 52| 7|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_1344_aes_mul_add_sb_plus_e ------------------ 227| | 228| | // Encode mu, and compute CC = W + enc(mu') (mod q) 229| 7| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 57| 7|#define frodo_key_encode oqs_kem_frodokem_1344_aes_key_encode ------------------ 230| 7| frodo_add(CC, W, CC); ------------------ | | 55| 7|#define frodo_add oqs_kem_frodokem_1344_aes_add ------------------ 231| | 232| | // Prepare input to F 233| 7| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 7|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_aes_length_ciphertext | | ------------------ | | | | 71| 7|#define OQS_KEM_frodokem_1344_aes_length_ciphertext 21696 | | ------------------ ------------------ 234| | 235| | // Reducing BBp modulo q 236| 75.2k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 75.2k|#define PARAMS_N 1344 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 75.2k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 75.2k|#define PARAMS_LOGQ 16 ------------------ | Branch (236:21): [True: 75.2k, False: 7] ------------------ 237| | 238| | // Needs to avoid branching on secret data using constant-time implementation. 239| 7| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 7|#define ct_verify oqs_kem_frodokem_1344_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 7|#define ct_verify oqs_kem_frodokem_1344_aes_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 240| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 241| 7| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 43| 7|#define ct_select oqs_kem_frodokem_1344_aes_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 242| 7| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 7|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 7|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_aes_length_ciphertext | | ------------------ | | | | 71| 7|#define OQS_KEM_frodokem_1344_aes_length_ciphertext 21696 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 243| | 244| | // Cleanup: 245| 7| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 246| 7| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 247| 7| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 248| 7| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 7|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 249| 7| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 250| 7| clear_bytes(muprime, BYTES_MU); ------------------ | | 29| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 7|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 7|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 7|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 7|#define PARAMS_NBAR 8 | | ------------------ ------------------ 251| 7| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 7|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 252| 7| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | ------------------ | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | ------------------ ------------------ 253| 7| clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 29| 7|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 7|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 7|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_aes_length_shared_secret | | | | ------------------ | | | | | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 254| 7| return OQS_SUCCESS; 255| 7|} OQS_KEM_frodokem_1344_shake_keypair: 19| 6|{ // FrodoKEM's key generation 20| | // Outputs: public key pk = pk_seedA||pk_b ( BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 21| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 22| 6| uint8_t *pk_seedA = &pk[0]; 23| 6| uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ 24| 6| uint8_t *sk_s = &sk[0]; 25| 6| uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 26| 6| uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ uint8_t *sk_S = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 6|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_shake_length_public_key | | ------------------ | | | | 84| 6|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ 27| 6| uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 6|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_shake_length_public_key | | ------------------ | | | | 84| 6|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 28| 6| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 29| 6| uint16_t S[2*PARAMS_N*PARAMS_NBAR] = {0}; // contains secret data 30| 6| uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ uint16_t *E = (uint16_t *)&S[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 31| 6| uint8_t randomness[CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A]; // contains secret data via randomness_s and randomness_seedSE 32| 6| uint8_t *randomness_s = &randomness[0]; // contains secret data 33| 6| uint8_t *randomness_seedSE = &randomness[CRYPTO_BYTES]; // contains secret data ------------------ | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 34| 6| uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ uint8_t *randomness_z = &randomness[CRYPTO_BYTES + BYTES_SEED_SE]; ------------------ | | 21| 6|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 35| 6| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 36| | 37| | // Generate the secret value s, the seed for S and E, and the seed for the seed for A. Add seed_A to the public key 38| 6| randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 28| 6|#define randombytes OQS_randombytes ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 21| 6|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ randombytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE + BYTES_SEED_A); ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ 39| 6| shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 31| 6|#define shake OQS_SHA3_shake256 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ shake(pk_seedA, BYTES_SEED_A, randomness_z, BYTES_SEED_A); ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ 40| | 41| | // Generate S and E, and compute B = A*S + E. Generate A on-the-fly 42| 6| shake_input_seedSE[0] = 0x5F; 43| 6| memcpy(&shake_input_seedSE[1], randomness_seedSE, BYTES_SEED_SE); ------------------ | | 21| 6|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 44| 6| shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 6|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)S, 2*PARAMS_N*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 6|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 45| 129k| for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 129k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < 2 * PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 129k|#define PARAMS_NBAR 8 ------------------ | Branch (45:24): [True: 129k, False: 6] ------------------ 46| 129k| S[i] = LE_TO_UINT16(S[i]); ------------------ | | 34| 129k| #define LE_TO_UINT16(n) (n) ------------------ 47| 129k| } 48| 6| frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 6|#define frodo_sample_n oqs_kem_frodokem_1344_shake_sample_n ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ frodo_sample_n(S, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 49| 6| frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 6|#define frodo_sample_n oqs_kem_frodokem_1344_shake_sample_n ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ frodo_sample_n(E, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 50| 6| frodo_mul_add_as_plus_e(B, S, E, pk); ------------------ | | 46| 6|#define frodo_mul_add_as_plus_e oqs_kem_frodokem_1344_shake_mul_add_as_plus_e ------------------ 51| | 52| | // Encode the second part of the public key 53| 6| frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 6|#define frodo_pack oqs_kem_frodokem_1344_shake_pack ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 3| 6|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_shake_length_public_key | | ------------------ | | | | 84| 6|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ frodo_pack(pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, B, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 6|#define PARAMS_LOGQ 16 ------------------ 54| | 55| | // Add s, pk and S to the secret key 56| 6| memcpy(sk_s, randomness_s, CRYPTO_BYTES); ------------------ | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 57| 6| memcpy(sk_pk, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 6|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_shake_length_public_key | | ------------------ | | | | 84| 6|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ 58| 64.5k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 64.5k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 64.5k|#define PARAMS_NBAR 8 ------------------ | Branch (58:24): [True: 64.5k, False: 6] ------------------ 59| 64.5k| S[i] = UINT16_TO_LE(S[i]); ------------------ | | 35| 64.5k| #define UINT16_TO_LE(n) (n) ------------------ 60| 64.5k| } 61| 6| memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ memcpy(sk_S, S, 2*PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 62| | 63| | // Add H(pk) to the secret key 64| 6| shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 6|#define shake OQS_SHA3_shake256 ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 6|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(sk_pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 6|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_shake_length_public_key | | ------------------ | | | | 84| 6|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ 65| | 66| | // Cleanup: 67| 6| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 6|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 68| 6| clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 6|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)E, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 69| 6| clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 29| 6|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ clear_bytes(randomness, CRYPTO_BYTES + BYTES_SEED_SE); ------------------ | | 21| 6|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 70| 6| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 6|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 6|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 71| 6| return OQS_SUCCESS; 72| 6|} OQS_KEM_frodokem_1344_shake_encaps: 86| 6|{ // FrodoKEM's key encapsulation 87| | // Input: public key pk = pk_seedA||pk_b (BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 bytes) 88| | // Outputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 89| | // shared key ss (CRYPTO_BYTES bytes) 90| 6| const uint8_t *pk_seedA = &pk[0]; 91| 6| const uint8_t *pk_b = &pk[BYTES_SEED_A]; ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ 92| 6| uint8_t *ct_c1 = &ct[0]; 93| 6| uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 6|#define PARAMS_LOGQ 16 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 94| 6| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 95| 6| uint16_t V[PARAMS_NBAR*PARAMS_NBAR]= {0}; // contains secret data 96| 6| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 97| 6| ALIGN_HEADER(32) uint16_t Bp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 98| 6| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 99| 6| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 100| 6| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 101| 6| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via mu 102| 6| uint8_t *pkh = &G2in[0]; 103| 6| uint8_t *mu = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 6|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 104| 6| uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 6|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ uint8_t *salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 6|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 6|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 6|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 6|#define PARAMS_NBAR 8 | | ------------------ ------------------ 105| 6| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 106| 6| uint8_t *seedSE = &G2out[0]; // contains secret data 107| 6| uint8_t *k = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 6|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 108| 6| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 109| 6| uint8_t *Fin_ct = &Fin[0]; 110| 6| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 6|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_shake_length_ciphertext | | ------------------ | | | | 86| 6|#define OQS_KEM_frodokem_1344_shake_length_ciphertext 21696 | | ------------------ ------------------ 111| 6| uint8_t shake_input_seedSE[1 + BYTES_SEED_SE]; // contains secret data 112| | 113| | // pkh <- G_1(pk), generate random mu and salt, compute (seedSE || k) = G_2(pkh || mu || salt) 114| 6| shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 31| 6|#define shake OQS_SHA3_shake256 ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 22| 6|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(pkh, BYTES_PKHASH, pk, CRYPTO_PUBLICKEYBYTES); ------------------ | | 3| 6|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_shake_length_public_key | | ------------------ | | | | 84| 6|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ 115| 6| randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 28| 6|#define randombytes OQS_randombytes ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 19| 6|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 6|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 6|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 6|#define PARAMS_NBAR 8 | | ------------------ ------------------ randombytes(mu, BYTES_MU + BYTES_SALT); ------------------ | | 20| 6|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 116| 6| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 6|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 6|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 6|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 6|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 6|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 6|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 6|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 6|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 117| | 118| | // Generate Sp and Ep, and compute Bp = Sp*A + Ep. Generate A on-the-fly 119| 6| shake_input_seedSE[0] = 0x96; 120| 6| memcpy(&shake_input_seedSE[1], seedSE, BYTES_SEED_SE); ------------------ | | 21| 6|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 121| 6| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 31| 6|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 6|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 122| 129k| for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 11| 129k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 129k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2 * PARAMS_N + PARAMS_NBAR) * PARAMS_NBAR; i++) { ------------------ | | 12| 129k|#define PARAMS_NBAR 8 ------------------ | Branch (122:24): [True: 129k, False: 6] ------------------ 123| 129k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 129k| #define LE_TO_UINT16(n) (n) ------------------ 124| 129k| } 125| 6| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 6|#define frodo_sample_n oqs_kem_frodokem_1344_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 126| 6| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 6|#define frodo_sample_n oqs_kem_frodokem_1344_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 127| 6| frodo_mul_add_sa_plus_e(Bp, Sp, Ep, pk_seedA); ------------------ | | 49| 6|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_1344_shake_mul_add_sa_plus_e ------------------ 128| 6| frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 6|#define frodo_pack oqs_kem_frodokem_1344_shake_pack ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 6|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, Bp, PARAMS_N*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 6|#define PARAMS_LOGQ 16 ------------------ 129| | 130| | // Generate Epp, and compute V = Sp*B + Epp 131| 6| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 6|#define frodo_sample_n oqs_kem_frodokem_1344_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 132| 6| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 6|#define frodo_unpack oqs_kem_frodokem_1344_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 6|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_shake_length_public_key | | ------------------ | | | | 84| 6|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 6|#define PARAMS_LOGQ 16 ------------------ 133| 6| frodo_mul_add_sb_plus_e(V, B, Sp, Epp); ------------------ | | 52| 6|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_1344_shake_mul_add_sb_plus_e ------------------ 134| | 135| | // Encode mu, and compute C = V + enc(mu) (mod q) 136| 6| frodo_key_encode(C, (uint16_t*)mu); ------------------ | | 57| 6|#define frodo_key_encode oqs_kem_frodokem_1344_shake_key_encode ------------------ 137| 6| frodo_add(C, V, C); ------------------ | | 55| 6|#define frodo_add oqs_kem_frodokem_1344_shake_add ------------------ 138| 6| frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 41| 6|#define frodo_pack oqs_kem_frodokem_1344_shake_pack ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 6|#define PARAMS_LOGQ 16 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ frodo_pack(ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, C, PARAMS_NBAR*PARAMS_NBAR, PARAMS_LOGQ); ------------------ | | 13| 6|#define PARAMS_LOGQ 16 ------------------ 139| | 140| | // Append salt to ct and compute ss = F(ct_c1||ct_c2||salt||k) 141| 6| memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 5| 6|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_shake_length_ciphertext | | ------------------ | | | | 86| 6|#define OQS_KEM_frodokem_1344_shake_length_ciphertext 21696 | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 6|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ memcpy(&ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT], salt, BYTES_SALT); ------------------ | | 20| 6|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 142| 6| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 6|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_shake_length_ciphertext | | ------------------ | | | | 86| 6|#define OQS_KEM_frodokem_1344_shake_length_ciphertext 21696 | | ------------------ ------------------ 143| 6| memcpy(Fin_k, k, CRYPTO_BYTES); ------------------ | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 144| 6| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 6|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 6|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_shake_length_ciphertext | | ------------------ | | | | 86| 6|#define OQS_KEM_frodokem_1344_shake_length_ciphertext 21696 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 145| | 146| | // Cleanup: 147| 6| clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 6|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)V, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 148| 6| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 6|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 149| 6| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 6|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 150| 6| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 6|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 151| 6| clear_bytes(mu, BYTES_MU); ------------------ | | 29| 6|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(mu, BYTES_MU); ------------------ | | 19| 6|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 6|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 6|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 6|#define PARAMS_NBAR 8 | | ------------------ ------------------ 152| 6| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 6|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 6|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 153| 6| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 6|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 154| 6| clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 29| 6|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSE, 1 + BYTES_SEED_SE); ------------------ | | 21| 6|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 155| 6| return OQS_SUCCESS; 156| 6|} OQS_KEM_frodokem_1344_shake_decaps: 160| 6|{ // FrodoKEM's key decapsulation 161| | // Inputs: ciphertext ct = ct_c1||ct_c2||salt ( (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8 + BYTES_SALT bytes) 162| | // secret key sk = sk_s||pk_seedA||pk_b||sk_S||sk_pkh (CRYPTO_BYTES + BYTES_SEED_A + (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8 + 2*PARAMS_N*PARAMS_NBAR + BYTES_PKHASH bytes) 163| | // Output: shared key ss (CRYPTO_BYTES bytes) 164| 6| uint16_t B[PARAMS_N*PARAMS_NBAR] = {0}; 165| 6| uint16_t Bp[PARAMS_N*PARAMS_NBAR] = {0}; 166| 6| uint16_t W[PARAMS_NBAR*PARAMS_NBAR] = {0}; // contains secret data 167| 6| uint16_t C[PARAMS_NBAR*PARAMS_NBAR] = {0}; 168| 6| uint16_t CC[PARAMS_NBAR*PARAMS_NBAR] = {0}; 169| 6| ALIGN_HEADER(32) uint16_t BBp[PARAMS_N*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; 170| 6| ALIGN_HEADER(32) uint16_t Sp[(2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR] ALIGN_FOOTER(32) = {0}; // contains secret data 171| 6| uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ uint16_t *Ep = (uint16_t *)&Sp[PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 172| 6| uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ uint16_t *Epp = (uint16_t *)&Sp[2*PARAMS_N*PARAMS_NBAR]; // contains secret data ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 173| 6| const uint8_t *ct_c1 = &ct[0]; 174| 6| const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 13| 6|#define PARAMS_LOGQ 16 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ const uint8_t *ct_c2 = &ct[(PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8]; ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 175| 6| const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 5| 6|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_shake_length_ciphertext | | ------------------ | | | | 86| 6|#define OQS_KEM_frodokem_1344_shake_length_ciphertext 21696 | | ------------------ ------------------ const uint8_t *salt = &ct[CRYPTO_CIPHERTEXTBYTES - BYTES_SALT]; ------------------ | | 20| 6|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 176| 6| const uint8_t *sk_s = &sk[0]; 177| 6| const uint8_t *sk_pk = &sk[CRYPTO_BYTES]; ------------------ | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 178| 6| const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ const uint16_t *sk_S = (uint16_t *) &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES]; ------------------ | | 3| 6|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_shake_length_public_key | | ------------------ | | | | 84| 6|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ 179| 6| uint16_t S[PARAMS_N * PARAMS_NBAR]; // contains secret data 180| 6| const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 3| 6|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_shake_length_public_key | | ------------------ | | | | 84| 6|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ const uint8_t *sk_pkh = &sk[CRYPTO_BYTES + CRYPTO_PUBLICKEYBYTES + 2*PARAMS_N*PARAMS_NBAR]; ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 181| 6| const uint8_t *pk_seedA = &sk_pk[0]; 182| 6| const uint8_t *pk_b = &sk_pk[BYTES_SEED_A]; ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ 183| 6| uint8_t G2in[BYTES_PKHASH + BYTES_MU + BYTES_SALT]; // contains secret data via muprime 184| 6| uint8_t *pkh = &G2in[0]; 185| 6| uint8_t *muprime = &G2in[BYTES_PKHASH]; // contains secret data ------------------ | | 22| 6|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 186| 6| uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 22| 6|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ uint8_t *G2in_salt = &G2in[BYTES_PKHASH + BYTES_MU]; ------------------ | | 19| 6|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 6|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 6|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 6|#define PARAMS_NBAR 8 | | ------------------ ------------------ 187| 6| uint8_t G2out[BYTES_SEED_SE + CRYPTO_BYTES]; // contains secret data 188| 6| uint8_t *seedSEprime = &G2out[0]; // contains secret data 189| 6| uint8_t *kprime = &G2out[BYTES_SEED_SE]; // contains secret data ------------------ | | 21| 6|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 190| 6| uint8_t Fin[CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES]; // contains secret data via Fin_k 191| 6| uint8_t *Fin_ct = &Fin[0]; 192| 6| uint8_t *Fin_k = &Fin[CRYPTO_CIPHERTEXTBYTES]; // contains secret data ------------------ | | 5| 6|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_shake_length_ciphertext | | ------------------ | | | | 86| 6|#define OQS_KEM_frodokem_1344_shake_length_ciphertext 21696 | | ------------------ ------------------ 193| 6| uint8_t shake_input_seedSEprime[1 + BYTES_SEED_SE]; // contains secret data 194| | 195| | 196| 64.5k| for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 11| 64.5k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < PARAMS_N * PARAMS_NBAR; i++) { ------------------ | | 12| 64.5k|#define PARAMS_NBAR 8 ------------------ | Branch (196:24): [True: 64.5k, False: 6] ------------------ 197| 64.5k| S[i] = LE_TO_UINT16(sk_S[i]); ------------------ | | 34| 64.5k| #define LE_TO_UINT16(n) (n) ------------------ 198| 64.5k| } 199| | 200| | // Compute W = C - Bp*S (mod q), and decode the randomness mu 201| 6| frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 6|#define frodo_unpack oqs_kem_frodokem_1344_shake_unpack ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 6|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ frodo_unpack(Bp, PARAMS_N*PARAMS_NBAR, ct_c1, (PARAMS_LOGQ*PARAMS_N*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 6|#define PARAMS_LOGQ 16 ------------------ 202| 6| frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 42| 6|#define frodo_unpack oqs_kem_frodokem_1344_shake_unpack ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 6|#define PARAMS_LOGQ 16 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ frodo_unpack(C, PARAMS_NBAR*PARAMS_NBAR, ct_c2, (PARAMS_LOGQ*PARAMS_NBAR*PARAMS_NBAR)/8, PARAMS_LOGQ); ------------------ | | 13| 6|#define PARAMS_LOGQ 16 ------------------ 203| 6| frodo_mul_bs(W, Bp, S); ------------------ | | 53| 6|#define frodo_mul_bs oqs_kem_frodokem_1344_shake_mul_bs ------------------ 204| 6| frodo_sub(W, C, W); ------------------ | | 56| 6|#define frodo_sub oqs_kem_frodokem_1344_shake_sub ------------------ 205| 6| frodo_key_decode((uint16_t*)muprime, W); ------------------ | | 58| 6|#define frodo_key_decode oqs_kem_frodokem_1344_shake_key_decode ------------------ 206| | 207| | // Generate (seedSE' || k') = G_2(pkh || mu' || salt) 208| 6| memcpy(pkh, sk_pkh, BYTES_PKHASH); ------------------ | | 22| 6|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 209| 6| memcpy(G2in_salt, salt, BYTES_SALT); ------------------ | | 20| 6|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 210| 6| shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 31| 6|#define shake OQS_SHA3_shake256 ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 21| 6|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 22| 6|#define BYTES_PKHASH CRYPTO_BYTES | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 19| 6|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 6|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 6|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 6|#define PARAMS_NBAR 8 | | ------------------ ------------------ shake(G2out, BYTES_SEED_SE + CRYPTO_BYTES, G2in, BYTES_PKHASH + BYTES_MU + BYTES_SALT); ------------------ | | 20| 6|#define BYTES_SALT (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 211| | 212| | // Generate Sp and Ep, and compute BBp = Sp*A + Ep. Generate A on-the-fly 213| 6| shake_input_seedSEprime[0] = 0x96; 214| 6| memcpy(&shake_input_seedSEprime[1], seedSEprime, BYTES_SEED_SE); ------------------ | | 21| 6|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 215| 6| shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 31| 6|#define shake OQS_SHA3_shake256 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ shake((uint8_t*)Sp, (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR*sizeof(uint16_t), shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 6|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 216| 129k| for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 11| 129k|#define PARAMS_N 1344 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 129k|#define PARAMS_NBAR 8 ------------------ for (size_t i = 0; i < (2*PARAMS_N+PARAMS_NBAR)*PARAMS_NBAR; i++) { ------------------ | | 12| 129k|#define PARAMS_NBAR 8 ------------------ | Branch (216:24): [True: 129k, False: 6] ------------------ 217| 129k| Sp[i] = LE_TO_UINT16(Sp[i]); ------------------ | | 34| 129k| #define LE_TO_UINT16(n) (n) ------------------ 218| 129k| } 219| 6| frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 6|#define frodo_sample_n oqs_kem_frodokem_1344_shake_sample_n ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ frodo_sample_n(Sp, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 220| 6| frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 40| 6|#define frodo_sample_n oqs_kem_frodokem_1344_shake_sample_n ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ frodo_sample_n(Ep, PARAMS_N*PARAMS_NBAR); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 221| 6| frodo_mul_add_sa_plus_e(BBp, Sp, Ep, pk_seedA); ------------------ | | 49| 6|#define frodo_mul_add_sa_plus_e oqs_kem_frodokem_1344_shake_mul_add_sa_plus_e ------------------ 222| | 223| | // Generate Epp, and compute W = Sp*B + Epp 224| 6| frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 40| 6|#define frodo_sample_n oqs_kem_frodokem_1344_shake_sample_n ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ frodo_sample_n(Epp, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 225| 6| frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 42| 6|#define frodo_unpack oqs_kem_frodokem_1344_shake_unpack ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 3| 6|#define CRYPTO_PUBLICKEYBYTES OQS_KEM_frodokem_1344_shake_length_public_key | | ------------------ | | | | 84| 6|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 | | ------------------ ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ frodo_unpack(B, PARAMS_N*PARAMS_NBAR, pk_b, CRYPTO_PUBLICKEYBYTES - BYTES_SEED_A, PARAMS_LOGQ); ------------------ | | 13| 6|#define PARAMS_LOGQ 16 ------------------ 226| 6| frodo_mul_add_sb_plus_e(W, B, Sp, Epp); ------------------ | | 52| 6|#define frodo_mul_add_sb_plus_e oqs_kem_frodokem_1344_shake_mul_add_sb_plus_e ------------------ 227| | 228| | // Encode mu, and compute CC = W + enc(mu') (mod q) 229| 6| frodo_key_encode(CC, (uint16_t*)muprime); ------------------ | | 57| 6|#define frodo_key_encode oqs_kem_frodokem_1344_shake_key_encode ------------------ 230| 6| frodo_add(CC, W, CC); ------------------ | | 55| 6|#define frodo_add oqs_kem_frodokem_1344_shake_add ------------------ 231| | 232| | // Prepare input to F 233| 6| memcpy(Fin_ct, ct, CRYPTO_CIPHERTEXTBYTES); ------------------ | | 5| 6|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_shake_length_ciphertext | | ------------------ | | | | 86| 6|#define OQS_KEM_frodokem_1344_shake_length_ciphertext 21696 | | ------------------ ------------------ 234| | 235| | // Reducing BBp modulo q 236| 64.5k| for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 11| 64.5k|#define PARAMS_N 1344 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 12| 64.5k|#define PARAMS_NBAR 8 ------------------ for (int i = 0; i < PARAMS_N*PARAMS_NBAR; i++) BBp[i] = BBp[i] & ((1 << PARAMS_LOGQ)-1); ------------------ | | 13| 64.5k|#define PARAMS_LOGQ 16 ------------------ | Branch (236:21): [True: 64.5k, False: 6] ------------------ 237| | 238| | // Needs to avoid branching on secret data using constant-time implementation. 239| 6| int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 6|#define ct_verify oqs_kem_frodokem_1344_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 44| 6|#define ct_verify oqs_kem_frodokem_1344_shake_ct_verify ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ int8_t selector = ct_verify(Bp, BBp, PARAMS_N*PARAMS_NBAR) | ct_verify(C, CC, PARAMS_NBAR*PARAMS_NBAR); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 240| | // If (selector == 0) then load k' to do ss = F(ct || k'), else if (selector == -1) load s to do ss = F(ct || s) 241| 6| ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 43| 6|#define ct_select oqs_kem_frodokem_1344_shake_ct_select ------------------ ct_select((uint8_t*)Fin_k, (uint8_t*)kprime, (uint8_t*)sk_s, CRYPTO_BYTES, selector); ------------------ | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 242| 6| shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 31| 6|#define shake OQS_SHA3_shake256 ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 5| 6|#define CRYPTO_CIPHERTEXTBYTES OQS_KEM_frodokem_1344_shake_length_ciphertext | | ------------------ | | | | 86| 6|#define OQS_KEM_frodokem_1344_shake_length_ciphertext 21696 | | ------------------ ------------------ shake(ss, CRYPTO_BYTES, Fin, CRYPTO_CIPHERTEXTBYTES + CRYPTO_BYTES); ------------------ | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 243| | 244| | // Cleanup: 245| 6| clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 6|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)W, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 246| 6| clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 6|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Sp, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 247| 6| clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 6|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)S, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 248| 6| clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 6|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 11| 6|#define PARAMS_N 1344 ------------------ clear_bytes((uint8_t *)Ep, PARAMS_N*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 249| 6| clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 29| 6|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ clear_bytes((uint8_t *)Epp, PARAMS_NBAR*PARAMS_NBAR*sizeof(uint16_t)); ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 250| 6| clear_bytes(muprime, BYTES_MU); ------------------ | | 29| 6|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(muprime, BYTES_MU); ------------------ | | 19| 6|#define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 15| 6|#define PARAMS_EXTRACTED_BITS 4 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 6|#define PARAMS_NBAR 8 | | ------------------ | | #define BYTES_MU (PARAMS_EXTRACTED_BITS*PARAMS_NBAR*PARAMS_NBAR)/8 | | ------------------ | | | | 12| 6|#define PARAMS_NBAR 8 | | ------------------ ------------------ 251| 6| clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 29| 6|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 21| 6|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ clear_bytes(G2out, BYTES_SEED_SE + CRYPTO_BYTES); ------------------ | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 252| 6| clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 29| 6|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(Fin_k, CRYPTO_BYTES); ------------------ | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | ------------------ | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | ------------------ ------------------ 253| 6| clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 29| 6|#define clear_bytes OQS_MEM_cleanse ------------------ clear_bytes(shake_input_seedSEprime, 1 + BYTES_SEED_SE); ------------------ | | 21| 6|#define BYTES_SEED_SE (2*CRYPTO_BYTES) | | ------------------ | | | | 6| 6|#define CRYPTO_BYTES OQS_KEM_frodokem_1344_shake_length_shared_secret | | | | ------------------ | | | | | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 | | | | ------------------ | | ------------------ ------------------ 254| 6| return OQS_SUCCESS; 255| 6|} oqs_kem_frodokem_640_aes_mul_add_sa_plus_e_avx2: 5| 4|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 6| | // Inputs: s', e' (N_BAR x N) 7| | // Output: out = s'*A + e' (N_BAR x N) 8| 4| int i, j, kk; 9| | 10| 10.2k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 10.2k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 10.2k, False: 4] ------------------ 11| 10.2k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 10.2k| } 13| | 14| 4| int k; 15| 4| uint16_t a_cols[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 16| 4| ALIGN_HEADER(32) uint16_t a_cols_t[PARAMS_N*PARAMS_STRIPE_STEP] ALIGN_FOOTER(32) = {0}; 17| 4| uint16_t a_cols_temp[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 18| 4| uint8_t *aes_key_schedule; 19| 4| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 20| | 21| 2.56k| for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 2.56k|#define PARAMS_N 640 ------------------ for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 2.56k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (21:24): [True: 2.56k, False: 4] ------------------ 22| 2.56k| a_cols_temp[j] = UINT16_TO_LE(i); // Loading values in the little-endian order ------------------ | | 35| 2.56k| #define UINT16_TO_LE(n) (n) ------------------ 23| 2.56k| } 24| | 25| 324| for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 11| 324|#define PARAMS_N 640 ------------------ for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 16| 320|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (25:18): [True: 320, False: 4] ------------------ 26| 205k| for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 11| 205k|#define PARAMS_N 640 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 205k|#define PARAMS_STRIPE_STEP 8 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 204k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (26:21): [True: 204k, False: 320] ------------------ 27| 204k| a_cols_temp[i + 1] = UINT16_TO_LE(kk); // Loading values in the little-endian order ------------------ | | 35| 204k| #define UINT16_TO_LE(n) (n) ------------------ 28| 204k| } 29| | 30| 320| OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 11| 320|#define PARAMS_N 640 ------------------ OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 16| 320|#define PARAMS_STRIPE_STEP 8 ------------------ 31| | 32| 205k| for (i = 0; i < PARAMS_N; i++) { // Transpose a_cols to have access to it in the column-major order. ------------------ | | 11| 205k|#define PARAMS_N 640 ------------------ | Branch (32:21): [True: 204k, False: 320] ------------------ 33| 1.84M| for (k = 0; k < PARAMS_STRIPE_STEP; k++) { ------------------ | | 16| 1.84M|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (33:25): [True: 1.63M, False: 204k] ------------------ 34| 1.63M| a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 34| 1.63M| #define LE_TO_UINT16(n) (n) ------------------ 35| 1.63M| } 36| 204k| } 37| | 38| 2.88k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 2.88k|#define PARAMS_NBAR 8 ------------------ | Branch (38:21): [True: 2.56k, False: 320] ------------------ 39| 7.68k| for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 16| 7.68k|#define PARAMS_STRIPE_STEP 8 ------------------ for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 17| 5.12k|#define PARAMS_PARALLEL 4 ------------------ | Branch (39:25): [True: 5.12k, False: 2.56k] ------------------ 40| 5.12k| ALIGN_HEADER(32) uint32_t sum[8 * PARAMS_PARALLEL] ALIGN_FOOTER(32); 41| 5.12k| __m256i a[PARAMS_PARALLEL], b, acc[PARAMS_PARALLEL]; 42| 5.12k| acc[0] = _mm256_setzero_si256(); 43| 5.12k| acc[1] = _mm256_setzero_si256(); 44| 5.12k| acc[2] = _mm256_setzero_si256(); 45| 5.12k| acc[3] = _mm256_setzero_si256(); 46| 209k| for (j = 0; j < PARAMS_N; j += 16) { // Matrix-vector multiplication ------------------ | | 11| 209k|#define PARAMS_N 640 ------------------ | Branch (46:29): [True: 204k, False: 5.12k] ------------------ 47| 204k| b = _mm256_load_si256((__m256i*)&s[i*PARAMS_N + j]); ------------------ | | 11| 204k|#define PARAMS_N 640 ------------------ 48| 204k| a[0] = _mm256_load_si256((__m256i*)&a_cols_t[(k+0)*PARAMS_N + j]); ------------------ | | 11| 204k|#define PARAMS_N 640 ------------------ 49| 204k| a[0] = _mm256_madd_epi16(a[0], b); 50| 204k| acc[0] = _mm256_add_epi16(a[0], acc[0]); 51| 204k| a[1] = _mm256_load_si256((__m256i*)&a_cols_t[(k+1)*PARAMS_N + j]); ------------------ | | 11| 204k|#define PARAMS_N 640 ------------------ 52| 204k| a[1] = _mm256_madd_epi16(a[1], b); 53| 204k| acc[1] = _mm256_add_epi16(a[1], acc[1]); 54| 204k| a[2] = _mm256_load_si256((__m256i*)&a_cols_t[(k+2)*PARAMS_N + j]); ------------------ | | 11| 204k|#define PARAMS_N 640 ------------------ 55| 204k| a[2] = _mm256_madd_epi16(a[2], b); 56| 204k| acc[2] = _mm256_add_epi16(a[2], acc[2]); 57| 204k| a[3] = _mm256_load_si256((__m256i*)&a_cols_t[(k+3)*PARAMS_N + j]); ------------------ | | 11| 204k|#define PARAMS_N 640 ------------------ 58| 204k| a[3] = _mm256_madd_epi16(a[3], b); 59| 204k| acc[3] = _mm256_add_epi16(a[3], acc[3]); 60| 204k| } 61| 5.12k| _mm256_store_si256((__m256i*)(sum + (8*0)), acc[0]); 62| 5.12k| out[i*PARAMS_N + kk + k + 0] += sum[8*0 + 0] + sum[8*0 + 1] + sum[8*0 + 2] + sum[8*0 + 3] + sum[8*0 + 4] + sum[8*0 + 5] + sum[8*0 + 6] + sum[8*0 + 7]; ------------------ | | 11| 5.12k|#define PARAMS_N 640 ------------------ 63| 5.12k| _mm256_store_si256((__m256i*)(sum + (8*1)), acc[1]); 64| 5.12k| out[i*PARAMS_N + kk + k + 1] += sum[8*1 + 0] + sum[8*1 + 1] + sum[8*1 + 2] + sum[8*1 + 3] + sum[8*1 + 4] + sum[8*1 + 5] + sum[8*1 + 6] + sum[8*1 + 7]; ------------------ | | 11| 5.12k|#define PARAMS_N 640 ------------------ 65| 5.12k| _mm256_store_si256((__m256i*)(sum + (8*2)), acc[2]); 66| 5.12k| out[i*PARAMS_N + kk + k + 2] += sum[8*2 + 0] + sum[8*2 + 1] + sum[8*2 + 2] + sum[8*2 + 3] + sum[8*2 + 4] + sum[8*2 + 5] + sum[8*2 + 6] + sum[8*2 + 7]; ------------------ | | 11| 5.12k|#define PARAMS_N 640 ------------------ 67| 5.12k| _mm256_store_si256((__m256i*)(sum + (8*3)), acc[3]); 68| 5.12k| out[i*PARAMS_N + kk + k + 3] += sum[8*3 + 0] + sum[8*3 + 1] + sum[8*3 + 2] + sum[8*3 + 3] + sum[8*3 + 4] + sum[8*3 + 5] + sum[8*3 + 6] + sum[8*3 + 7]; ------------------ | | 11| 5.12k|#define PARAMS_N 640 ------------------ 69| 5.12k| } 70| 2.56k| } 71| 320| } 72| 4| OQS_AES128_free_schedule(aes_key_schedule); 73| 4| return 1; 74| 4|} oqs_kem_frodokem_976_aes_mul_add_sa_plus_e_avx2: 5| 18|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 6| | // Inputs: s', e' (N_BAR x N) 7| | // Output: out = s'*A + e' (N_BAR x N) 8| 18| int i, j, kk; 9| | 10| 70.2k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 70.2k|#define PARAMS_N 976 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 70.2k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 70.2k, False: 18] ------------------ 11| 70.2k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 70.2k| } 13| | 14| 18| int k; 15| 18| uint16_t a_cols[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 16| 18| ALIGN_HEADER(32) uint16_t a_cols_t[PARAMS_N*PARAMS_STRIPE_STEP] ALIGN_FOOTER(32) = {0}; 17| 18| uint16_t a_cols_temp[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 18| 18| uint8_t *aes_key_schedule; 19| 18| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 20| | 21| 17.5k| for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 17.5k|#define PARAMS_N 976 ------------------ for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 17.5k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (21:24): [True: 17.5k, False: 18] ------------------ 22| 17.5k| a_cols_temp[j] = UINT16_TO_LE(i); // Loading values in the little-endian order ------------------ | | 35| 17.5k| #define UINT16_TO_LE(n) (n) ------------------ 23| 17.5k| } 24| | 25| 2.21k| for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 11| 2.21k|#define PARAMS_N 976 ------------------ for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 16| 2.19k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (25:18): [True: 2.19k, False: 18] ------------------ 26| 2.14M| for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 11| 2.14M|#define PARAMS_N 976 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 2.14M|#define PARAMS_STRIPE_STEP 8 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 2.14M|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (26:21): [True: 2.14M, False: 2.19k] ------------------ 27| 2.14M| a_cols_temp[i + 1] = UINT16_TO_LE(kk); // Loading values in the little-endian order ------------------ | | 35| 2.14M| #define UINT16_TO_LE(n) (n) ------------------ 28| 2.14M| } 29| | 30| 2.19k| OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 11| 2.19k|#define PARAMS_N 976 ------------------ OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 16| 2.19k|#define PARAMS_STRIPE_STEP 8 ------------------ 31| | 32| 2.14M| for (i = 0; i < PARAMS_N; i++) { // Transpose a_cols to have access to it in the column-major order. ------------------ | | 11| 2.14M|#define PARAMS_N 976 ------------------ | Branch (32:21): [True: 2.14M, False: 2.19k] ------------------ 33| 19.2M| for (k = 0; k < PARAMS_STRIPE_STEP; k++) { ------------------ | | 16| 19.2M|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (33:25): [True: 17.1M, False: 2.14M] ------------------ 34| 17.1M| a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 11| 17.1M|#define PARAMS_N 976 ------------------ a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 34| 17.1M| #define LE_TO_UINT16(n) (n) ------------------ 35| 17.1M| } 36| 2.14M| } 37| | 38| 19.7k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 19.7k|#define PARAMS_NBAR 8 ------------------ | Branch (38:21): [True: 17.5k, False: 2.19k] ------------------ 39| 52.7k| for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 16| 52.7k|#define PARAMS_STRIPE_STEP 8 ------------------ for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 17| 35.1k|#define PARAMS_PARALLEL 4 ------------------ | Branch (39:25): [True: 35.1k, False: 17.5k] ------------------ 40| 35.1k| ALIGN_HEADER(32) uint32_t sum[8 * PARAMS_PARALLEL] ALIGN_FOOTER(32); 41| 35.1k| __m256i a[PARAMS_PARALLEL], b, acc[PARAMS_PARALLEL]; 42| 35.1k| acc[0] = _mm256_setzero_si256(); 43| 35.1k| acc[1] = _mm256_setzero_si256(); 44| 35.1k| acc[2] = _mm256_setzero_si256(); 45| 35.1k| acc[3] = _mm256_setzero_si256(); 46| 2.17M| for (j = 0; j < PARAMS_N; j += 16) { // Matrix-vector multiplication ------------------ | | 11| 2.17M|#define PARAMS_N 976 ------------------ | Branch (46:29): [True: 2.14M, False: 35.1k] ------------------ 47| 2.14M| b = _mm256_load_si256((__m256i*)&s[i*PARAMS_N + j]); ------------------ | | 11| 2.14M|#define PARAMS_N 976 ------------------ 48| 2.14M| a[0] = _mm256_load_si256((__m256i*)&a_cols_t[(k+0)*PARAMS_N + j]); ------------------ | | 11| 2.14M|#define PARAMS_N 976 ------------------ 49| 2.14M| a[0] = _mm256_madd_epi16(a[0], b); 50| 2.14M| acc[0] = _mm256_add_epi16(a[0], acc[0]); 51| 2.14M| a[1] = _mm256_load_si256((__m256i*)&a_cols_t[(k+1)*PARAMS_N + j]); ------------------ | | 11| 2.14M|#define PARAMS_N 976 ------------------ 52| 2.14M| a[1] = _mm256_madd_epi16(a[1], b); 53| 2.14M| acc[1] = _mm256_add_epi16(a[1], acc[1]); 54| 2.14M| a[2] = _mm256_load_si256((__m256i*)&a_cols_t[(k+2)*PARAMS_N + j]); ------------------ | | 11| 2.14M|#define PARAMS_N 976 ------------------ 55| 2.14M| a[2] = _mm256_madd_epi16(a[2], b); 56| 2.14M| acc[2] = _mm256_add_epi16(a[2], acc[2]); 57| 2.14M| a[3] = _mm256_load_si256((__m256i*)&a_cols_t[(k+3)*PARAMS_N + j]); ------------------ | | 11| 2.14M|#define PARAMS_N 976 ------------------ 58| 2.14M| a[3] = _mm256_madd_epi16(a[3], b); 59| 2.14M| acc[3] = _mm256_add_epi16(a[3], acc[3]); 60| 2.14M| } 61| 35.1k| _mm256_store_si256((__m256i*)(sum + (8*0)), acc[0]); 62| 35.1k| out[i*PARAMS_N + kk + k + 0] += sum[8*0 + 0] + sum[8*0 + 1] + sum[8*0 + 2] + sum[8*0 + 3] + sum[8*0 + 4] + sum[8*0 + 5] + sum[8*0 + 6] + sum[8*0 + 7]; ------------------ | | 11| 35.1k|#define PARAMS_N 976 ------------------ 63| 35.1k| _mm256_store_si256((__m256i*)(sum + (8*1)), acc[1]); 64| 35.1k| out[i*PARAMS_N + kk + k + 1] += sum[8*1 + 0] + sum[8*1 + 1] + sum[8*1 + 2] + sum[8*1 + 3] + sum[8*1 + 4] + sum[8*1 + 5] + sum[8*1 + 6] + sum[8*1 + 7]; ------------------ | | 11| 35.1k|#define PARAMS_N 976 ------------------ 65| 35.1k| _mm256_store_si256((__m256i*)(sum + (8*2)), acc[2]); 66| 35.1k| out[i*PARAMS_N + kk + k + 2] += sum[8*2 + 0] + sum[8*2 + 1] + sum[8*2 + 2] + sum[8*2 + 3] + sum[8*2 + 4] + sum[8*2 + 5] + sum[8*2 + 6] + sum[8*2 + 7]; ------------------ | | 11| 35.1k|#define PARAMS_N 976 ------------------ 67| 35.1k| _mm256_store_si256((__m256i*)(sum + (8*3)), acc[3]); 68| 35.1k| out[i*PARAMS_N + kk + k + 3] += sum[8*3 + 0] + sum[8*3 + 1] + sum[8*3 + 2] + sum[8*3 + 3] + sum[8*3 + 4] + sum[8*3 + 5] + sum[8*3 + 6] + sum[8*3 + 7]; ------------------ | | 11| 35.1k|#define PARAMS_N 976 ------------------ 69| 35.1k| } 70| 17.5k| } 71| 2.19k| } 72| 18| OQS_AES128_free_schedule(aes_key_schedule); 73| 18| return 1; 74| 18|} oqs_kem_frodokem_1344_aes_mul_add_sa_plus_e_avx2: 5| 14|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 6| | // Inputs: s', e' (N_BAR x N) 7| | // Output: out = s'*A + e' (N_BAR x N) 8| 14| int i, j, kk; 9| | 10| 75.2k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 75.2k|#define PARAMS_N 1344 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 75.2k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 75.2k, False: 14] ------------------ 11| 75.2k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 75.2k| } 13| | 14| 14| int k; 15| 14| uint16_t a_cols[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 16| 14| ALIGN_HEADER(32) uint16_t a_cols_t[PARAMS_N*PARAMS_STRIPE_STEP] ALIGN_FOOTER(32) = {0}; 17| 14| uint16_t a_cols_temp[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 18| 14| uint8_t *aes_key_schedule; 19| 14| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 20| | 21| 18.8k| for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 18.8k|#define PARAMS_N 1344 ------------------ for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 18.8k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (21:24): [True: 18.8k, False: 14] ------------------ 22| 18.8k| a_cols_temp[j] = UINT16_TO_LE(i); // Loading values in the little-endian order ------------------ | | 35| 18.8k| #define UINT16_TO_LE(n) (n) ------------------ 23| 18.8k| } 24| | 25| 2.36k| for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 11| 2.36k|#define PARAMS_N 1344 ------------------ for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 16| 2.35k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (25:18): [True: 2.35k, False: 14] ------------------ 26| 3.16M| for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 11| 3.16M|#define PARAMS_N 1344 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 3.16M|#define PARAMS_STRIPE_STEP 8 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 3.16M|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (26:21): [True: 3.16M, False: 2.35k] ------------------ 27| 3.16M| a_cols_temp[i + 1] = UINT16_TO_LE(kk); // Loading values in the little-endian order ------------------ | | 35| 3.16M| #define UINT16_TO_LE(n) (n) ------------------ 28| 3.16M| } 29| | 30| 2.35k| OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 11| 2.35k|#define PARAMS_N 1344 ------------------ OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 16| 2.35k|#define PARAMS_STRIPE_STEP 8 ------------------ 31| | 32| 3.16M| for (i = 0; i < PARAMS_N; i++) { // Transpose a_cols to have access to it in the column-major order. ------------------ | | 11| 3.16M|#define PARAMS_N 1344 ------------------ | Branch (32:21): [True: 3.16M, False: 2.35k] ------------------ 33| 28.4M| for (k = 0; k < PARAMS_STRIPE_STEP; k++) { ------------------ | | 16| 28.4M|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (33:25): [True: 25.2M, False: 3.16M] ------------------ 34| 25.2M| a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 11| 25.2M|#define PARAMS_N 1344 ------------------ a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 34| 25.2M| #define LE_TO_UINT16(n) (n) ------------------ 35| 25.2M| } 36| 3.16M| } 37| | 38| 21.1k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 21.1k|#define PARAMS_NBAR 8 ------------------ | Branch (38:21): [True: 18.8k, False: 2.35k] ------------------ 39| 56.4k| for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 16| 56.4k|#define PARAMS_STRIPE_STEP 8 ------------------ for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 17| 37.6k|#define PARAMS_PARALLEL 4 ------------------ | Branch (39:25): [True: 37.6k, False: 18.8k] ------------------ 40| 37.6k| ALIGN_HEADER(32) uint32_t sum[8 * PARAMS_PARALLEL] ALIGN_FOOTER(32); 41| 37.6k| __m256i a[PARAMS_PARALLEL], b, acc[PARAMS_PARALLEL]; 42| 37.6k| acc[0] = _mm256_setzero_si256(); 43| 37.6k| acc[1] = _mm256_setzero_si256(); 44| 37.6k| acc[2] = _mm256_setzero_si256(); 45| 37.6k| acc[3] = _mm256_setzero_si256(); 46| 3.19M| for (j = 0; j < PARAMS_N; j += 16) { // Matrix-vector multiplication ------------------ | | 11| 3.19M|#define PARAMS_N 1344 ------------------ | Branch (46:29): [True: 3.16M, False: 37.6k] ------------------ 47| 3.16M| b = _mm256_load_si256((__m256i*)&s[i*PARAMS_N + j]); ------------------ | | 11| 3.16M|#define PARAMS_N 1344 ------------------ 48| 3.16M| a[0] = _mm256_load_si256((__m256i*)&a_cols_t[(k+0)*PARAMS_N + j]); ------------------ | | 11| 3.16M|#define PARAMS_N 1344 ------------------ 49| 3.16M| a[0] = _mm256_madd_epi16(a[0], b); 50| 3.16M| acc[0] = _mm256_add_epi16(a[0], acc[0]); 51| 3.16M| a[1] = _mm256_load_si256((__m256i*)&a_cols_t[(k+1)*PARAMS_N + j]); ------------------ | | 11| 3.16M|#define PARAMS_N 1344 ------------------ 52| 3.16M| a[1] = _mm256_madd_epi16(a[1], b); 53| 3.16M| acc[1] = _mm256_add_epi16(a[1], acc[1]); 54| 3.16M| a[2] = _mm256_load_si256((__m256i*)&a_cols_t[(k+2)*PARAMS_N + j]); ------------------ | | 11| 3.16M|#define PARAMS_N 1344 ------------------ 55| 3.16M| a[2] = _mm256_madd_epi16(a[2], b); 56| 3.16M| acc[2] = _mm256_add_epi16(a[2], acc[2]); 57| 3.16M| a[3] = _mm256_load_si256((__m256i*)&a_cols_t[(k+3)*PARAMS_N + j]); ------------------ | | 11| 3.16M|#define PARAMS_N 1344 ------------------ 58| 3.16M| a[3] = _mm256_madd_epi16(a[3], b); 59| 3.16M| acc[3] = _mm256_add_epi16(a[3], acc[3]); 60| 3.16M| } 61| 37.6k| _mm256_store_si256((__m256i*)(sum + (8*0)), acc[0]); 62| 37.6k| out[i*PARAMS_N + kk + k + 0] += sum[8*0 + 0] + sum[8*0 + 1] + sum[8*0 + 2] + sum[8*0 + 3] + sum[8*0 + 4] + sum[8*0 + 5] + sum[8*0 + 6] + sum[8*0 + 7]; ------------------ | | 11| 37.6k|#define PARAMS_N 1344 ------------------ 63| 37.6k| _mm256_store_si256((__m256i*)(sum + (8*1)), acc[1]); 64| 37.6k| out[i*PARAMS_N + kk + k + 1] += sum[8*1 + 0] + sum[8*1 + 1] + sum[8*1 + 2] + sum[8*1 + 3] + sum[8*1 + 4] + sum[8*1 + 5] + sum[8*1 + 6] + sum[8*1 + 7]; ------------------ | | 11| 37.6k|#define PARAMS_N 1344 ------------------ 65| 37.6k| _mm256_store_si256((__m256i*)(sum + (8*2)), acc[2]); 66| 37.6k| out[i*PARAMS_N + kk + k + 2] += sum[8*2 + 0] + sum[8*2 + 1] + sum[8*2 + 2] + sum[8*2 + 3] + sum[8*2 + 4] + sum[8*2 + 5] + sum[8*2 + 6] + sum[8*2 + 7]; ------------------ | | 11| 37.6k|#define PARAMS_N 1344 ------------------ 67| 37.6k| _mm256_store_si256((__m256i*)(sum + (8*3)), acc[3]); 68| 37.6k| out[i*PARAMS_N + kk + k + 3] += sum[8*3 + 0] + sum[8*3 + 1] + sum[8*3 + 2] + sum[8*3 + 3] + sum[8*3 + 4] + sum[8*3 + 5] + sum[8*3 + 6] + sum[8*3 + 7]; ------------------ | | 11| 37.6k|#define PARAMS_N 1344 ------------------ 69| 37.6k| } 70| 18.8k| } 71| 2.35k| } 72| 14| OQS_AES128_free_schedule(aes_key_schedule); 73| 14| return 1; 74| 14|} oqs_kem_efrodokem_640_aes_mul_add_sa_plus_e_avx2: 5| 8|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 6| | // Inputs: s', e' (N_BAR x N) 7| | // Output: out = s'*A + e' (N_BAR x N) 8| 8| int i, j, kk; 9| | 10| 20.4k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 20.4k|#define PARAMS_N 640 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 20.4k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 20.4k, False: 8] ------------------ 11| 20.4k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 20.4k| } 13| | 14| 8| int k; 15| 8| uint16_t a_cols[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 16| 8| ALIGN_HEADER(32) uint16_t a_cols_t[PARAMS_N*PARAMS_STRIPE_STEP] ALIGN_FOOTER(32) = {0}; 17| 8| uint16_t a_cols_temp[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 18| 8| uint8_t *aes_key_schedule; 19| 8| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 20| | 21| 5.12k| for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 5.12k|#define PARAMS_N 640 ------------------ for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 5.12k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (21:24): [True: 5.12k, False: 8] ------------------ 22| 5.12k| a_cols_temp[j] = UINT16_TO_LE(i); // Loading values in the little-endian order ------------------ | | 35| 5.12k| #define UINT16_TO_LE(n) (n) ------------------ 23| 5.12k| } 24| | 25| 648| for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 11| 648|#define PARAMS_N 640 ------------------ for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 16| 640|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (25:18): [True: 640, False: 8] ------------------ 26| 410k| for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 11| 410k|#define PARAMS_N 640 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 410k|#define PARAMS_STRIPE_STEP 8 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 409k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (26:21): [True: 409k, False: 640] ------------------ 27| 409k| a_cols_temp[i + 1] = UINT16_TO_LE(kk); // Loading values in the little-endian order ------------------ | | 35| 409k| #define UINT16_TO_LE(n) (n) ------------------ 28| 409k| } 29| | 30| 640| OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 11| 640|#define PARAMS_N 640 ------------------ OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 16| 640|#define PARAMS_STRIPE_STEP 8 ------------------ 31| | 32| 410k| for (i = 0; i < PARAMS_N; i++) { // Transpose a_cols to have access to it in the column-major order. ------------------ | | 11| 410k|#define PARAMS_N 640 ------------------ | Branch (32:21): [True: 409k, False: 640] ------------------ 33| 3.68M| for (k = 0; k < PARAMS_STRIPE_STEP; k++) { ------------------ | | 16| 3.68M|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (33:25): [True: 3.27M, False: 409k] ------------------ 34| 3.27M| a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 11| 3.27M|#define PARAMS_N 640 ------------------ a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 34| 3.27M| #define LE_TO_UINT16(n) (n) ------------------ 35| 3.27M| } 36| 409k| } 37| | 38| 5.76k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 5.76k|#define PARAMS_NBAR 8 ------------------ | Branch (38:21): [True: 5.12k, False: 640] ------------------ 39| 15.3k| for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 16| 15.3k|#define PARAMS_STRIPE_STEP 8 ------------------ for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 17| 10.2k|#define PARAMS_PARALLEL 4 ------------------ | Branch (39:25): [True: 10.2k, False: 5.12k] ------------------ 40| 10.2k| ALIGN_HEADER(32) uint32_t sum[8 * PARAMS_PARALLEL] ALIGN_FOOTER(32); 41| 10.2k| __m256i a[PARAMS_PARALLEL], b, acc[PARAMS_PARALLEL]; 42| 10.2k| acc[0] = _mm256_setzero_si256(); 43| 10.2k| acc[1] = _mm256_setzero_si256(); 44| 10.2k| acc[2] = _mm256_setzero_si256(); 45| 10.2k| acc[3] = _mm256_setzero_si256(); 46| 419k| for (j = 0; j < PARAMS_N; j += 16) { // Matrix-vector multiplication ------------------ | | 11| 419k|#define PARAMS_N 640 ------------------ | Branch (46:29): [True: 409k, False: 10.2k] ------------------ 47| 409k| b = _mm256_load_si256((__m256i*)&s[i*PARAMS_N + j]); ------------------ | | 11| 409k|#define PARAMS_N 640 ------------------ 48| 409k| a[0] = _mm256_load_si256((__m256i*)&a_cols_t[(k+0)*PARAMS_N + j]); ------------------ | | 11| 409k|#define PARAMS_N 640 ------------------ 49| 409k| a[0] = _mm256_madd_epi16(a[0], b); 50| 409k| acc[0] = _mm256_add_epi16(a[0], acc[0]); 51| 409k| a[1] = _mm256_load_si256((__m256i*)&a_cols_t[(k+1)*PARAMS_N + j]); ------------------ | | 11| 409k|#define PARAMS_N 640 ------------------ 52| 409k| a[1] = _mm256_madd_epi16(a[1], b); 53| 409k| acc[1] = _mm256_add_epi16(a[1], acc[1]); 54| 409k| a[2] = _mm256_load_si256((__m256i*)&a_cols_t[(k+2)*PARAMS_N + j]); ------------------ | | 11| 409k|#define PARAMS_N 640 ------------------ 55| 409k| a[2] = _mm256_madd_epi16(a[2], b); 56| 409k| acc[2] = _mm256_add_epi16(a[2], acc[2]); 57| 409k| a[3] = _mm256_load_si256((__m256i*)&a_cols_t[(k+3)*PARAMS_N + j]); ------------------ | | 11| 409k|#define PARAMS_N 640 ------------------ 58| 409k| a[3] = _mm256_madd_epi16(a[3], b); 59| 409k| acc[3] = _mm256_add_epi16(a[3], acc[3]); 60| 409k| } 61| 10.2k| _mm256_store_si256((__m256i*)(sum + (8*0)), acc[0]); 62| 10.2k| out[i*PARAMS_N + kk + k + 0] += sum[8*0 + 0] + sum[8*0 + 1] + sum[8*0 + 2] + sum[8*0 + 3] + sum[8*0 + 4] + sum[8*0 + 5] + sum[8*0 + 6] + sum[8*0 + 7]; ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ 63| 10.2k| _mm256_store_si256((__m256i*)(sum + (8*1)), acc[1]); 64| 10.2k| out[i*PARAMS_N + kk + k + 1] += sum[8*1 + 0] + sum[8*1 + 1] + sum[8*1 + 2] + sum[8*1 + 3] + sum[8*1 + 4] + sum[8*1 + 5] + sum[8*1 + 6] + sum[8*1 + 7]; ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ 65| 10.2k| _mm256_store_si256((__m256i*)(sum + (8*2)), acc[2]); 66| 10.2k| out[i*PARAMS_N + kk + k + 2] += sum[8*2 + 0] + sum[8*2 + 1] + sum[8*2 + 2] + sum[8*2 + 3] + sum[8*2 + 4] + sum[8*2 + 5] + sum[8*2 + 6] + sum[8*2 + 7]; ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ 67| 10.2k| _mm256_store_si256((__m256i*)(sum + (8*3)), acc[3]); 68| 10.2k| out[i*PARAMS_N + kk + k + 3] += sum[8*3 + 0] + sum[8*3 + 1] + sum[8*3 + 2] + sum[8*3 + 3] + sum[8*3 + 4] + sum[8*3 + 5] + sum[8*3 + 6] + sum[8*3 + 7]; ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ 69| 10.2k| } 70| 5.12k| } 71| 640| } 72| 8| OQS_AES128_free_schedule(aes_key_schedule); 73| 8| return 1; 74| 8|} oqs_kem_efrodokem_976_aes_mul_add_sa_plus_e_avx2: 5| 18|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 6| | // Inputs: s', e' (N_BAR x N) 7| | // Output: out = s'*A + e' (N_BAR x N) 8| 18| int i, j, kk; 9| | 10| 70.2k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 70.2k|#define PARAMS_N 976 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 70.2k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 70.2k, False: 18] ------------------ 11| 70.2k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 70.2k| } 13| | 14| 18| int k; 15| 18| uint16_t a_cols[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 16| 18| ALIGN_HEADER(32) uint16_t a_cols_t[PARAMS_N*PARAMS_STRIPE_STEP] ALIGN_FOOTER(32) = {0}; 17| 18| uint16_t a_cols_temp[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 18| 18| uint8_t *aes_key_schedule; 19| 18| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 20| | 21| 17.5k| for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 17.5k|#define PARAMS_N 976 ------------------ for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 17.5k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (21:24): [True: 17.5k, False: 18] ------------------ 22| 17.5k| a_cols_temp[j] = UINT16_TO_LE(i); // Loading values in the little-endian order ------------------ | | 35| 17.5k| #define UINT16_TO_LE(n) (n) ------------------ 23| 17.5k| } 24| | 25| 2.21k| for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 11| 2.21k|#define PARAMS_N 976 ------------------ for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 16| 2.19k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (25:18): [True: 2.19k, False: 18] ------------------ 26| 2.14M| for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 11| 2.14M|#define PARAMS_N 976 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 2.14M|#define PARAMS_STRIPE_STEP 8 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 2.14M|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (26:21): [True: 2.14M, False: 2.19k] ------------------ 27| 2.14M| a_cols_temp[i + 1] = UINT16_TO_LE(kk); // Loading values in the little-endian order ------------------ | | 35| 2.14M| #define UINT16_TO_LE(n) (n) ------------------ 28| 2.14M| } 29| | 30| 2.19k| OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 11| 2.19k|#define PARAMS_N 976 ------------------ OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 16| 2.19k|#define PARAMS_STRIPE_STEP 8 ------------------ 31| | 32| 2.14M| for (i = 0; i < PARAMS_N; i++) { // Transpose a_cols to have access to it in the column-major order. ------------------ | | 11| 2.14M|#define PARAMS_N 976 ------------------ | Branch (32:21): [True: 2.14M, False: 2.19k] ------------------ 33| 19.2M| for (k = 0; k < PARAMS_STRIPE_STEP; k++) { ------------------ | | 16| 19.2M|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (33:25): [True: 17.1M, False: 2.14M] ------------------ 34| 17.1M| a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 11| 17.1M|#define PARAMS_N 976 ------------------ a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 34| 17.1M| #define LE_TO_UINT16(n) (n) ------------------ 35| 17.1M| } 36| 2.14M| } 37| | 38| 19.7k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 19.7k|#define PARAMS_NBAR 8 ------------------ | Branch (38:21): [True: 17.5k, False: 2.19k] ------------------ 39| 52.7k| for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 16| 52.7k|#define PARAMS_STRIPE_STEP 8 ------------------ for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 17| 35.1k|#define PARAMS_PARALLEL 4 ------------------ | Branch (39:25): [True: 35.1k, False: 17.5k] ------------------ 40| 35.1k| ALIGN_HEADER(32) uint32_t sum[8 * PARAMS_PARALLEL] ALIGN_FOOTER(32); 41| 35.1k| __m256i a[PARAMS_PARALLEL], b, acc[PARAMS_PARALLEL]; 42| 35.1k| acc[0] = _mm256_setzero_si256(); 43| 35.1k| acc[1] = _mm256_setzero_si256(); 44| 35.1k| acc[2] = _mm256_setzero_si256(); 45| 35.1k| acc[3] = _mm256_setzero_si256(); 46| 2.17M| for (j = 0; j < PARAMS_N; j += 16) { // Matrix-vector multiplication ------------------ | | 11| 2.17M|#define PARAMS_N 976 ------------------ | Branch (46:29): [True: 2.14M, False: 35.1k] ------------------ 47| 2.14M| b = _mm256_load_si256((__m256i*)&s[i*PARAMS_N + j]); ------------------ | | 11| 2.14M|#define PARAMS_N 976 ------------------ 48| 2.14M| a[0] = _mm256_load_si256((__m256i*)&a_cols_t[(k+0)*PARAMS_N + j]); ------------------ | | 11| 2.14M|#define PARAMS_N 976 ------------------ 49| 2.14M| a[0] = _mm256_madd_epi16(a[0], b); 50| 2.14M| acc[0] = _mm256_add_epi16(a[0], acc[0]); 51| 2.14M| a[1] = _mm256_load_si256((__m256i*)&a_cols_t[(k+1)*PARAMS_N + j]); ------------------ | | 11| 2.14M|#define PARAMS_N 976 ------------------ 52| 2.14M| a[1] = _mm256_madd_epi16(a[1], b); 53| 2.14M| acc[1] = _mm256_add_epi16(a[1], acc[1]); 54| 2.14M| a[2] = _mm256_load_si256((__m256i*)&a_cols_t[(k+2)*PARAMS_N + j]); ------------------ | | 11| 2.14M|#define PARAMS_N 976 ------------------ 55| 2.14M| a[2] = _mm256_madd_epi16(a[2], b); 56| 2.14M| acc[2] = _mm256_add_epi16(a[2], acc[2]); 57| 2.14M| a[3] = _mm256_load_si256((__m256i*)&a_cols_t[(k+3)*PARAMS_N + j]); ------------------ | | 11| 2.14M|#define PARAMS_N 976 ------------------ 58| 2.14M| a[3] = _mm256_madd_epi16(a[3], b); 59| 2.14M| acc[3] = _mm256_add_epi16(a[3], acc[3]); 60| 2.14M| } 61| 35.1k| _mm256_store_si256((__m256i*)(sum + (8*0)), acc[0]); 62| 35.1k| out[i*PARAMS_N + kk + k + 0] += sum[8*0 + 0] + sum[8*0 + 1] + sum[8*0 + 2] + sum[8*0 + 3] + sum[8*0 + 4] + sum[8*0 + 5] + sum[8*0 + 6] + sum[8*0 + 7]; ------------------ | | 11| 35.1k|#define PARAMS_N 976 ------------------ 63| 35.1k| _mm256_store_si256((__m256i*)(sum + (8*1)), acc[1]); 64| 35.1k| out[i*PARAMS_N + kk + k + 1] += sum[8*1 + 0] + sum[8*1 + 1] + sum[8*1 + 2] + sum[8*1 + 3] + sum[8*1 + 4] + sum[8*1 + 5] + sum[8*1 + 6] + sum[8*1 + 7]; ------------------ | | 11| 35.1k|#define PARAMS_N 976 ------------------ 65| 35.1k| _mm256_store_si256((__m256i*)(sum + (8*2)), acc[2]); 66| 35.1k| out[i*PARAMS_N + kk + k + 2] += sum[8*2 + 0] + sum[8*2 + 1] + sum[8*2 + 2] + sum[8*2 + 3] + sum[8*2 + 4] + sum[8*2 + 5] + sum[8*2 + 6] + sum[8*2 + 7]; ------------------ | | 11| 35.1k|#define PARAMS_N 976 ------------------ 67| 35.1k| _mm256_store_si256((__m256i*)(sum + (8*3)), acc[3]); 68| 35.1k| out[i*PARAMS_N + kk + k + 3] += sum[8*3 + 0] + sum[8*3 + 1] + sum[8*3 + 2] + sum[8*3 + 3] + sum[8*3 + 4] + sum[8*3 + 5] + sum[8*3 + 6] + sum[8*3 + 7]; ------------------ | | 11| 35.1k|#define PARAMS_N 976 ------------------ 69| 35.1k| } 70| 17.5k| } 71| 2.19k| } 72| 18| OQS_AES128_free_schedule(aes_key_schedule); 73| 18| return 1; 74| 18|} oqs_kem_efrodokem_1344_aes_mul_add_sa_plus_e_avx2: 5| 18|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 6| | // Inputs: s', e' (N_BAR x N) 7| | // Output: out = s'*A + e' (N_BAR x N) 8| 18| int i, j, kk; 9| | 10| 96.7k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 96.7k|#define PARAMS_N 1344 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 96.7k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 96.7k, False: 18] ------------------ 11| 96.7k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 96.7k| } 13| | 14| 18| int k; 15| 18| uint16_t a_cols[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 16| 18| ALIGN_HEADER(32) uint16_t a_cols_t[PARAMS_N*PARAMS_STRIPE_STEP] ALIGN_FOOTER(32) = {0}; 17| 18| uint16_t a_cols_temp[PARAMS_N*PARAMS_STRIPE_STEP] = {0}; 18| 18| uint8_t *aes_key_schedule; 19| 18| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 20| | 21| 24.2k| for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 24.2k|#define PARAMS_N 1344 ------------------ for (i = 0, j = 0; i < PARAMS_N; i++, j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 24.1k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (21:24): [True: 24.1k, False: 18] ------------------ 22| 24.1k| a_cols_temp[j] = UINT16_TO_LE(i); // Loading values in the little-endian order ------------------ | | 35| 24.1k| #define UINT16_TO_LE(n) (n) ------------------ 23| 24.1k| } 24| | 25| 3.04k| for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 11| 3.04k|#define PARAMS_N 1344 ------------------ for (kk = 0; kk < PARAMS_N; kk += PARAMS_STRIPE_STEP) { // Go through A's columns, 8 (== PARAMS_STRIPE_STEP) columns at a time. ------------------ | | 16| 3.02k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (25:18): [True: 3.02k, False: 18] ------------------ 26| 4.06M| for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 11| 4.06M|#define PARAMS_N 1344 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 4.06M|#define PARAMS_STRIPE_STEP 8 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_STRIPE_STEP); i += PARAMS_STRIPE_STEP) { ------------------ | | 16| 4.06M|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (26:21): [True: 4.06M, False: 3.02k] ------------------ 27| 4.06M| a_cols_temp[i + 1] = UINT16_TO_LE(kk); // Loading values in the little-endian order ------------------ | | 35| 4.06M| #define UINT16_TO_LE(n) (n) ------------------ 28| 4.06M| } 29| | 30| 3.02k| OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 11| 3.02k|#define PARAMS_N 1344 ------------------ OQS_AES128_ECB_enc_sch((uint8_t*)a_cols_temp, PARAMS_N*PARAMS_STRIPE_STEP*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_cols); ------------------ | | 16| 3.02k|#define PARAMS_STRIPE_STEP 8 ------------------ 31| | 32| 4.06M| for (i = 0; i < PARAMS_N; i++) { // Transpose a_cols to have access to it in the column-major order. ------------------ | | 11| 4.06M|#define PARAMS_N 1344 ------------------ | Branch (32:21): [True: 4.06M, False: 3.02k] ------------------ 33| 36.5M| for (k = 0; k < PARAMS_STRIPE_STEP; k++) { ------------------ | | 16| 36.5M|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (33:25): [True: 32.5M, False: 4.06M] ------------------ 34| 32.5M| a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 11| 32.5M|#define PARAMS_N 1344 ------------------ a_cols_t[k*PARAMS_N + i] = LE_TO_UINT16(a_cols[i*PARAMS_STRIPE_STEP + k]); ------------------ | | 34| 32.5M| #define LE_TO_UINT16(n) (n) ------------------ 35| 32.5M| } 36| 4.06M| } 37| | 38| 27.2k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 27.2k|#define PARAMS_NBAR 8 ------------------ | Branch (38:21): [True: 24.1k, False: 3.02k] ------------------ 39| 72.5k| for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 16| 72.5k|#define PARAMS_STRIPE_STEP 8 ------------------ for (k = 0; k < PARAMS_STRIPE_STEP; k += PARAMS_PARALLEL) { ------------------ | | 17| 48.3k|#define PARAMS_PARALLEL 4 ------------------ | Branch (39:25): [True: 48.3k, False: 24.1k] ------------------ 40| 48.3k| ALIGN_HEADER(32) uint32_t sum[8 * PARAMS_PARALLEL] ALIGN_FOOTER(32); 41| 48.3k| __m256i a[PARAMS_PARALLEL], b, acc[PARAMS_PARALLEL]; 42| 48.3k| acc[0] = _mm256_setzero_si256(); 43| 48.3k| acc[1] = _mm256_setzero_si256(); 44| 48.3k| acc[2] = _mm256_setzero_si256(); 45| 48.3k| acc[3] = _mm256_setzero_si256(); 46| 4.11M| for (j = 0; j < PARAMS_N; j += 16) { // Matrix-vector multiplication ------------------ | | 11| 4.11M|#define PARAMS_N 1344 ------------------ | Branch (46:29): [True: 4.06M, False: 48.3k] ------------------ 47| 4.06M| b = _mm256_load_si256((__m256i*)&s[i*PARAMS_N + j]); ------------------ | | 11| 4.06M|#define PARAMS_N 1344 ------------------ 48| 4.06M| a[0] = _mm256_load_si256((__m256i*)&a_cols_t[(k+0)*PARAMS_N + j]); ------------------ | | 11| 4.06M|#define PARAMS_N 1344 ------------------ 49| 4.06M| a[0] = _mm256_madd_epi16(a[0], b); 50| 4.06M| acc[0] = _mm256_add_epi16(a[0], acc[0]); 51| 4.06M| a[1] = _mm256_load_si256((__m256i*)&a_cols_t[(k+1)*PARAMS_N + j]); ------------------ | | 11| 4.06M|#define PARAMS_N 1344 ------------------ 52| 4.06M| a[1] = _mm256_madd_epi16(a[1], b); 53| 4.06M| acc[1] = _mm256_add_epi16(a[1], acc[1]); 54| 4.06M| a[2] = _mm256_load_si256((__m256i*)&a_cols_t[(k+2)*PARAMS_N + j]); ------------------ | | 11| 4.06M|#define PARAMS_N 1344 ------------------ 55| 4.06M| a[2] = _mm256_madd_epi16(a[2], b); 56| 4.06M| acc[2] = _mm256_add_epi16(a[2], acc[2]); 57| 4.06M| a[3] = _mm256_load_si256((__m256i*)&a_cols_t[(k+3)*PARAMS_N + j]); ------------------ | | 11| 4.06M|#define PARAMS_N 1344 ------------------ 58| 4.06M| a[3] = _mm256_madd_epi16(a[3], b); 59| 4.06M| acc[3] = _mm256_add_epi16(a[3], acc[3]); 60| 4.06M| } 61| 48.3k| _mm256_store_si256((__m256i*)(sum + (8*0)), acc[0]); 62| 48.3k| out[i*PARAMS_N + kk + k + 0] += sum[8*0 + 0] + sum[8*0 + 1] + sum[8*0 + 2] + sum[8*0 + 3] + sum[8*0 + 4] + sum[8*0 + 5] + sum[8*0 + 6] + sum[8*0 + 7]; ------------------ | | 11| 48.3k|#define PARAMS_N 1344 ------------------ 63| 48.3k| _mm256_store_si256((__m256i*)(sum + (8*1)), acc[1]); 64| 48.3k| out[i*PARAMS_N + kk + k + 1] += sum[8*1 + 0] + sum[8*1 + 1] + sum[8*1 + 2] + sum[8*1 + 3] + sum[8*1 + 4] + sum[8*1 + 5] + sum[8*1 + 6] + sum[8*1 + 7]; ------------------ | | 11| 48.3k|#define PARAMS_N 1344 ------------------ 65| 48.3k| _mm256_store_si256((__m256i*)(sum + (8*2)), acc[2]); 66| 48.3k| out[i*PARAMS_N + kk + k + 2] += sum[8*2 + 0] + sum[8*2 + 1] + sum[8*2 + 2] + sum[8*2 + 3] + sum[8*2 + 4] + sum[8*2 + 5] + sum[8*2 + 6] + sum[8*2 + 7]; ------------------ | | 11| 48.3k|#define PARAMS_N 1344 ------------------ 67| 48.3k| _mm256_store_si256((__m256i*)(sum + (8*3)), acc[3]); 68| 48.3k| out[i*PARAMS_N + kk + k + 3] += sum[8*3 + 0] + sum[8*3 + 1] + sum[8*3 + 2] + sum[8*3 + 3] + sum[8*3 + 4] + sum[8*3 + 5] + sum[8*3 + 6] + sum[8*3 + 7]; ------------------ | | 11| 48.3k|#define PARAMS_N 1344 ------------------ 69| 48.3k| } 70| 24.1k| } 71| 3.02k| } 72| 18| OQS_AES128_free_schedule(aes_key_schedule); 73| 18| return 1; 74| 18|} oqs_kem_frodokem_640_aes_mul_add_as_plus_e_avx2: 4| 2|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 2| int i, j, k; 8| 2| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 5.12k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 5.12k|#define PARAMS_N 640 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 5.12k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 5.12k, False: 2] ------------------ 11| 5.12k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 5.12k| } 13| | 14| 2|#if defined(USE_AES128_FOR_A) 15| 2| int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| 2| uint8_t *aes_key_schedule; 17| 2| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| 162| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 162|#define PARAMS_N 640 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 160|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (19:17): [True: 160, False: 2] ------------------ 20| 160| a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 11| 160|#define PARAMS_N 640 ------------------ a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 35| 160| #define UINT16_TO_LE(n) (n) ------------------ 21| 160| a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 160|#define PARAMS_N 640 ------------------ a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 160| #define UINT16_TO_LE(n) (n) ------------------ 22| 160| a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 160|#define PARAMS_N 640 ------------------ a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 160| #define UINT16_TO_LE(n) (n) ------------------ 23| 160| a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 160|#define PARAMS_N 640 ------------------ a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 160| #define UINT16_TO_LE(n) (n) ------------------ 24| 160| } 25| | 26| 322| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 322|#define PARAMS_N 640 ------------------ | Branch (26:17): [True: 320, False: 2] ------------------ 27| 25.9k| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 11| 25.9k|#define PARAMS_N 640 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 16| 25.6k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (27:21): [True: 25.6k, False: 320] ------------------ 28| 25.6k| a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 11| 25.6k|#define PARAMS_N 640 ------------------ a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 35| 25.6k| #define UINT16_TO_LE(n) (n) ------------------ 29| 25.6k| a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 11| 25.6k|#define PARAMS_N 640 ------------------ a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 35| 25.6k| #define UINT16_TO_LE(n) (n) ------------------ 30| 25.6k| a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 11| 25.6k|#define PARAMS_N 640 ------------------ a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 35| 25.6k| #define UINT16_TO_LE(n) (n) ------------------ 31| 25.6k| a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 11| 25.6k|#define PARAMS_N 640 ------------------ a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 35| 25.6k| #define UINT16_TO_LE(n) (n) ------------------ 32| 25.6k| } 33| | 34| 320| OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); ------------------ | | 11| 320|#define PARAMS_N 640 ------------------ 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| | uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| | uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| | uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| | uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| | uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| | uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| | uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| | memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); 45| | memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); 46| | memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); 47| | memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); 48| | for (i = 0; i < PARAMS_N; i += 4) { 49| | seed_A_origin_0[0] = UINT16_TO_LE(i + 0); 50| | seed_A_origin_1[0] = UINT16_TO_LE(i + 1); 51| | seed_A_origin_2[0] = UINT16_TO_LE(i + 2); 52| | seed_A_origin_3[0] = UINT16_TO_LE(i + 3); 53| | OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), 54| | (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); 55| |#endif /* USE_AES128_FOR_A */ 56| 819k| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 819k|#define PARAMS_N 640 ------------------ | Branch (56:21): [True: 819k, False: 320] ------------------ 57| 819k| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 819k| #define LE_TO_UINT16(n) (n) ------------------ 58| 819k| } 59| 2.88k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 2.88k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 2.56k, False: 320] ------------------ 60| 2.56k| uint16_t sum[4] = {0}; 61| 1.64M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 1.64M|#define PARAMS_N 640 ------------------ | Branch (61:25): [True: 1.63M, False: 2.56k] ------------------ 62| 1.63M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ 63| 1.63M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ 64| 1.63M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ 65| 1.63M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ 66| 1.63M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ 67| 1.63M| } 68| 2.56k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 2.56k|#define PARAMS_NBAR 8 ------------------ 69| 2.56k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 2.56k|#define PARAMS_NBAR 8 ------------------ 70| 2.56k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 2.56k|#define PARAMS_NBAR 8 ------------------ 71| 2.56k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 2.56k|#define PARAMS_NBAR 8 ------------------ 72| 2.56k| } 73| 320| } 74| | 75| 2|#if defined(USE_AES128_FOR_A) 76| 2| OQS_AES128_free_schedule(aes_key_schedule); 77| 2|#endif 78| 2| return 1; 79| 2|} oqs_kem_frodokem_976_aes_mul_add_as_plus_e_avx2: 4| 9|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 9| int i, j, k; 8| 9| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 35.1k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 35.1k|#define PARAMS_N 976 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 35.1k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 35.1k, False: 9] ------------------ 11| 35.1k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 35.1k| } 13| | 14| 9|#if defined(USE_AES128_FOR_A) 15| 9| int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| 9| uint8_t *aes_key_schedule; 17| 9| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| 1.10k| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 1.10k|#define PARAMS_N 976 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 1.09k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (19:17): [True: 1.09k, False: 9] ------------------ 20| 1.09k| a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 11| 1.09k|#define PARAMS_N 976 ------------------ a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 35| 1.09k| #define UINT16_TO_LE(n) (n) ------------------ 21| 1.09k| a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.09k|#define PARAMS_N 976 ------------------ a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.09k| #define UINT16_TO_LE(n) (n) ------------------ 22| 1.09k| a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.09k|#define PARAMS_N 976 ------------------ a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.09k| #define UINT16_TO_LE(n) (n) ------------------ 23| 1.09k| a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.09k|#define PARAMS_N 976 ------------------ a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.09k| #define UINT16_TO_LE(n) (n) ------------------ 24| 1.09k| } 25| | 26| 2.20k| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 2.20k|#define PARAMS_N 976 ------------------ | Branch (26:17): [True: 2.19k, False: 9] ------------------ 27| 270k| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 11| 270k|#define PARAMS_N 976 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 16| 267k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (27:21): [True: 267k, False: 2.19k] ------------------ 28| 267k| a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 11| 267k|#define PARAMS_N 976 ------------------ a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 35| 267k| #define UINT16_TO_LE(n) (n) ------------------ 29| 267k| a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 11| 267k|#define PARAMS_N 976 ------------------ a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 35| 267k| #define UINT16_TO_LE(n) (n) ------------------ 30| 267k| a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 11| 267k|#define PARAMS_N 976 ------------------ a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 35| 267k| #define UINT16_TO_LE(n) (n) ------------------ 31| 267k| a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 11| 267k|#define PARAMS_N 976 ------------------ a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 35| 267k| #define UINT16_TO_LE(n) (n) ------------------ 32| 267k| } 33| | 34| 2.19k| OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); ------------------ | | 11| 2.19k|#define PARAMS_N 976 ------------------ 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| | uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| | uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| | uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| | uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| | uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| | uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| | uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| | memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); 45| | memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); 46| | memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); 47| | memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); 48| | for (i = 0; i < PARAMS_N; i += 4) { 49| | seed_A_origin_0[0] = UINT16_TO_LE(i + 0); 50| | seed_A_origin_1[0] = UINT16_TO_LE(i + 1); 51| | seed_A_origin_2[0] = UINT16_TO_LE(i + 2); 52| | seed_A_origin_3[0] = UINT16_TO_LE(i + 3); 53| | OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), 54| | (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); 55| |#endif /* USE_AES128_FOR_A */ 56| 8.57M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 8.57M|#define PARAMS_N 976 ------------------ | Branch (56:21): [True: 8.57M, False: 2.19k] ------------------ 57| 8.57M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 8.57M| #define LE_TO_UINT16(n) (n) ------------------ 58| 8.57M| } 59| 19.7k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 19.7k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 17.5k, False: 2.19k] ------------------ 60| 17.5k| uint16_t sum[4] = {0}; 61| 17.1M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 17.1M|#define PARAMS_N 976 ------------------ | Branch (61:25): [True: 17.1M, False: 17.5k] ------------------ 62| 17.1M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 17.1M|#define PARAMS_N 976 ------------------ 63| 17.1M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 17.1M|#define PARAMS_N 976 ------------------ 64| 17.1M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 17.1M|#define PARAMS_N 976 ------------------ 65| 17.1M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 17.1M|#define PARAMS_N 976 ------------------ 66| 17.1M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 17.1M|#define PARAMS_N 976 ------------------ 67| 17.1M| } 68| 17.5k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 17.5k|#define PARAMS_NBAR 8 ------------------ 69| 17.5k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 17.5k|#define PARAMS_NBAR 8 ------------------ 70| 17.5k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 17.5k|#define PARAMS_NBAR 8 ------------------ 71| 17.5k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 17.5k|#define PARAMS_NBAR 8 ------------------ 72| 17.5k| } 73| 2.19k| } 74| | 75| 9|#if defined(USE_AES128_FOR_A) 76| 9| OQS_AES128_free_schedule(aes_key_schedule); 77| 9|#endif 78| 9| return 1; 79| 9|} oqs_kem_frodokem_1344_aes_mul_add_as_plus_e_avx2: 4| 7|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 7| int i, j, k; 8| 7| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 37.6k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 37.6k|#define PARAMS_N 1344 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 37.6k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 37.6k, False: 7] ------------------ 11| 37.6k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 37.6k| } 13| | 14| 7|#if defined(USE_AES128_FOR_A) 15| 7| int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| 7| uint8_t *aes_key_schedule; 17| 7| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| 1.18k| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 1.18k|#define PARAMS_N 1344 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 1.17k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (19:17): [True: 1.17k, False: 7] ------------------ 20| 1.17k| a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 11| 1.17k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 35| 1.17k| #define UINT16_TO_LE(n) (n) ------------------ 21| 1.17k| a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.17k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.17k| #define UINT16_TO_LE(n) (n) ------------------ 22| 1.17k| a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.17k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.17k| #define UINT16_TO_LE(n) (n) ------------------ 23| 1.17k| a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.17k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.17k| #define UINT16_TO_LE(n) (n) ------------------ 24| 1.17k| } 25| | 26| 2.35k| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 2.35k|#define PARAMS_N 1344 ------------------ | Branch (26:17): [True: 2.35k, False: 7] ------------------ 27| 397k| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 11| 397k|#define PARAMS_N 1344 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 16| 395k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (27:21): [True: 395k, False: 2.35k] ------------------ 28| 395k| a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 11| 395k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 35| 395k| #define UINT16_TO_LE(n) (n) ------------------ 29| 395k| a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 11| 395k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 35| 395k| #define UINT16_TO_LE(n) (n) ------------------ 30| 395k| a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 11| 395k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 35| 395k| #define UINT16_TO_LE(n) (n) ------------------ 31| 395k| a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 11| 395k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 35| 395k| #define UINT16_TO_LE(n) (n) ------------------ 32| 395k| } 33| | 34| 2.35k| OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); ------------------ | | 11| 2.35k|#define PARAMS_N 1344 ------------------ 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| | uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| | uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| | uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| | uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| | uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| | uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| | uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| | memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); 45| | memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); 46| | memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); 47| | memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); 48| | for (i = 0; i < PARAMS_N; i += 4) { 49| | seed_A_origin_0[0] = UINT16_TO_LE(i + 0); 50| | seed_A_origin_1[0] = UINT16_TO_LE(i + 1); 51| | seed_A_origin_2[0] = UINT16_TO_LE(i + 2); 52| | seed_A_origin_3[0] = UINT16_TO_LE(i + 3); 53| | OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), 54| | (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); 55| |#endif /* USE_AES128_FOR_A */ 56| 12.6M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 12.6M|#define PARAMS_N 1344 ------------------ | Branch (56:21): [True: 12.6M, False: 2.35k] ------------------ 57| 12.6M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 12.6M| #define LE_TO_UINT16(n) (n) ------------------ 58| 12.6M| } 59| 21.1k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 21.1k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 18.8k, False: 2.35k] ------------------ 60| 18.8k| uint16_t sum[4] = {0}; 61| 25.3M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 25.3M|#define PARAMS_N 1344 ------------------ | Branch (61:25): [True: 25.2M, False: 18.8k] ------------------ 62| 25.2M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 25.2M|#define PARAMS_N 1344 ------------------ 63| 25.2M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 25.2M|#define PARAMS_N 1344 ------------------ 64| 25.2M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 25.2M|#define PARAMS_N 1344 ------------------ 65| 25.2M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 25.2M|#define PARAMS_N 1344 ------------------ 66| 25.2M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 25.2M|#define PARAMS_N 1344 ------------------ 67| 25.2M| } 68| 18.8k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 18.8k|#define PARAMS_NBAR 8 ------------------ 69| 18.8k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 18.8k|#define PARAMS_NBAR 8 ------------------ 70| 18.8k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 18.8k|#define PARAMS_NBAR 8 ------------------ 71| 18.8k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 18.8k|#define PARAMS_NBAR 8 ------------------ 72| 18.8k| } 73| 2.35k| } 74| | 75| 7|#if defined(USE_AES128_FOR_A) 76| 7| OQS_AES128_free_schedule(aes_key_schedule); 77| 7|#endif 78| 7| return 1; 79| 7|} oqs_kem_frodokem_640_shake_mul_add_as_plus_e_avx2: 4| 3|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 3| int i, j, k; 8| 3| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 7.68k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 7.68k|#define PARAMS_N 640 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 7.68k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 7.68k, False: 3] ------------------ 11| 7.68k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 7.68k| } 13| | 14| |#if defined(USE_AES128_FOR_A) 15| | int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| | uint8_t *aes_key_schedule; 17| | OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { 20| | a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order 21| | a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); 22| | a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); 23| | a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); 24| | } 25| | 26| | for (i = 0; i < PARAMS_N; i += 4) { 27| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time 28| | a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order 29| | a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); 30| | a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); 31| | a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); 32| | } 33| | 34| | OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| 3| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| 3| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| 3| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| 3| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| 3| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| 3| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| 3| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| 3| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 45| 3| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 46| 3| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 47| 3| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 3|#define BYTES_SEED_A 16 ------------------ 48| 483| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 483|#define PARAMS_N 640 ------------------ | Branch (48:17): [True: 480, False: 3] ------------------ 49| 480| seed_A_origin_0[0] = UINT16_TO_LE(i + 0); ------------------ | | 35| 480| #define UINT16_TO_LE(n) (n) ------------------ 50| 480| seed_A_origin_1[0] = UINT16_TO_LE(i + 1); ------------------ | | 35| 480| #define UINT16_TO_LE(n) (n) ------------------ 51| 480| seed_A_origin_2[0] = UINT16_TO_LE(i + 2); ------------------ | | 35| 480| #define UINT16_TO_LE(n) (n) ------------------ 52| 480| seed_A_origin_3[0] = UINT16_TO_LE(i + 3); ------------------ | | 35| 480| #define UINT16_TO_LE(n) (n) ------------------ 53| 480| OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 480|#define PARAMS_N 640 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 480|#define PARAMS_N 640 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 480|#define PARAMS_N 640 ------------------ 54| 480| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 480|#define PARAMS_N 640 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 480|#define BYTES_SEED_A 16 ------------------ 55| 480|#endif /* USE_AES128_FOR_A */ 56| 1.22M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 1.22M|#define PARAMS_N 640 ------------------ | Branch (56:21): [True: 1.22M, False: 480] ------------------ 57| 1.22M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 1.22M| #define LE_TO_UINT16(n) (n) ------------------ 58| 1.22M| } 59| 4.32k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 4.32k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 3.84k, False: 480] ------------------ 60| 3.84k| uint16_t sum[4] = {0}; 61| 2.46M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 2.46M|#define PARAMS_N 640 ------------------ | Branch (61:25): [True: 2.45M, False: 3.84k] ------------------ 62| 2.45M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 2.45M|#define PARAMS_N 640 ------------------ 63| 2.45M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 2.45M|#define PARAMS_N 640 ------------------ 64| 2.45M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 2.45M|#define PARAMS_N 640 ------------------ 65| 2.45M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 2.45M|#define PARAMS_N 640 ------------------ 66| 2.45M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 2.45M|#define PARAMS_N 640 ------------------ 67| 2.45M| } 68| 3.84k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 3.84k|#define PARAMS_NBAR 8 ------------------ 69| 3.84k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 3.84k|#define PARAMS_NBAR 8 ------------------ 70| 3.84k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 3.84k|#define PARAMS_NBAR 8 ------------------ 71| 3.84k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 3.84k|#define PARAMS_NBAR 8 ------------------ 72| 3.84k| } 73| 480| } 74| | 75| |#if defined(USE_AES128_FOR_A) 76| | OQS_AES128_free_schedule(aes_key_schedule); 77| |#endif 78| 3| return 1; 79| 3|} oqs_kem_frodokem_976_shake_mul_add_as_plus_e_avx2: 4| 9|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 9| int i, j, k; 8| 9| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 35.1k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 35.1k|#define PARAMS_N 976 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 35.1k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 35.1k, False: 9] ------------------ 11| 35.1k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 35.1k| } 13| | 14| |#if defined(USE_AES128_FOR_A) 15| | int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| | uint8_t *aes_key_schedule; 17| | OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { 20| | a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order 21| | a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); 22| | a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); 23| | a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); 24| | } 25| | 26| | for (i = 0; i < PARAMS_N; i += 4) { 27| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time 28| | a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order 29| | a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); 30| | a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); 31| | a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); 32| | } 33| | 34| | OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| 9| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| 9| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| 9| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| 9| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| 9| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| 9| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| 9| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| 9| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 45| 9| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 46| 9| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 47| 9| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 9|#define BYTES_SEED_A 16 ------------------ 48| 2.20k| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 2.20k|#define PARAMS_N 976 ------------------ | Branch (48:17): [True: 2.19k, False: 9] ------------------ 49| 2.19k| seed_A_origin_0[0] = UINT16_TO_LE(i + 0); ------------------ | | 35| 2.19k| #define UINT16_TO_LE(n) (n) ------------------ 50| 2.19k| seed_A_origin_1[0] = UINT16_TO_LE(i + 1); ------------------ | | 35| 2.19k| #define UINT16_TO_LE(n) (n) ------------------ 51| 2.19k| seed_A_origin_2[0] = UINT16_TO_LE(i + 2); ------------------ | | 35| 2.19k| #define UINT16_TO_LE(n) (n) ------------------ 52| 2.19k| seed_A_origin_3[0] = UINT16_TO_LE(i + 3); ------------------ | | 35| 2.19k| #define UINT16_TO_LE(n) (n) ------------------ 53| 2.19k| OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 2.19k|#define PARAMS_N 976 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 2.19k|#define PARAMS_N 976 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 2.19k|#define PARAMS_N 976 ------------------ 54| 2.19k| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 2.19k|#define PARAMS_N 976 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 2.19k|#define BYTES_SEED_A 16 ------------------ 55| 2.19k|#endif /* USE_AES128_FOR_A */ 56| 8.57M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 8.57M|#define PARAMS_N 976 ------------------ | Branch (56:21): [True: 8.57M, False: 2.19k] ------------------ 57| 8.57M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 8.57M| #define LE_TO_UINT16(n) (n) ------------------ 58| 8.57M| } 59| 19.7k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 19.7k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 17.5k, False: 2.19k] ------------------ 60| 17.5k| uint16_t sum[4] = {0}; 61| 17.1M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 17.1M|#define PARAMS_N 976 ------------------ | Branch (61:25): [True: 17.1M, False: 17.5k] ------------------ 62| 17.1M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 17.1M|#define PARAMS_N 976 ------------------ 63| 17.1M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 17.1M|#define PARAMS_N 976 ------------------ 64| 17.1M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 17.1M|#define PARAMS_N 976 ------------------ 65| 17.1M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 17.1M|#define PARAMS_N 976 ------------------ 66| 17.1M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 17.1M|#define PARAMS_N 976 ------------------ 67| 17.1M| } 68| 17.5k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 17.5k|#define PARAMS_NBAR 8 ------------------ 69| 17.5k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 17.5k|#define PARAMS_NBAR 8 ------------------ 70| 17.5k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 17.5k|#define PARAMS_NBAR 8 ------------------ 71| 17.5k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 17.5k|#define PARAMS_NBAR 8 ------------------ 72| 17.5k| } 73| 2.19k| } 74| | 75| |#if defined(USE_AES128_FOR_A) 76| | OQS_AES128_free_schedule(aes_key_schedule); 77| |#endif 78| 9| return 1; 79| 9|} oqs_kem_frodokem_1344_shake_mul_add_as_plus_e_avx2: 4| 6|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 6| int i, j, k; 8| 6| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 32.2k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 32.2k|#define PARAMS_N 1344 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 32.2k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 32.2k, False: 6] ------------------ 11| 32.2k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 32.2k| } 13| | 14| |#if defined(USE_AES128_FOR_A) 15| | int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| | uint8_t *aes_key_schedule; 17| | OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { 20| | a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order 21| | a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); 22| | a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); 23| | a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); 24| | } 25| | 26| | for (i = 0; i < PARAMS_N; i += 4) { 27| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time 28| | a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order 29| | a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); 30| | a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); 31| | a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); 32| | } 33| | 34| | OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| 6| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| 6| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| 6| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| 6| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| 6| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| 6| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| 6| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| 6| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ 45| 6| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ 46| 6| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ 47| 6| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ 48| 2.02k| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 2.02k|#define PARAMS_N 1344 ------------------ | Branch (48:17): [True: 2.01k, False: 6] ------------------ 49| 2.01k| seed_A_origin_0[0] = UINT16_TO_LE(i + 0); ------------------ | | 35| 2.01k| #define UINT16_TO_LE(n) (n) ------------------ 50| 2.01k| seed_A_origin_1[0] = UINT16_TO_LE(i + 1); ------------------ | | 35| 2.01k| #define UINT16_TO_LE(n) (n) ------------------ 51| 2.01k| seed_A_origin_2[0] = UINT16_TO_LE(i + 2); ------------------ | | 35| 2.01k| #define UINT16_TO_LE(n) (n) ------------------ 52| 2.01k| seed_A_origin_3[0] = UINT16_TO_LE(i + 3); ------------------ | | 35| 2.01k| #define UINT16_TO_LE(n) (n) ------------------ 53| 2.01k| OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 2.01k|#define PARAMS_N 1344 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 2.01k|#define PARAMS_N 1344 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 2.01k|#define PARAMS_N 1344 ------------------ 54| 2.01k| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 2.01k|#define PARAMS_N 1344 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 2.01k|#define BYTES_SEED_A 16 ------------------ 55| 2.01k|#endif /* USE_AES128_FOR_A */ 56| 10.8M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 10.8M|#define PARAMS_N 1344 ------------------ | Branch (56:21): [True: 10.8M, False: 2.01k] ------------------ 57| 10.8M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 10.8M| #define LE_TO_UINT16(n) (n) ------------------ 58| 10.8M| } 59| 18.1k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 18.1k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 16.1k, False: 2.01k] ------------------ 60| 16.1k| uint16_t sum[4] = {0}; 61| 21.6M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 21.6M|#define PARAMS_N 1344 ------------------ | Branch (61:25): [True: 21.6M, False: 16.1k] ------------------ 62| 21.6M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 21.6M|#define PARAMS_N 1344 ------------------ 63| 21.6M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 21.6M|#define PARAMS_N 1344 ------------------ 64| 21.6M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 21.6M|#define PARAMS_N 1344 ------------------ 65| 21.6M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 21.6M|#define PARAMS_N 1344 ------------------ 66| 21.6M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 21.6M|#define PARAMS_N 1344 ------------------ 67| 21.6M| } 68| 16.1k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 16.1k|#define PARAMS_NBAR 8 ------------------ 69| 16.1k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 16.1k|#define PARAMS_NBAR 8 ------------------ 70| 16.1k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 16.1k|#define PARAMS_NBAR 8 ------------------ 71| 16.1k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 16.1k|#define PARAMS_NBAR 8 ------------------ 72| 16.1k| } 73| 2.01k| } 74| | 75| |#if defined(USE_AES128_FOR_A) 76| | OQS_AES128_free_schedule(aes_key_schedule); 77| |#endif 78| 6| return 1; 79| 6|} oqs_kem_efrodokem_640_aes_mul_add_as_plus_e_avx2: 4| 4|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 4| int i, j, k; 8| 4| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 10.2k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 10.2k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 10.2k, False: 4] ------------------ 11| 10.2k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 10.2k| } 13| | 14| 4|#if defined(USE_AES128_FOR_A) 15| 4| int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| 4| uint8_t *aes_key_schedule; 17| 4| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| 324| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 324|#define PARAMS_N 640 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 320|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (19:17): [True: 320, False: 4] ------------------ 20| 320| a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 11| 320|#define PARAMS_N 640 ------------------ a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 35| 320| #define UINT16_TO_LE(n) (n) ------------------ 21| 320| a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 320|#define PARAMS_N 640 ------------------ a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 320| #define UINT16_TO_LE(n) (n) ------------------ 22| 320| a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 320|#define PARAMS_N 640 ------------------ a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 320| #define UINT16_TO_LE(n) (n) ------------------ 23| 320| a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 320|#define PARAMS_N 640 ------------------ a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 320| #define UINT16_TO_LE(n) (n) ------------------ 24| 320| } 25| | 26| 644| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 644|#define PARAMS_N 640 ------------------ | Branch (26:17): [True: 640, False: 4] ------------------ 27| 51.8k| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 11| 51.8k|#define PARAMS_N 640 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 16| 51.2k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (27:21): [True: 51.2k, False: 640] ------------------ 28| 51.2k| a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 11| 51.2k|#define PARAMS_N 640 ------------------ a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 35| 51.2k| #define UINT16_TO_LE(n) (n) ------------------ 29| 51.2k| a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 11| 51.2k|#define PARAMS_N 640 ------------------ a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 35| 51.2k| #define UINT16_TO_LE(n) (n) ------------------ 30| 51.2k| a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 11| 51.2k|#define PARAMS_N 640 ------------------ a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 35| 51.2k| #define UINT16_TO_LE(n) (n) ------------------ 31| 51.2k| a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 11| 51.2k|#define PARAMS_N 640 ------------------ a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 35| 51.2k| #define UINT16_TO_LE(n) (n) ------------------ 32| 51.2k| } 33| | 34| 640| OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); ------------------ | | 11| 640|#define PARAMS_N 640 ------------------ 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| | uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| | uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| | uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| | uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| | uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| | uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| | uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| | memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); 45| | memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); 46| | memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); 47| | memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); 48| | for (i = 0; i < PARAMS_N; i += 4) { 49| | seed_A_origin_0[0] = UINT16_TO_LE(i + 0); 50| | seed_A_origin_1[0] = UINT16_TO_LE(i + 1); 51| | seed_A_origin_2[0] = UINT16_TO_LE(i + 2); 52| | seed_A_origin_3[0] = UINT16_TO_LE(i + 3); 53| | OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), 54| | (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); 55| |#endif /* USE_AES128_FOR_A */ 56| 1.63M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ | Branch (56:21): [True: 1.63M, False: 640] ------------------ 57| 1.63M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 1.63M| #define LE_TO_UINT16(n) (n) ------------------ 58| 1.63M| } 59| 5.76k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 5.76k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 5.12k, False: 640] ------------------ 60| 5.12k| uint16_t sum[4] = {0}; 61| 3.28M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 3.28M|#define PARAMS_N 640 ------------------ | Branch (61:25): [True: 3.27M, False: 5.12k] ------------------ 62| 3.27M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 3.27M|#define PARAMS_N 640 ------------------ 63| 3.27M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 3.27M|#define PARAMS_N 640 ------------------ 64| 3.27M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 3.27M|#define PARAMS_N 640 ------------------ 65| 3.27M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 3.27M|#define PARAMS_N 640 ------------------ 66| 3.27M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 3.27M|#define PARAMS_N 640 ------------------ 67| 3.27M| } 68| 5.12k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 5.12k|#define PARAMS_NBAR 8 ------------------ 69| 5.12k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 5.12k|#define PARAMS_NBAR 8 ------------------ 70| 5.12k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 5.12k|#define PARAMS_NBAR 8 ------------------ 71| 5.12k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 5.12k|#define PARAMS_NBAR 8 ------------------ 72| 5.12k| } 73| 640| } 74| | 75| 4|#if defined(USE_AES128_FOR_A) 76| 4| OQS_AES128_free_schedule(aes_key_schedule); 77| 4|#endif 78| 4| return 1; 79| 4|} oqs_kem_efrodokem_976_aes_mul_add_as_plus_e_avx2: 4| 9|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 9| int i, j, k; 8| 9| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 35.1k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 35.1k|#define PARAMS_N 976 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 35.1k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 35.1k, False: 9] ------------------ 11| 35.1k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 35.1k| } 13| | 14| 9|#if defined(USE_AES128_FOR_A) 15| 9| int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| 9| uint8_t *aes_key_schedule; 17| 9| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| 1.10k| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 1.10k|#define PARAMS_N 976 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 1.09k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (19:17): [True: 1.09k, False: 9] ------------------ 20| 1.09k| a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 11| 1.09k|#define PARAMS_N 976 ------------------ a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 35| 1.09k| #define UINT16_TO_LE(n) (n) ------------------ 21| 1.09k| a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.09k|#define PARAMS_N 976 ------------------ a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.09k| #define UINT16_TO_LE(n) (n) ------------------ 22| 1.09k| a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.09k|#define PARAMS_N 976 ------------------ a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.09k| #define UINT16_TO_LE(n) (n) ------------------ 23| 1.09k| a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.09k|#define PARAMS_N 976 ------------------ a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.09k| #define UINT16_TO_LE(n) (n) ------------------ 24| 1.09k| } 25| | 26| 2.20k| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 2.20k|#define PARAMS_N 976 ------------------ | Branch (26:17): [True: 2.19k, False: 9] ------------------ 27| 270k| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 11| 270k|#define PARAMS_N 976 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 16| 267k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (27:21): [True: 267k, False: 2.19k] ------------------ 28| 267k| a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 11| 267k|#define PARAMS_N 976 ------------------ a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 35| 267k| #define UINT16_TO_LE(n) (n) ------------------ 29| 267k| a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 11| 267k|#define PARAMS_N 976 ------------------ a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 35| 267k| #define UINT16_TO_LE(n) (n) ------------------ 30| 267k| a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 11| 267k|#define PARAMS_N 976 ------------------ a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 35| 267k| #define UINT16_TO_LE(n) (n) ------------------ 31| 267k| a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 11| 267k|#define PARAMS_N 976 ------------------ a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 35| 267k| #define UINT16_TO_LE(n) (n) ------------------ 32| 267k| } 33| | 34| 2.19k| OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); ------------------ | | 11| 2.19k|#define PARAMS_N 976 ------------------ 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| | uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| | uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| | uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| | uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| | uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| | uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| | uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| | memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); 45| | memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); 46| | memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); 47| | memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); 48| | for (i = 0; i < PARAMS_N; i += 4) { 49| | seed_A_origin_0[0] = UINT16_TO_LE(i + 0); 50| | seed_A_origin_1[0] = UINT16_TO_LE(i + 1); 51| | seed_A_origin_2[0] = UINT16_TO_LE(i + 2); 52| | seed_A_origin_3[0] = UINT16_TO_LE(i + 3); 53| | OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), 54| | (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); 55| |#endif /* USE_AES128_FOR_A */ 56| 8.57M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 8.57M|#define PARAMS_N 976 ------------------ | Branch (56:21): [True: 8.57M, False: 2.19k] ------------------ 57| 8.57M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 8.57M| #define LE_TO_UINT16(n) (n) ------------------ 58| 8.57M| } 59| 19.7k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 19.7k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 17.5k, False: 2.19k] ------------------ 60| 17.5k| uint16_t sum[4] = {0}; 61| 17.1M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 17.1M|#define PARAMS_N 976 ------------------ | Branch (61:25): [True: 17.1M, False: 17.5k] ------------------ 62| 17.1M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 17.1M|#define PARAMS_N 976 ------------------ 63| 17.1M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 17.1M|#define PARAMS_N 976 ------------------ 64| 17.1M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 17.1M|#define PARAMS_N 976 ------------------ 65| 17.1M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 17.1M|#define PARAMS_N 976 ------------------ 66| 17.1M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 17.1M|#define PARAMS_N 976 ------------------ 67| 17.1M| } 68| 17.5k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 17.5k|#define PARAMS_NBAR 8 ------------------ 69| 17.5k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 17.5k|#define PARAMS_NBAR 8 ------------------ 70| 17.5k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 17.5k|#define PARAMS_NBAR 8 ------------------ 71| 17.5k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 17.5k|#define PARAMS_NBAR 8 ------------------ 72| 17.5k| } 73| 2.19k| } 74| | 75| 9|#if defined(USE_AES128_FOR_A) 76| 9| OQS_AES128_free_schedule(aes_key_schedule); 77| 9|#endif 78| 9| return 1; 79| 9|} oqs_kem_efrodokem_1344_aes_mul_add_as_plus_e_avx2: 4| 9|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 9| int i, j, k; 8| 9| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 48.3k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 48.3k|#define PARAMS_N 1344 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 48.3k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 48.3k, False: 9] ------------------ 11| 48.3k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 48.3k| } 13| | 14| 9|#if defined(USE_AES128_FOR_A) 15| 9| int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| 9| uint8_t *aes_key_schedule; 17| 9| OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| 1.52k| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 11| 1.52k|#define PARAMS_N 1344 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { ------------------ | | 16| 1.51k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (19:17): [True: 1.51k, False: 9] ------------------ 20| 1.51k| a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 11| 1.51k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order ------------------ | | 35| 1.51k| #define UINT16_TO_LE(n) (n) ------------------ 21| 1.51k| a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.51k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.51k| #define UINT16_TO_LE(n) (n) ------------------ 22| 1.51k| a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.51k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.51k| #define UINT16_TO_LE(n) (n) ------------------ 23| 1.51k| a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 11| 1.51k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); ------------------ | | 35| 1.51k| #define UINT16_TO_LE(n) (n) ------------------ 24| 1.51k| } 25| | 26| 3.03k| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 3.03k|#define PARAMS_N 1344 ------------------ | Branch (26:17): [True: 3.02k, False: 9] ------------------ 27| 511k| for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 11| 511k|#define PARAMS_N 1344 ------------------ for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time ------------------ | | 16| 508k|#define PARAMS_STRIPE_STEP 8 ------------------ | Branch (27:21): [True: 508k, False: 3.02k] ------------------ 28| 508k| a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 11| 508k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order ------------------ | | 35| 508k| #define UINT16_TO_LE(n) (n) ------------------ 29| 508k| a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 11| 508k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); ------------------ | | 35| 508k| #define UINT16_TO_LE(n) (n) ------------------ 30| 508k| a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 11| 508k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); ------------------ | | 35| 508k| #define UINT16_TO_LE(n) (n) ------------------ 31| 508k| a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 11| 508k|#define PARAMS_N 1344 ------------------ a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); ------------------ | | 35| 508k| #define UINT16_TO_LE(n) (n) ------------------ 32| 508k| } 33| | 34| 3.02k| OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); ------------------ | | 11| 3.02k|#define PARAMS_N 1344 ------------------ 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| | uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| | uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| | uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| | uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| | uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| | uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| | uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| | memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); 45| | memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); 46| | memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); 47| | memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); 48| | for (i = 0; i < PARAMS_N; i += 4) { 49| | seed_A_origin_0[0] = UINT16_TO_LE(i + 0); 50| | seed_A_origin_1[0] = UINT16_TO_LE(i + 1); 51| | seed_A_origin_2[0] = UINT16_TO_LE(i + 2); 52| | seed_A_origin_3[0] = UINT16_TO_LE(i + 3); 53| | OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), 54| | (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); 55| |#endif /* USE_AES128_FOR_A */ 56| 16.2M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 16.2M|#define PARAMS_N 1344 ------------------ | Branch (56:21): [True: 16.2M, False: 3.02k] ------------------ 57| 16.2M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 16.2M| #define LE_TO_UINT16(n) (n) ------------------ 58| 16.2M| } 59| 27.2k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 27.2k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 24.1k, False: 3.02k] ------------------ 60| 24.1k| uint16_t sum[4] = {0}; 61| 32.5M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 32.5M|#define PARAMS_N 1344 ------------------ | Branch (61:25): [True: 32.5M, False: 24.1k] ------------------ 62| 32.5M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 32.5M|#define PARAMS_N 1344 ------------------ 63| 32.5M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 32.5M|#define PARAMS_N 1344 ------------------ 64| 32.5M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 32.5M|#define PARAMS_N 1344 ------------------ 65| 32.5M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 32.5M|#define PARAMS_N 1344 ------------------ 66| 32.5M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 32.5M|#define PARAMS_N 1344 ------------------ 67| 32.5M| } 68| 24.1k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 24.1k|#define PARAMS_NBAR 8 ------------------ 69| 24.1k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 24.1k|#define PARAMS_NBAR 8 ------------------ 70| 24.1k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 24.1k|#define PARAMS_NBAR 8 ------------------ 71| 24.1k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 24.1k|#define PARAMS_NBAR 8 ------------------ 72| 24.1k| } 73| 3.02k| } 74| | 75| 9|#if defined(USE_AES128_FOR_A) 76| 9| OQS_AES128_free_schedule(aes_key_schedule); 77| 9|#endif 78| 9| return 1; 79| 9|} oqs_kem_efrodokem_640_shake_mul_add_as_plus_e_avx2: 4| 2|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 2| int i, j, k; 8| 2| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 5.12k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 5.12k|#define PARAMS_N 640 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 5.12k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 5.12k, False: 2] ------------------ 11| 5.12k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 5.12k| } 13| | 14| |#if defined(USE_AES128_FOR_A) 15| | int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| | uint8_t *aes_key_schedule; 17| | OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { 20| | a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order 21| | a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); 22| | a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); 23| | a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); 24| | } 25| | 26| | for (i = 0; i < PARAMS_N; i += 4) { 27| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time 28| | a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order 29| | a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); 30| | a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); 31| | a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); 32| | } 33| | 34| | OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| 2| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| 2| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| 2| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| 2| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| 2| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| 2| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| 2| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| 2| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 45| 2| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 46| 2| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 47| 2| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 2|#define BYTES_SEED_A 16 ------------------ 48| 322| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 322|#define PARAMS_N 640 ------------------ | Branch (48:17): [True: 320, False: 2] ------------------ 49| 320| seed_A_origin_0[0] = UINT16_TO_LE(i + 0); ------------------ | | 35| 320| #define UINT16_TO_LE(n) (n) ------------------ 50| 320| seed_A_origin_1[0] = UINT16_TO_LE(i + 1); ------------------ | | 35| 320| #define UINT16_TO_LE(n) (n) ------------------ 51| 320| seed_A_origin_2[0] = UINT16_TO_LE(i + 2); ------------------ | | 35| 320| #define UINT16_TO_LE(n) (n) ------------------ 52| 320| seed_A_origin_3[0] = UINT16_TO_LE(i + 3); ------------------ | | 35| 320| #define UINT16_TO_LE(n) (n) ------------------ 53| 320| OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 320|#define PARAMS_N 640 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 320|#define PARAMS_N 640 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 320|#define PARAMS_N 640 ------------------ 54| 320| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 320|#define PARAMS_N 640 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 320|#define BYTES_SEED_A 16 ------------------ 55| 320|#endif /* USE_AES128_FOR_A */ 56| 819k| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 819k|#define PARAMS_N 640 ------------------ | Branch (56:21): [True: 819k, False: 320] ------------------ 57| 819k| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 819k| #define LE_TO_UINT16(n) (n) ------------------ 58| 819k| } 59| 2.88k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 2.88k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 2.56k, False: 320] ------------------ 60| 2.56k| uint16_t sum[4] = {0}; 61| 1.64M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 1.64M|#define PARAMS_N 640 ------------------ | Branch (61:25): [True: 1.63M, False: 2.56k] ------------------ 62| 1.63M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ 63| 1.63M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ 64| 1.63M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ 65| 1.63M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ 66| 1.63M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 1.63M|#define PARAMS_N 640 ------------------ 67| 1.63M| } 68| 2.56k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 2.56k|#define PARAMS_NBAR 8 ------------------ 69| 2.56k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 2.56k|#define PARAMS_NBAR 8 ------------------ 70| 2.56k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 2.56k|#define PARAMS_NBAR 8 ------------------ 71| 2.56k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 2.56k|#define PARAMS_NBAR 8 ------------------ 72| 2.56k| } 73| 320| } 74| | 75| |#if defined(USE_AES128_FOR_A) 76| | OQS_AES128_free_schedule(aes_key_schedule); 77| |#endif 78| 2| return 1; 79| 2|} oqs_kem_efrodokem_976_shake_mul_add_as_plus_e_avx2: 4| 8|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 8| int i, j, k; 8| 8| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 31.2k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 31.2k|#define PARAMS_N 976 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 31.2k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 31.2k, False: 8] ------------------ 11| 31.2k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 31.2k| } 13| | 14| |#if defined(USE_AES128_FOR_A) 15| | int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| | uint8_t *aes_key_schedule; 17| | OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { 20| | a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order 21| | a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); 22| | a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); 23| | a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); 24| | } 25| | 26| | for (i = 0; i < PARAMS_N; i += 4) { 27| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time 28| | a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order 29| | a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); 30| | a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); 31| | a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); 32| | } 33| | 34| | OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| 8| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| 8| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| 8| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| 8| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| 8| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| 8| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| 8| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| 8| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 45| 8| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 46| 8| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 47| 8| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 8|#define BYTES_SEED_A 16 ------------------ 48| 1.96k| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 1.96k|#define PARAMS_N 976 ------------------ | Branch (48:17): [True: 1.95k, False: 8] ------------------ 49| 1.95k| seed_A_origin_0[0] = UINT16_TO_LE(i + 0); ------------------ | | 35| 1.95k| #define UINT16_TO_LE(n) (n) ------------------ 50| 1.95k| seed_A_origin_1[0] = UINT16_TO_LE(i + 1); ------------------ | | 35| 1.95k| #define UINT16_TO_LE(n) (n) ------------------ 51| 1.95k| seed_A_origin_2[0] = UINT16_TO_LE(i + 2); ------------------ | | 35| 1.95k| #define UINT16_TO_LE(n) (n) ------------------ 52| 1.95k| seed_A_origin_3[0] = UINT16_TO_LE(i + 3); ------------------ | | 35| 1.95k| #define UINT16_TO_LE(n) (n) ------------------ 53| 1.95k| OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 1.95k|#define PARAMS_N 976 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 1.95k|#define PARAMS_N 976 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 1.95k|#define PARAMS_N 976 ------------------ 54| 1.95k| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 1.95k|#define PARAMS_N 976 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 1.95k|#define BYTES_SEED_A 16 ------------------ 55| 1.95k|#endif /* USE_AES128_FOR_A */ 56| 7.62M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 7.62M|#define PARAMS_N 976 ------------------ | Branch (56:21): [True: 7.62M, False: 1.95k] ------------------ 57| 7.62M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 7.62M| #define LE_TO_UINT16(n) (n) ------------------ 58| 7.62M| } 59| 17.5k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 17.5k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 15.6k, False: 1.95k] ------------------ 60| 15.6k| uint16_t sum[4] = {0}; 61| 15.2M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 15.2M|#define PARAMS_N 976 ------------------ | Branch (61:25): [True: 15.2M, False: 15.6k] ------------------ 62| 15.2M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 15.2M|#define PARAMS_N 976 ------------------ 63| 15.2M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 15.2M|#define PARAMS_N 976 ------------------ 64| 15.2M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 15.2M|#define PARAMS_N 976 ------------------ 65| 15.2M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 15.2M|#define PARAMS_N 976 ------------------ 66| 15.2M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 15.2M|#define PARAMS_N 976 ------------------ 67| 15.2M| } 68| 15.6k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 15.6k|#define PARAMS_NBAR 8 ------------------ 69| 15.6k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 15.6k|#define PARAMS_NBAR 8 ------------------ 70| 15.6k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 15.6k|#define PARAMS_NBAR 8 ------------------ 71| 15.6k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 15.6k|#define PARAMS_NBAR 8 ------------------ 72| 15.6k| } 73| 1.95k| } 74| | 75| |#if defined(USE_AES128_FOR_A) 76| | OQS_AES128_free_schedule(aes_key_schedule); 77| |#endif 78| 8| return 1; 79| 8|} oqs_kem_efrodokem_1344_shake_mul_add_as_plus_e_avx2: 4| 7|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 5| | // Inputs: s, e (N x N_BAR) 6| | // Output: out = A*s + e (N x N_BAR) 7| 7| int i, j, k; 8| 7| ALIGN_HEADER(32) int16_t a_row[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 9| | 10| 37.6k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 37.6k|#define PARAMS_N 1344 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 37.6k|#define PARAMS_NBAR 8 ------------------ | Branch (10:17): [True: 37.6k, False: 7] ------------------ 11| 37.6k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 12| 37.6k| } 13| | 14| |#if defined(USE_AES128_FOR_A) 15| | int16_t a_row_temp[4*PARAMS_N] = {0}; // Take four lines of A at once 16| | uint8_t *aes_key_schedule; 17| | OQS_AES128_ECB_load_schedule(seed_A, (void **) &aes_key_schedule); 18| | 19| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { 20| | a_row_temp[j + 1 + 0*PARAMS_N] = UINT16_TO_LE(j); // Loading values in the little-endian order 21| | a_row_temp[j + 1 + 1*PARAMS_N] = UINT16_TO_LE(j); 22| | a_row_temp[j + 1 + 2*PARAMS_N] = UINT16_TO_LE(j); 23| | a_row_temp[j + 1 + 3*PARAMS_N] = UINT16_TO_LE(j); 24| | } 25| | 26| | for (i = 0; i < PARAMS_N; i += 4) { 27| | for (j = 0; j < PARAMS_N; j += PARAMS_STRIPE_STEP) { // Go through A, four rows at a time 28| | a_row_temp[j + 0*PARAMS_N] = UINT16_TO_LE(i+0); // Loading values in the little-endian order 29| | a_row_temp[j + 1*PARAMS_N] = UINT16_TO_LE(i+1); 30| | a_row_temp[j + 2*PARAMS_N] = UINT16_TO_LE(i+2); 31| | a_row_temp[j + 3*PARAMS_N] = UINT16_TO_LE(i+3); 32| | } 33| | 34| | OQS_AES128_ECB_enc_sch((uint8_t*)a_row_temp, 4*PARAMS_N*sizeof(int16_t), aes_key_schedule, (uint8_t*)a_row); 35| |#elif defined (USE_SHAKE128_FOR_A) 36| | uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 37| 7| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 38| 7| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 39| 7| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 40| 7| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 41| 7| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 42| 7| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 43| 7| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 44| 7| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 7|#define BYTES_SEED_A 16 ------------------ 45| 7| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 7|#define BYTES_SEED_A 16 ------------------ 46| 7| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 7|#define BYTES_SEED_A 16 ------------------ 47| 7| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 7|#define BYTES_SEED_A 16 ------------------ 48| 2.35k| for (i = 0; i < PARAMS_N; i += 4) { ------------------ | | 11| 2.35k|#define PARAMS_N 1344 ------------------ | Branch (48:17): [True: 2.35k, False: 7] ------------------ 49| 2.35k| seed_A_origin_0[0] = UINT16_TO_LE(i + 0); ------------------ | | 35| 2.35k| #define UINT16_TO_LE(n) (n) ------------------ 50| 2.35k| seed_A_origin_1[0] = UINT16_TO_LE(i + 1); ------------------ | | 35| 2.35k| #define UINT16_TO_LE(n) (n) ------------------ 51| 2.35k| seed_A_origin_2[0] = UINT16_TO_LE(i + 2); ------------------ | | 35| 2.35k| #define UINT16_TO_LE(n) (n) ------------------ 52| 2.35k| seed_A_origin_3[0] = UINT16_TO_LE(i + 3); ------------------ | | 35| 2.35k| #define UINT16_TO_LE(n) (n) ------------------ 53| 2.35k| OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 2.35k|#define PARAMS_N 1344 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 2.35k|#define PARAMS_N 1344 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_row), (unsigned char*)(a_row + PARAMS_N), (unsigned char*)(a_row + 2*PARAMS_N), (unsigned char*)(a_row + 3*PARAMS_N), ------------------ | | 11| 2.35k|#define PARAMS_N 1344 ------------------ 54| 2.35k| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 2.35k|#define PARAMS_N 1344 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 2.35k|#define BYTES_SEED_A 16 ------------------ 55| 2.35k|#endif /* USE_AES128_FOR_A */ 56| 12.6M| for (k = 0; k < 4 * PARAMS_N; k++) { ------------------ | | 11| 12.6M|#define PARAMS_N 1344 ------------------ | Branch (56:21): [True: 12.6M, False: 2.35k] ------------------ 57| 12.6M| a_row[k] = LE_TO_UINT16(a_row[k]); ------------------ | | 34| 12.6M| #define LE_TO_UINT16(n) (n) ------------------ 58| 12.6M| } 59| 21.1k| for (k = 0; k < PARAMS_NBAR; k++) { ------------------ | | 12| 21.1k|#define PARAMS_NBAR 8 ------------------ | Branch (59:21): [True: 18.8k, False: 2.35k] ------------------ 60| 18.8k| uint16_t sum[4] = {0}; 61| 25.3M| for (j = 0; j < PARAMS_N; j++) { // Matrix-vector multiplication ------------------ | | 11| 25.3M|#define PARAMS_N 1344 ------------------ | Branch (61:25): [True: 25.2M, False: 18.8k] ------------------ 62| 25.2M| uint16_t sp = s[k*PARAMS_N + j]; ------------------ | | 11| 25.2M|#define PARAMS_N 1344 ------------------ 63| 25.2M| sum[0] += a_row[0*PARAMS_N + j] * sp; // Go through four lines with same s ------------------ | | 11| 25.2M|#define PARAMS_N 1344 ------------------ 64| 25.2M| sum[1] += a_row[1*PARAMS_N + j] * sp; ------------------ | | 11| 25.2M|#define PARAMS_N 1344 ------------------ 65| 25.2M| sum[2] += a_row[2*PARAMS_N + j] * sp; ------------------ | | 11| 25.2M|#define PARAMS_N 1344 ------------------ 66| 25.2M| sum[3] += a_row[3*PARAMS_N + j] * sp; ------------------ | | 11| 25.2M|#define PARAMS_N 1344 ------------------ 67| 25.2M| } 68| 18.8k| out[(i+0)*PARAMS_NBAR + k] += sum[0]; ------------------ | | 12| 18.8k|#define PARAMS_NBAR 8 ------------------ 69| 18.8k| out[(i+2)*PARAMS_NBAR + k] += sum[2]; ------------------ | | 12| 18.8k|#define PARAMS_NBAR 8 ------------------ 70| 18.8k| out[(i+1)*PARAMS_NBAR + k] += sum[1]; ------------------ | | 12| 18.8k|#define PARAMS_NBAR 8 ------------------ 71| 18.8k| out[(i+3)*PARAMS_NBAR + k] += sum[3]; ------------------ | | 12| 18.8k|#define PARAMS_NBAR 8 ------------------ 72| 18.8k| } 73| 2.35k| } 74| | 75| |#if defined(USE_AES128_FOR_A) 76| | OQS_AES128_free_schedule(aes_key_schedule); 77| |#endif 78| 7| return 1; 79| 7|} oqs_kem_frodokem_640_aes_mul_add_as_plus_e: 27| 2|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 2|#if defined(OQS_DIST_X86_64_BUILD) 31| 2| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 2, False: 0] ------------------ 32| 2| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 48| 2|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_frodokem_640_aes_mul_add_as_plus_e_avx2 ------------------ 33| 2| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 47| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_frodokem_640_aes_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 2|} oqs_kem_frodokem_640_aes_mul_add_sa_plus_e: 44| 4|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| 4|#if defined(USE_AES128_FOR_A) 48| 4| #if defined(OQS_DIST_X86_64_BUILD) 49| 4| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (49:9): [True: 4, False: 0] ------------------ 50| 4| return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); ------------------ | | 51| 4|#define frodo_mul_add_sa_plus_e_aes_avx2 oqs_kem_frodokem_640_aes_mul_add_sa_plus_e_avx2 ------------------ 51| 4| } else { 52| 0| return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); ------------------ | | 50| 0|#define frodo_mul_add_sa_plus_e_aes_portable oqs_kem_frodokem_640_aes_mul_add_sa_plus_e_portable ------------------ 53| 0| } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 62| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 63| | } else { 64| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 65| | } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| |#endif 72| 4|} oqs_kem_frodokem_640_aes_mul_bs: 75| 2|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 2| int i, j, k; 79| | 80| 18| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 18|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 16, False: 2] ------------------ 81| 144| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 144|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 128, False: 16] ------------------ 82| 128| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 128|#define PARAMS_NBAR 8 ------------------ 83| 82.0k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 82.0k|#define PARAMS_N 640 ------------------ | Branch (83:25): [True: 81.9k, False: 128] ------------------ 84| 81.9k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 81.9k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 81.9k|#define PARAMS_N 640 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 81.9k|#define PARAMS_N 640 ------------------ 85| 81.9k| } 86| 128| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 256|#define PARAMS_EXTRACTED_BITS 2 ------------------ 147| 256| pos++; 148| 256| } 149| 32| } 150| 4|} oqs_kem_frodokem_640_aes_key_decode: 154| 2|{ // Decoding 155| 2| unsigned int i, j, index = 0, npieces_word = 8; 156| 2| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 157| 2| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 158| 2| uint8_t *pos = (uint8_t*)out; 159| 2| uint64_t templong; 160| | 161| 18| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 16, False: 2] ------------------ 162| 16| templong = 0; 163| 144| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 128, False: 16] ------------------ 164| 128| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 128|#define PARAMS_LOGQ 15 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 128|#define PARAMS_EXTRACTED_BITS 2 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 128|#define PARAMS_LOGQ 15 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 128|#define PARAMS_EXTRACTED_BITS 2 ------------------ 165| 128| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 128|#define PARAMS_EXTRACTED_BITS 2 ------------------ 166| 128| index++; 167| 128| } 168| 48| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 48|#define PARAMS_EXTRACTED_BITS 2 ------------------ | Branch (168:21): [True: 32, False: 16] ------------------ 169| 32| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 32|#define PARAMS_EXTRACTED_BITS 2 ------------------ 170| 32| } 171| 16| } 172| 2|} oqs_kem_frodokem_640_shake_mul_add_as_plus_e: 27| 3|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 3|#if defined(OQS_DIST_X86_64_BUILD) 31| 3| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 3, False: 0] ------------------ 32| 3| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 48| 3|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_frodokem_640_shake_mul_add_as_plus_e_avx2 ------------------ 33| 3| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 47| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_frodokem_640_shake_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 3|} oqs_kem_frodokem_640_shake_mul_add_sa_plus_e: 44| 6|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| |#if defined(USE_AES128_FOR_A) 48| | #if defined(OQS_DIST_X86_64_BUILD) 49| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 50| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 51| | } else { 52| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 53| | } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| 6| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (61:9): [True: 6, False: 0] ------------------ 62| 6| return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); ------------------ | | 51| 6|#define frodo_mul_add_sa_plus_e_shake_avx2 oqs_kem_frodokem_640_shake_mul_add_sa_plus_e_avx2 ------------------ 63| 6| } else { 64| 0| return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); ------------------ | | 50| 0|#define frodo_mul_add_sa_plus_e_shake_portable oqs_kem_frodokem_640_shake_mul_add_sa_plus_e_portable ------------------ 65| 0| } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| 6|#endif 72| 6|} oqs_kem_frodokem_640_shake_mul_bs: 75| 3|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 3| int i, j, k; 79| | 80| 27| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 27|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 24, False: 3] ------------------ 81| 216| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 216|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 192, False: 24] ------------------ 82| 192| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 192|#define PARAMS_NBAR 8 ------------------ 83| 123k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 123k|#define PARAMS_N 640 ------------------ | Branch (83:25): [True: 122k, False: 192] ------------------ 84| 122k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 122k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 122k|#define PARAMS_N 640 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 122k|#define PARAMS_N 640 ------------------ 85| 122k| } 86| 192| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 384|#define PARAMS_EXTRACTED_BITS 2 ------------------ 147| 384| pos++; 148| 384| } 149| 48| } 150| 6|} oqs_kem_frodokem_640_shake_key_decode: 154| 3|{ // Decoding 155| 3| unsigned int i, j, index = 0, npieces_word = 8; 156| 3| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 3|#define PARAMS_NBAR 8 ------------------ 157| 3| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 3|#define PARAMS_EXTRACTED_BITS 2 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 3|#define PARAMS_LOGQ 15 ------------------ 158| 3| uint8_t *pos = (uint8_t*)out; 159| 3| uint64_t templong; 160| | 161| 27| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 24, False: 3] ------------------ 162| 24| templong = 0; 163| 216| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 192, False: 24] ------------------ 164| 192| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 192|#define PARAMS_LOGQ 15 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 192|#define PARAMS_EXTRACTED_BITS 2 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 192|#define PARAMS_LOGQ 15 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 192|#define PARAMS_EXTRACTED_BITS 2 ------------------ 165| 192| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 192|#define PARAMS_EXTRACTED_BITS 2 ------------------ 166| 192| index++; 167| 192| } 168| 72| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 72|#define PARAMS_EXTRACTED_BITS 2 ------------------ | Branch (168:21): [True: 48, False: 24] ------------------ 169| 48| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 48|#define PARAMS_EXTRACTED_BITS 2 ------------------ 170| 48| } 171| 24| } 172| 3|} oqs_kem_frodokem_976_aes_mul_add_as_plus_e: 27| 9|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 9|#if defined(OQS_DIST_X86_64_BUILD) 31| 9| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 9, False: 0] ------------------ 32| 9| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 48| 9|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_frodokem_976_aes_mul_add_as_plus_e_avx2 ------------------ 33| 9| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 47| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_frodokem_976_aes_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 9|} oqs_kem_frodokem_976_aes_mul_add_sa_plus_e: 44| 18|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| 18|#if defined(USE_AES128_FOR_A) 48| 18| #if defined(OQS_DIST_X86_64_BUILD) 49| 18| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (49:9): [True: 18, False: 0] ------------------ 50| 18| return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); ------------------ | | 51| 18|#define frodo_mul_add_sa_plus_e_aes_avx2 oqs_kem_frodokem_976_aes_mul_add_sa_plus_e_avx2 ------------------ 51| 18| } else { 52| 0| return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); ------------------ | | 50| 0|#define frodo_mul_add_sa_plus_e_aes_portable oqs_kem_frodokem_976_aes_mul_add_sa_plus_e_portable ------------------ 53| 0| } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 62| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 63| | } else { 64| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 65| | } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| |#endif 72| 18|} oqs_kem_frodokem_976_aes_mul_bs: 75| 9|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 9| int i, j, k; 79| | 80| 81| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 81|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 72, False: 9] ------------------ 81| 648| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 648|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 576, False: 72] ------------------ 82| 576| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 576|#define PARAMS_NBAR 8 ------------------ 83| 562k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 562k|#define PARAMS_N 976 ------------------ | Branch (83:25): [True: 562k, False: 576] ------------------ 84| 562k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 562k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 562k|#define PARAMS_N 976 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 562k|#define PARAMS_N 976 ------------------ 85| 562k| } 86| 576| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 1.15k|#define PARAMS_EXTRACTED_BITS 3 ------------------ 147| 1.15k| pos++; 148| 1.15k| } 149| 144| } 150| 18|} oqs_kem_frodokem_976_aes_key_decode: 154| 9|{ // Decoding 155| 9| unsigned int i, j, index = 0, npieces_word = 8; 156| 9| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 157| 9| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 9|#define PARAMS_EXTRACTED_BITS 3 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 158| 9| uint8_t *pos = (uint8_t*)out; 159| 9| uint64_t templong; 160| | 161| 81| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 72, False: 9] ------------------ 162| 72| templong = 0; 163| 648| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 576, False: 72] ------------------ 164| 576| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 576|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 576|#define PARAMS_EXTRACTED_BITS 3 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 576|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 576|#define PARAMS_EXTRACTED_BITS 3 ------------------ 165| 576| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 576|#define PARAMS_EXTRACTED_BITS 3 ------------------ 166| 576| index++; 167| 576| } 168| 288| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 288|#define PARAMS_EXTRACTED_BITS 3 ------------------ | Branch (168:21): [True: 216, False: 72] ------------------ 169| 216| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 216|#define PARAMS_EXTRACTED_BITS 3 ------------------ 170| 216| } 171| 72| } 172| 9|} oqs_kem_frodokem_976_shake_mul_add_as_plus_e: 27| 9|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 9|#if defined(OQS_DIST_X86_64_BUILD) 31| 9| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 9, False: 0] ------------------ 32| 9| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 48| 9|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_frodokem_976_shake_mul_add_as_plus_e_avx2 ------------------ 33| 9| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 47| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_frodokem_976_shake_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 9|} oqs_kem_frodokem_976_shake_mul_add_sa_plus_e: 44| 18|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| |#if defined(USE_AES128_FOR_A) 48| | #if defined(OQS_DIST_X86_64_BUILD) 49| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 50| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 51| | } else { 52| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 53| | } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| 18| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (61:9): [True: 18, False: 0] ------------------ 62| 18| return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); ------------------ | | 51| 18|#define frodo_mul_add_sa_plus_e_shake_avx2 oqs_kem_frodokem_976_shake_mul_add_sa_plus_e_avx2 ------------------ 63| 18| } else { 64| 0| return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); ------------------ | | 50| 0|#define frodo_mul_add_sa_plus_e_shake_portable oqs_kem_frodokem_976_shake_mul_add_sa_plus_e_portable ------------------ 65| 0| } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| 18|#endif 72| 18|} oqs_kem_frodokem_976_shake_mul_bs: 75| 9|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 9| int i, j, k; 79| | 80| 81| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 81|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 72, False: 9] ------------------ 81| 648| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 648|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 576, False: 72] ------------------ 82| 576| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 576|#define PARAMS_NBAR 8 ------------------ 83| 562k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 562k|#define PARAMS_N 976 ------------------ | Branch (83:25): [True: 562k, False: 576] ------------------ 84| 562k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 562k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 562k|#define PARAMS_N 976 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 562k|#define PARAMS_N 976 ------------------ 85| 562k| } 86| 576| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 1.15k|#define PARAMS_EXTRACTED_BITS 3 ------------------ 147| 1.15k| pos++; 148| 1.15k| } 149| 144| } 150| 18|} oqs_kem_frodokem_976_shake_key_decode: 154| 9|{ // Decoding 155| 9| unsigned int i, j, index = 0, npieces_word = 8; 156| 9| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 157| 9| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 9|#define PARAMS_EXTRACTED_BITS 3 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 158| 9| uint8_t *pos = (uint8_t*)out; 159| 9| uint64_t templong; 160| | 161| 81| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 72, False: 9] ------------------ 162| 72| templong = 0; 163| 648| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 576, False: 72] ------------------ 164| 576| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 576|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 576|#define PARAMS_EXTRACTED_BITS 3 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 576|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 576|#define PARAMS_EXTRACTED_BITS 3 ------------------ 165| 576| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 576|#define PARAMS_EXTRACTED_BITS 3 ------------------ 166| 576| index++; 167| 576| } 168| 288| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 288|#define PARAMS_EXTRACTED_BITS 3 ------------------ | Branch (168:21): [True: 216, False: 72] ------------------ 169| 216| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 216|#define PARAMS_EXTRACTED_BITS 3 ------------------ 170| 216| } 171| 72| } 172| 9|} oqs_kem_frodokem_1344_aes_mul_add_as_plus_e: 27| 7|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 7|#if defined(OQS_DIST_X86_64_BUILD) 31| 7| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 7, False: 0] ------------------ 32| 7| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 48| 7|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_frodokem_1344_aes_mul_add_as_plus_e_avx2 ------------------ 33| 7| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 47| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_frodokem_1344_aes_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 7|} oqs_kem_frodokem_1344_aes_mul_add_sa_plus_e: 44| 14|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| 14|#if defined(USE_AES128_FOR_A) 48| 14| #if defined(OQS_DIST_X86_64_BUILD) 49| 14| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (49:9): [True: 14, False: 0] ------------------ 50| 14| return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); ------------------ | | 51| 14|#define frodo_mul_add_sa_plus_e_aes_avx2 oqs_kem_frodokem_1344_aes_mul_add_sa_plus_e_avx2 ------------------ 51| 14| } else { 52| 0| return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); ------------------ | | 50| 0|#define frodo_mul_add_sa_plus_e_aes_portable oqs_kem_frodokem_1344_aes_mul_add_sa_plus_e_portable ------------------ 53| 0| } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 62| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 63| | } else { 64| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 65| | } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| |#endif 72| 14|} oqs_kem_frodokem_1344_aes_mul_bs: 75| 7|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 7| int i, j, k; 79| | 80| 63| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 63|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 56, False: 7] ------------------ 81| 504| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 504|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 448, False: 56] ------------------ 82| 448| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 448|#define PARAMS_NBAR 8 ------------------ 83| 602k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 602k|#define PARAMS_N 1344 ------------------ | Branch (83:25): [True: 602k, False: 448] ------------------ 84| 602k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 602k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 602k|#define PARAMS_N 1344 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 602k|#define PARAMS_N 1344 ------------------ 85| 602k| } 86| 448| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 896|#define PARAMS_EXTRACTED_BITS 4 ------------------ 147| 896| pos++; 148| 896| } 149| 112| } 150| 14|} oqs_kem_frodokem_1344_aes_key_decode: 154| 7|{ // Decoding 155| 7| unsigned int i, j, index = 0, npieces_word = 8; 156| 7| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 157| 7| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 7|#define PARAMS_EXTRACTED_BITS 4 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 7|#define PARAMS_LOGQ 16 ------------------ 158| 7| uint8_t *pos = (uint8_t*)out; 159| 7| uint64_t templong; 160| | 161| 63| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 56, False: 7] ------------------ 162| 56| templong = 0; 163| 504| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 448, False: 56] ------------------ 164| 448| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 448|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 448|#define PARAMS_EXTRACTED_BITS 4 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 448|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 448|#define PARAMS_EXTRACTED_BITS 4 ------------------ 165| 448| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 448|#define PARAMS_EXTRACTED_BITS 4 ------------------ 166| 448| index++; 167| 448| } 168| 280| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 280|#define PARAMS_EXTRACTED_BITS 4 ------------------ | Branch (168:21): [True: 224, False: 56] ------------------ 169| 224| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 224|#define PARAMS_EXTRACTED_BITS 4 ------------------ 170| 224| } 171| 56| } 172| 7|} oqs_kem_frodokem_1344_shake_mul_add_as_plus_e: 27| 6|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 6|#if defined(OQS_DIST_X86_64_BUILD) 31| 6| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 6, False: 0] ------------------ 32| 6| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 48| 6|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_frodokem_1344_shake_mul_add_as_plus_e_avx2 ------------------ 33| 6| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 47| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_frodokem_1344_shake_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 6|} oqs_kem_frodokem_1344_shake_mul_add_sa_plus_e: 44| 12|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| |#if defined(USE_AES128_FOR_A) 48| | #if defined(OQS_DIST_X86_64_BUILD) 49| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 50| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 51| | } else { 52| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 53| | } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| 12| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (61:9): [True: 12, False: 0] ------------------ 62| 12| return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); ------------------ | | 51| 12|#define frodo_mul_add_sa_plus_e_shake_avx2 oqs_kem_frodokem_1344_shake_mul_add_sa_plus_e_avx2 ------------------ 63| 12| } else { 64| 0| return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); ------------------ | | 50| 0|#define frodo_mul_add_sa_plus_e_shake_portable oqs_kem_frodokem_1344_shake_mul_add_sa_plus_e_portable ------------------ 65| 0| } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| 12|#endif 72| 12|} oqs_kem_frodokem_1344_shake_mul_bs: 75| 6|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 6| int i, j, k; 79| | 80| 54| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 54|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 48, False: 6] ------------------ 81| 432| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 432|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 384, False: 48] ------------------ 82| 384| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 384|#define PARAMS_NBAR 8 ------------------ 83| 516k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 516k|#define PARAMS_N 1344 ------------------ | Branch (83:25): [True: 516k, False: 384] ------------------ 84| 516k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 516k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 516k|#define PARAMS_N 1344 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 516k|#define PARAMS_N 1344 ------------------ 85| 516k| } 86| 384| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 768|#define PARAMS_EXTRACTED_BITS 4 ------------------ 147| 768| pos++; 148| 768| } 149| 96| } 150| 12|} oqs_kem_frodokem_1344_shake_key_decode: 154| 6|{ // Decoding 155| 6| unsigned int i, j, index = 0, npieces_word = 8; 156| 6| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 6|#define PARAMS_NBAR 8 ------------------ 157| 6| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 6|#define PARAMS_EXTRACTED_BITS 4 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 6|#define PARAMS_LOGQ 16 ------------------ 158| 6| uint8_t *pos = (uint8_t*)out; 159| 6| uint64_t templong; 160| | 161| 54| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 48, False: 6] ------------------ 162| 48| templong = 0; 163| 432| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 384, False: 48] ------------------ 164| 384| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 384|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 384|#define PARAMS_EXTRACTED_BITS 4 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 384|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 384|#define PARAMS_EXTRACTED_BITS 4 ------------------ 165| 384| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 384|#define PARAMS_EXTRACTED_BITS 4 ------------------ 166| 384| index++; 167| 384| } 168| 240| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 240|#define PARAMS_EXTRACTED_BITS 4 ------------------ | Branch (168:21): [True: 192, False: 48] ------------------ 169| 192| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 192|#define PARAMS_EXTRACTED_BITS 4 ------------------ 170| 192| } 171| 48| } 172| 6|} oqs_kem_efrodokem_640_aes_mul_add_as_plus_e: 27| 4|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 4|#if defined(OQS_DIST_X86_64_BUILD) 31| 4| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 4, False: 0] ------------------ 32| 4| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 46| 4|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_efrodokem_640_aes_mul_add_as_plus_e_avx2 ------------------ 33| 4| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 45| 0|#define frodo_mul_add_as_plus_e_portable oqs_ekem_frodokem_640_aes_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 4|} oqs_kem_efrodokem_640_aes_mul_add_sa_plus_e: 44| 8|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| 8|#if defined(USE_AES128_FOR_A) 48| 8| #if defined(OQS_DIST_X86_64_BUILD) 49| 8| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (49:9): [True: 8, False: 0] ------------------ 50| 8| return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); ------------------ | | 49| 8|#define frodo_mul_add_sa_plus_e_aes_avx2 oqs_kem_efrodokem_640_aes_mul_add_sa_plus_e_avx2 ------------------ 51| 8| } else { 52| 0| return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); ------------------ | | 48| 0|#define frodo_mul_add_sa_plus_e_aes_portable oqs_kem_efrodokem_640_aes_mul_add_sa_plus_e_portable ------------------ 53| 0| } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 62| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 63| | } else { 64| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 65| | } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| |#endif 72| 8|} oqs_kem_efrodokem_640_aes_mul_bs: 75| 4|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 4| int i, j, k; 79| | 80| 36| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 36|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 32, False: 4] ------------------ 81| 288| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 288|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 256, False: 32] ------------------ 82| 256| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 256|#define PARAMS_NBAR 8 ------------------ 83| 164k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 164k|#define PARAMS_N 640 ------------------ | Branch (83:25): [True: 163k, False: 256] ------------------ 84| 163k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 163k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 163k|#define PARAMS_N 640 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 163k|#define PARAMS_N 640 ------------------ 85| 163k| } 86| 256| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 512|#define PARAMS_EXTRACTED_BITS 2 ------------------ 147| 512| pos++; 148| 512| } 149| 64| } 150| 8|} oqs_kem_efrodokem_640_aes_key_decode: 154| 4|{ // Decoding 155| 4| unsigned int i, j, index = 0, npieces_word = 8; 156| 4| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 4|#define PARAMS_NBAR 8 ------------------ 157| 4| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 4|#define PARAMS_EXTRACTED_BITS 2 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 4|#define PARAMS_LOGQ 15 ------------------ 158| 4| uint8_t *pos = (uint8_t*)out; 159| 4| uint64_t templong; 160| | 161| 36| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 32, False: 4] ------------------ 162| 32| templong = 0; 163| 288| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 256, False: 32] ------------------ 164| 256| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 256|#define PARAMS_LOGQ 15 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 256|#define PARAMS_EXTRACTED_BITS 2 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 256|#define PARAMS_LOGQ 15 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 256|#define PARAMS_EXTRACTED_BITS 2 ------------------ 165| 256| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 256|#define PARAMS_EXTRACTED_BITS 2 ------------------ 166| 256| index++; 167| 256| } 168| 96| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 96|#define PARAMS_EXTRACTED_BITS 2 ------------------ | Branch (168:21): [True: 64, False: 32] ------------------ 169| 64| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 64|#define PARAMS_EXTRACTED_BITS 2 ------------------ 170| 64| } 171| 32| } 172| 4|} oqs_kem_efrodokem_640_shake_mul_add_as_plus_e: 27| 2|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 2|#if defined(OQS_DIST_X86_64_BUILD) 31| 2| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 2, False: 0] ------------------ 32| 2| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 46| 2|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_efrodokem_640_shake_mul_add_as_plus_e_avx2 ------------------ 33| 2| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 45| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_efrodokem_640_shake_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 2|} oqs_kem_efrodokem_640_shake_mul_add_sa_plus_e: 44| 4|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| |#if defined(USE_AES128_FOR_A) 48| | #if defined(OQS_DIST_X86_64_BUILD) 49| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 50| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 51| | } else { 52| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 53| | } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| 4| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (61:9): [True: 4, False: 0] ------------------ 62| 4| return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); ------------------ | | 49| 4|#define frodo_mul_add_sa_plus_e_shake_avx2 oqs_kem_efrodokem_640_shake_mul_add_sa_plus_e_avx2 ------------------ 63| 4| } else { 64| 0| return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); ------------------ | | 48| 0|#define frodo_mul_add_sa_plus_e_shake_portable oqs_kem_efrodokem_640_shake_mul_add_sa_plus_e_portable ------------------ 65| 0| } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| 4|#endif 72| 4|} oqs_kem_efrodokem_640_shake_mul_bs: 75| 2|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 2| int i, j, k; 79| | 80| 18| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 18|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 16, False: 2] ------------------ 81| 144| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 144|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 128, False: 16] ------------------ 82| 128| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 128|#define PARAMS_NBAR 8 ------------------ 83| 82.0k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 82.0k|#define PARAMS_N 640 ------------------ | Branch (83:25): [True: 81.9k, False: 128] ------------------ 84| 81.9k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 81.9k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 81.9k|#define PARAMS_N 640 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 81.9k|#define PARAMS_N 640 ------------------ 85| 81.9k| } 86| 128| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 256|#define PARAMS_EXTRACTED_BITS 2 ------------------ 147| 256| pos++; 148| 256| } 149| 32| } 150| 4|} oqs_kem_efrodokem_640_shake_key_decode: 154| 2|{ // Decoding 155| 2| unsigned int i, j, index = 0, npieces_word = 8; 156| 2| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 2|#define PARAMS_NBAR 8 ------------------ 157| 2| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 2|#define PARAMS_EXTRACTED_BITS 2 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 2|#define PARAMS_LOGQ 15 ------------------ 158| 2| uint8_t *pos = (uint8_t*)out; 159| 2| uint64_t templong; 160| | 161| 18| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 16, False: 2] ------------------ 162| 16| templong = 0; 163| 144| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 128, False: 16] ------------------ 164| 128| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 128|#define PARAMS_LOGQ 15 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 128|#define PARAMS_EXTRACTED_BITS 2 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 128|#define PARAMS_LOGQ 15 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 128|#define PARAMS_EXTRACTED_BITS 2 ------------------ 165| 128| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 128|#define PARAMS_EXTRACTED_BITS 2 ------------------ 166| 128| index++; 167| 128| } 168| 48| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 48|#define PARAMS_EXTRACTED_BITS 2 ------------------ | Branch (168:21): [True: 32, False: 16] ------------------ 169| 32| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 32|#define PARAMS_EXTRACTED_BITS 2 ------------------ 170| 32| } 171| 16| } 172| 2|} oqs_kem_efrodokem_976_aes_mul_add_as_plus_e: 27| 9|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 9|#if defined(OQS_DIST_X86_64_BUILD) 31| 9| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 9, False: 0] ------------------ 32| 9| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 46| 9|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_efrodokem_976_aes_mul_add_as_plus_e_avx2 ------------------ 33| 9| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 45| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_efrodokem_976_aes_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 9|} oqs_kem_efrodokem_976_aes_mul_add_sa_plus_e: 44| 18|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| 18|#if defined(USE_AES128_FOR_A) 48| 18| #if defined(OQS_DIST_X86_64_BUILD) 49| 18| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (49:9): [True: 18, False: 0] ------------------ 50| 18| return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); ------------------ | | 49| 18|#define frodo_mul_add_sa_plus_e_aes_avx2 oqs_kem_efrodokem_976_aes_mul_add_sa_plus_e_avx2 ------------------ 51| 18| } else { 52| 0| return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); ------------------ | | 48| 0|#define frodo_mul_add_sa_plus_e_aes_portable oqs_kem_efrodokem_976_aes_mul_add_sa_plus_e_portable ------------------ 53| 0| } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 62| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 63| | } else { 64| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 65| | } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| |#endif 72| 18|} oqs_kem_efrodokem_976_aes_mul_bs: 75| 9|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 9| int i, j, k; 79| | 80| 81| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 81|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 72, False: 9] ------------------ 81| 648| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 648|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 576, False: 72] ------------------ 82| 576| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 576|#define PARAMS_NBAR 8 ------------------ 83| 562k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 562k|#define PARAMS_N 976 ------------------ | Branch (83:25): [True: 562k, False: 576] ------------------ 84| 562k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 562k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 562k|#define PARAMS_N 976 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 562k|#define PARAMS_N 976 ------------------ 85| 562k| } 86| 576| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 1.15k|#define PARAMS_EXTRACTED_BITS 3 ------------------ 147| 1.15k| pos++; 148| 1.15k| } 149| 144| } 150| 18|} oqs_kem_efrodokem_976_aes_key_decode: 154| 9|{ // Decoding 155| 9| unsigned int i, j, index = 0, npieces_word = 8; 156| 9| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 157| 9| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 9|#define PARAMS_EXTRACTED_BITS 3 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 158| 9| uint8_t *pos = (uint8_t*)out; 159| 9| uint64_t templong; 160| | 161| 81| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 72, False: 9] ------------------ 162| 72| templong = 0; 163| 648| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 576, False: 72] ------------------ 164| 576| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 576|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 576|#define PARAMS_EXTRACTED_BITS 3 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 576|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 576|#define PARAMS_EXTRACTED_BITS 3 ------------------ 165| 576| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 576|#define PARAMS_EXTRACTED_BITS 3 ------------------ 166| 576| index++; 167| 576| } 168| 288| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 288|#define PARAMS_EXTRACTED_BITS 3 ------------------ | Branch (168:21): [True: 216, False: 72] ------------------ 169| 216| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 216|#define PARAMS_EXTRACTED_BITS 3 ------------------ 170| 216| } 171| 72| } 172| 9|} oqs_kem_efrodokem_976_shake_mul_add_as_plus_e: 27| 8|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 8|#if defined(OQS_DIST_X86_64_BUILD) 31| 8| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 8, False: 0] ------------------ 32| 8| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 46| 8|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_efrodokem_976_shake_mul_add_as_plus_e_avx2 ------------------ 33| 8| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 45| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_efrodokem_976_shake_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 8|} oqs_kem_efrodokem_976_shake_mul_add_sa_plus_e: 44| 16|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| |#if defined(USE_AES128_FOR_A) 48| | #if defined(OQS_DIST_X86_64_BUILD) 49| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 50| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 51| | } else { 52| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 53| | } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| 16| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (61:9): [True: 16, False: 0] ------------------ 62| 16| return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); ------------------ | | 49| 16|#define frodo_mul_add_sa_plus_e_shake_avx2 oqs_kem_efrodokem_976_shake_mul_add_sa_plus_e_avx2 ------------------ 63| 16| } else { 64| 0| return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); ------------------ | | 48| 0|#define frodo_mul_add_sa_plus_e_shake_portable oqs_kem_efrodokem_976_shake_mul_add_sa_plus_e_portable ------------------ 65| 0| } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| 16|#endif 72| 16|} oqs_kem_efrodokem_976_shake_mul_bs: 75| 8|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 8| int i, j, k; 79| | 80| 72| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 72|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 64, False: 8] ------------------ 81| 576| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 576|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 512, False: 64] ------------------ 82| 512| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 512|#define PARAMS_NBAR 8 ------------------ 83| 500k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 500k|#define PARAMS_N 976 ------------------ | Branch (83:25): [True: 499k, False: 512] ------------------ 84| 499k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 499k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 499k|#define PARAMS_N 976 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 499k|#define PARAMS_N 976 ------------------ 85| 499k| } 86| 512| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 1.02k|#define PARAMS_EXTRACTED_BITS 3 ------------------ 147| 1.02k| pos++; 148| 1.02k| } 149| 128| } 150| 16|} oqs_kem_efrodokem_976_shake_key_decode: 154| 8|{ // Decoding 155| 8| unsigned int i, j, index = 0, npieces_word = 8; 156| 8| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 8|#define PARAMS_NBAR 8 ------------------ 157| 8| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 8|#define PARAMS_EXTRACTED_BITS 3 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 8|#define PARAMS_LOGQ 16 ------------------ 158| 8| uint8_t *pos = (uint8_t*)out; 159| 8| uint64_t templong; 160| | 161| 72| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 64, False: 8] ------------------ 162| 64| templong = 0; 163| 576| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 512, False: 64] ------------------ 164| 512| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 512|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 512|#define PARAMS_EXTRACTED_BITS 3 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 512|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 512|#define PARAMS_EXTRACTED_BITS 3 ------------------ 165| 512| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 512|#define PARAMS_EXTRACTED_BITS 3 ------------------ 166| 512| index++; 167| 512| } 168| 256| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 256|#define PARAMS_EXTRACTED_BITS 3 ------------------ | Branch (168:21): [True: 192, False: 64] ------------------ 169| 192| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 192|#define PARAMS_EXTRACTED_BITS 3 ------------------ 170| 192| } 171| 64| } 172| 8|} oqs_kem_efrodokem_1344_aes_mul_add_as_plus_e: 27| 9|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 9|#if defined(OQS_DIST_X86_64_BUILD) 31| 9| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 9, False: 0] ------------------ 32| 9| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 46| 9|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_efrodokem_1344_aes_mul_add_as_plus_e_avx2 ------------------ 33| 9| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 45| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_efrodokem_1344_aes_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 9|} oqs_kem_efrodokem_1344_aes_mul_add_sa_plus_e: 44| 18|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| 18|#if defined(USE_AES128_FOR_A) 48| 18| #if defined(OQS_DIST_X86_64_BUILD) 49| 18| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (49:9): [True: 18, False: 0] ------------------ 50| 18| return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); ------------------ | | 49| 18|#define frodo_mul_add_sa_plus_e_aes_avx2 oqs_kem_efrodokem_1344_aes_mul_add_sa_plus_e_avx2 ------------------ 51| 18| } else { 52| 0| return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); ------------------ | | 48| 0|#define frodo_mul_add_sa_plus_e_aes_portable oqs_kem_efrodokem_1344_aes_mul_add_sa_plus_e_portable ------------------ 53| 0| } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 62| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 63| | } else { 64| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 65| | } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| |#endif 72| 18|} oqs_kem_efrodokem_1344_aes_mul_bs: 75| 9|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 9| int i, j, k; 79| | 80| 81| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 81|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 72, False: 9] ------------------ 81| 648| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 648|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 576, False: 72] ------------------ 82| 576| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 576|#define PARAMS_NBAR 8 ------------------ 83| 774k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 774k|#define PARAMS_N 1344 ------------------ | Branch (83:25): [True: 774k, False: 576] ------------------ 84| 774k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 774k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 774k|#define PARAMS_N 1344 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 774k|#define PARAMS_N 1344 ------------------ 85| 774k| } 86| 576| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 1.15k|#define PARAMS_EXTRACTED_BITS 4 ------------------ 147| 1.15k| pos++; 148| 1.15k| } 149| 144| } 150| 18|} oqs_kem_efrodokem_1344_aes_key_decode: 154| 9|{ // Decoding 155| 9| unsigned int i, j, index = 0, npieces_word = 8; 156| 9| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 9|#define PARAMS_NBAR 8 ------------------ 157| 9| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 9|#define PARAMS_EXTRACTED_BITS 4 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 9|#define PARAMS_LOGQ 16 ------------------ 158| 9| uint8_t *pos = (uint8_t*)out; 159| 9| uint64_t templong; 160| | 161| 81| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 72, False: 9] ------------------ 162| 72| templong = 0; 163| 648| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 576, False: 72] ------------------ 164| 576| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 576|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 576|#define PARAMS_EXTRACTED_BITS 4 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 576|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 576|#define PARAMS_EXTRACTED_BITS 4 ------------------ 165| 576| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 576|#define PARAMS_EXTRACTED_BITS 4 ------------------ 166| 576| index++; 167| 576| } 168| 360| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 360|#define PARAMS_EXTRACTED_BITS 4 ------------------ | Branch (168:21): [True: 288, False: 72] ------------------ 169| 288| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 288|#define PARAMS_EXTRACTED_BITS 4 ------------------ 170| 288| } 171| 72| } 172| 9|} oqs_kem_efrodokem_1344_shake_mul_add_as_plus_e: 27| 7|{ // Generate-and-multiply: generate matrix A (N x N) row-wise, multiply by s on the right. 28| | // Inputs: s, e (N x N_BAR) 29| | // Output: out = A*s + e (N x N_BAR) 30| 7|#if defined(OQS_DIST_X86_64_BUILD) 31| 7| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (31:9): [True: 7, False: 0] ------------------ 32| 7| return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); ------------------ | | 46| 7|#define frodo_mul_add_as_plus_e_avx2 oqs_kem_efrodokem_1344_shake_mul_add_as_plus_e_avx2 ------------------ 33| 7| } else { 34| 0| return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); ------------------ | | 45| 0|#define frodo_mul_add_as_plus_e_portable oqs_kem_efrodokem_1344_shake_mul_add_as_plus_e_portable ------------------ 35| 0| } 36| |#elif defined(OQS_USE_AVX2_INSTRUCTIONS) 37| | return frodo_mul_add_as_plus_e_avx2(out, s, e, seed_A); 38| |#else 39| | return frodo_mul_add_as_plus_e_portable(out, s, e, seed_A); 40| |#endif 41| 7|} oqs_kem_efrodokem_1344_shake_mul_add_sa_plus_e: 44| 14|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 45| | // Inputs: s', e' (N_BAR x N) 46| | // Output: out = s'*A + e' (N_BAR x N) 47| |#if defined(USE_AES128_FOR_A) 48| | #if defined(OQS_DIST_X86_64_BUILD) 49| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { 50| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 51| | } else { 52| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 53| | } 54| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 55| | return frodo_mul_add_sa_plus_e_aes_avx2(out, s, e, seed_A); 56| | #else 57| | return frodo_mul_add_sa_plus_e_aes_portable(out, s, e, seed_A); 58| | #endif 59| |#elif defined(USE_SHAKE128_FOR_A) 60| | #if defined(OQS_DIST_X86_64_BUILD) 61| 14| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2)) { ------------------ | Branch (61:9): [True: 14, False: 0] ------------------ 62| 14| return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); ------------------ | | 49| 14|#define frodo_mul_add_sa_plus_e_shake_avx2 oqs_kem_efrodokem_1344_shake_mul_add_sa_plus_e_avx2 ------------------ 63| 14| } else { 64| 0| return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); ------------------ | | 48| 0|#define frodo_mul_add_sa_plus_e_shake_portable oqs_kem_efrodokem_1344_shake_mul_add_sa_plus_e_portable ------------------ 65| 0| } 66| | #elif defined(OQS_USE_AVX2_INSTRUCTIONS) 67| | return frodo_mul_add_sa_plus_e_shake_avx2(out, s, e, seed_A); 68| | #else 69| | return frodo_mul_add_sa_plus_e_shake_portable(out, s, e, seed_A); 70| | #endif 71| 14|#endif 72| 14|} oqs_kem_efrodokem_1344_shake_mul_bs: 75| 7|{ // Multiply by s on the right 76| | // Inputs: b (N_BAR x N), s (N x N_BAR) 77| | // Output: out = b*s (N_BAR x N_BAR) 78| 7| int i, j, k; 79| | 80| 63| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 63|#define PARAMS_NBAR 8 ------------------ | Branch (80:17): [True: 56, False: 7] ------------------ 81| 504| for (j = 0; j < PARAMS_NBAR; j++) { ------------------ | | 12| 504|#define PARAMS_NBAR 8 ------------------ | Branch (81:21): [True: 448, False: 56] ------------------ 82| 448| out[i*PARAMS_NBAR + j] = 0; ------------------ | | 12| 448|#define PARAMS_NBAR 8 ------------------ 83| 602k| for (k = 0; k < PARAMS_N; k++) { ------------------ | | 11| 602k|#define PARAMS_N 1344 ------------------ | Branch (83:25): [True: 602k, False: 448] ------------------ 84| 602k| out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 12| 602k|#define PARAMS_NBAR 8 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 602k|#define PARAMS_N 1344 ------------------ out[i*PARAMS_NBAR + j] += (uint16_t) ((uint32_t) b[i*PARAMS_N + k] * (uint32_t) s[j*PARAMS_N + k]); ------------------ | | 11| 602k|#define PARAMS_N 1344 ------------------ 85| 602k| } 86| 448| out[i*PARAMS_NBAR + j] = (uint32_t)(out[i*PARAMS_NBAR + j]) & ((1<>= PARAMS_EXTRACTED_BITS; ------------------ | | 15| 896|#define PARAMS_EXTRACTED_BITS 4 ------------------ 147| 896| pos++; 148| 896| } 149| 112| } 150| 14|} oqs_kem_efrodokem_1344_shake_key_decode: 154| 7|{ // Decoding 155| 7| unsigned int i, j, index = 0, npieces_word = 8; 156| 7| unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ unsigned int nwords = (PARAMS_NBAR * PARAMS_NBAR) / 8; ------------------ | | 12| 7|#define PARAMS_NBAR 8 ------------------ 157| 7| uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 15| 7|#define PARAMS_EXTRACTED_BITS 4 ------------------ uint16_t temp, maskex=((uint16_t)1 << PARAMS_EXTRACTED_BITS) -1, maskq =((uint16_t)1 << PARAMS_LOGQ) -1; ------------------ | | 13| 7|#define PARAMS_LOGQ 16 ------------------ 158| 7| uint8_t *pos = (uint8_t*)out; 159| 7| uint64_t templong; 160| | 161| 63| for (i = 0; i < nwords; i++) { ------------------ | Branch (161:17): [True: 56, False: 7] ------------------ 162| 56| templong = 0; 163| 504| for (j = 0; j < npieces_word; j++) { // temp = floor(in*2^{-11}+0.5) ------------------ | Branch (163:21): [True: 448, False: 56] ------------------ 164| 448| temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 448|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 448|#define PARAMS_EXTRACTED_BITS 4 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 13| 448|#define PARAMS_LOGQ 16 ------------------ temp = ((in[index] & maskq) + (1 << (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS - 1))) >> (PARAMS_LOGQ - PARAMS_EXTRACTED_BITS); ------------------ | | 15| 448|#define PARAMS_EXTRACTED_BITS 4 ------------------ 165| 448| templong |= ((uint64_t)(temp & maskex)) << (PARAMS_EXTRACTED_BITS * j); ------------------ | | 15| 448|#define PARAMS_EXTRACTED_BITS 4 ------------------ 166| 448| index++; 167| 448| } 168| 280| for (j = 0; j < PARAMS_EXTRACTED_BITS; j++) { ------------------ | | 15| 280|#define PARAMS_EXTRACTED_BITS 4 ------------------ | Branch (168:21): [True: 224, False: 56] ------------------ 169| 224| pos[i*PARAMS_EXTRACTED_BITS + j] = (templong >> (8*j)) & 0xFF; ------------------ | | 15| 224|#define PARAMS_EXTRACTED_BITS 4 ------------------ 170| 224| } 171| 56| } 172| 7|} oqs_kem_frodokem_640_shake_mul_add_sa_plus_e_avx2: 7| 6|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 8| | // Inputs: s', e' (N_BAR x N) 9| | // Output: out = s'*A + e' (N_BAR x N) 10| 6| int i, j, kk; 11| | 12| 15.3k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 15.3k|#define PARAMS_N 640 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 15.3k|#define PARAMS_NBAR 8 ------------------ | Branch (12:17): [True: 15.3k, False: 6] ------------------ 13| 15.3k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 14| 15.3k| } 15| | 16| 6| int t=0; 17| 6| ALIGN_HEADER(32) uint16_t a_cols[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 18| | 19| 6| uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 20| 6| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 21| 6| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 22| 6| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 23| 6| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 24| 6| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 25| 6| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 26| 6| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 27| 6| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ 28| 6| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ 29| 6| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ 30| 6| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 6|#define BYTES_SEED_A 16 ------------------ 31| | 32| 966| for (kk = 0; kk < PARAMS_N; kk+=4) { ------------------ | | 11| 966|#define PARAMS_N 640 ------------------ | Branch (32:18): [True: 960, False: 6] ------------------ 33| 960| seed_A_origin_0[0] = UINT16_TO_LE(kk + 0); ------------------ | | 35| 960| #define UINT16_TO_LE(n) (n) ------------------ 34| 960| seed_A_origin_1[0] = UINT16_TO_LE(kk + 1); ------------------ | | 35| 960| #define UINT16_TO_LE(n) (n) ------------------ 35| 960| seed_A_origin_2[0] = UINT16_TO_LE(kk + 2); ------------------ | | 35| 960| #define UINT16_TO_LE(n) (n) ------------------ 36| 960| seed_A_origin_3[0] = UINT16_TO_LE(kk + 3); ------------------ | | 35| 960| #define UINT16_TO_LE(n) (n) ------------------ 37| 960| OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 960|#define PARAMS_N 640 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 960|#define PARAMS_N 640 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 960|#define PARAMS_N 640 ------------------ 38| 960| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 960|#define PARAMS_N 640 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 960|#define BYTES_SEED_A 16 ------------------ 39| | 40| 8.64k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 8.64k|#define PARAMS_NBAR 8 ------------------ | Branch (40:21): [True: 7.68k, False: 960] ------------------ 41| 7.68k| __m256i a, b0, b1, b2, b3, acc[PARAMS_N/16]; 42| 7.68k| b0 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 0]); ------------------ | | 11| 7.68k|#define PARAMS_N 640 ------------------ 43| 7.68k| b1 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 1]); ------------------ | | 11| 7.68k|#define PARAMS_N 640 ------------------ 44| 7.68k| b2 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 2]); ------------------ | | 11| 7.68k|#define PARAMS_N 640 ------------------ 45| 7.68k| b3 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 3]); ------------------ | | 11| 7.68k|#define PARAMS_N 640 ------------------ 46| 314k| for (j = 0; j < PARAMS_N; j+=16) { // Matrix-vector multiplication ------------------ | | 11| 314k|#define PARAMS_N 640 ------------------ | Branch (46:25): [True: 307k, False: 7.68k] ------------------ 47| 307k| acc[j/16] = _mm256_load_si256((__m256i*)&out[i*PARAMS_N + j]); ------------------ | | 11| 307k|#define PARAMS_N 640 ------------------ 48| 307k| a = _mm256_load_si256((__m256i*)&a_cols[(t+0)*PARAMS_N + j]); ------------------ | | 11| 307k|#define PARAMS_N 640 ------------------ 49| 307k| a = _mm256_mullo_epi16(a, b0); 50| 307k| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 51| 307k| a = _mm256_load_si256((__m256i*)&a_cols[(t+1)*PARAMS_N + j]); ------------------ | | 11| 307k|#define PARAMS_N 640 ------------------ 52| 307k| a = _mm256_mullo_epi16(a, b1); 53| 307k| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 54| 307k| a = _mm256_load_si256((__m256i*)&a_cols[(t+2)*PARAMS_N + j]); ------------------ | | 11| 307k|#define PARAMS_N 640 ------------------ 55| 307k| a = _mm256_mullo_epi16(a, b2); 56| 307k| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 57| 307k| a = _mm256_load_si256((__m256i*)&a_cols[(t+3)*PARAMS_N + j]); ------------------ | | 11| 307k|#define PARAMS_N 640 ------------------ 58| 307k| a = _mm256_mullo_epi16(a, b3); 59| 307k| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 60| 307k| } 61| 314k| for (j = 0; j < PARAMS_N/16; j++) { ------------------ | | 11| 314k|#define PARAMS_N 640 ------------------ | Branch (61:25): [True: 307k, False: 7.68k] ------------------ 62| 307k| _mm256_store_si256((__m256i*)&out[i*PARAMS_N + 16*j], acc[j]); ------------------ | | 11| 307k|#define PARAMS_N 640 ------------------ 63| 307k| } 64| 7.68k| } 65| 960| } 66| | 67| 6| return 1; 68| 6|} oqs_kem_frodokem_976_shake_mul_add_sa_plus_e_avx2: 7| 18|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 8| | // Inputs: s', e' (N_BAR x N) 9| | // Output: out = s'*A + e' (N_BAR x N) 10| 18| int i, j, kk; 11| | 12| 70.2k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 70.2k|#define PARAMS_N 976 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 70.2k|#define PARAMS_NBAR 8 ------------------ | Branch (12:17): [True: 70.2k, False: 18] ------------------ 13| 70.2k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 14| 70.2k| } 15| | 16| 18| int t=0; 17| 18| ALIGN_HEADER(32) uint16_t a_cols[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 18| | 19| 18| uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 20| 18| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 21| 18| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 22| 18| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 23| 18| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 24| 18| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 25| 18| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 26| 18| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 27| 18| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 18|#define BYTES_SEED_A 16 ------------------ 28| 18| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 18|#define BYTES_SEED_A 16 ------------------ 29| 18| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 18|#define BYTES_SEED_A 16 ------------------ 30| 18| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 18|#define BYTES_SEED_A 16 ------------------ 31| | 32| 4.41k| for (kk = 0; kk < PARAMS_N; kk+=4) { ------------------ | | 11| 4.41k|#define PARAMS_N 976 ------------------ | Branch (32:18): [True: 4.39k, False: 18] ------------------ 33| 4.39k| seed_A_origin_0[0] = UINT16_TO_LE(kk + 0); ------------------ | | 35| 4.39k| #define UINT16_TO_LE(n) (n) ------------------ 34| 4.39k| seed_A_origin_1[0] = UINT16_TO_LE(kk + 1); ------------------ | | 35| 4.39k| #define UINT16_TO_LE(n) (n) ------------------ 35| 4.39k| seed_A_origin_2[0] = UINT16_TO_LE(kk + 2); ------------------ | | 35| 4.39k| #define UINT16_TO_LE(n) (n) ------------------ 36| 4.39k| seed_A_origin_3[0] = UINT16_TO_LE(kk + 3); ------------------ | | 35| 4.39k| #define UINT16_TO_LE(n) (n) ------------------ 37| 4.39k| OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 4.39k|#define PARAMS_N 976 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 4.39k|#define PARAMS_N 976 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 4.39k|#define PARAMS_N 976 ------------------ 38| 4.39k| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 4.39k|#define PARAMS_N 976 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 4.39k|#define BYTES_SEED_A 16 ------------------ 39| | 40| 39.5k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 39.5k|#define PARAMS_NBAR 8 ------------------ | Branch (40:21): [True: 35.1k, False: 4.39k] ------------------ 41| 35.1k| __m256i a, b0, b1, b2, b3, acc[PARAMS_N/16]; 42| 35.1k| b0 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 0]); ------------------ | | 11| 35.1k|#define PARAMS_N 976 ------------------ 43| 35.1k| b1 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 1]); ------------------ | | 11| 35.1k|#define PARAMS_N 976 ------------------ 44| 35.1k| b2 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 2]); ------------------ | | 11| 35.1k|#define PARAMS_N 976 ------------------ 45| 35.1k| b3 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 3]); ------------------ | | 11| 35.1k|#define PARAMS_N 976 ------------------ 46| 2.17M| for (j = 0; j < PARAMS_N; j+=16) { // Matrix-vector multiplication ------------------ | | 11| 2.17M|#define PARAMS_N 976 ------------------ | Branch (46:25): [True: 2.14M, False: 35.1k] ------------------ 47| 2.14M| acc[j/16] = _mm256_load_si256((__m256i*)&out[i*PARAMS_N + j]); ------------------ | | 11| 2.14M|#define PARAMS_N 976 ------------------ 48| 2.14M| a = _mm256_load_si256((__m256i*)&a_cols[(t+0)*PARAMS_N + j]); ------------------ | | 11| 2.14M|#define PARAMS_N 976 ------------------ 49| 2.14M| a = _mm256_mullo_epi16(a, b0); 50| 2.14M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 51| 2.14M| a = _mm256_load_si256((__m256i*)&a_cols[(t+1)*PARAMS_N + j]); ------------------ | | 11| 2.14M|#define PARAMS_N 976 ------------------ 52| 2.14M| a = _mm256_mullo_epi16(a, b1); 53| 2.14M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 54| 2.14M| a = _mm256_load_si256((__m256i*)&a_cols[(t+2)*PARAMS_N + j]); ------------------ | | 11| 2.14M|#define PARAMS_N 976 ------------------ 55| 2.14M| a = _mm256_mullo_epi16(a, b2); 56| 2.14M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 57| 2.14M| a = _mm256_load_si256((__m256i*)&a_cols[(t+3)*PARAMS_N + j]); ------------------ | | 11| 2.14M|#define PARAMS_N 976 ------------------ 58| 2.14M| a = _mm256_mullo_epi16(a, b3); 59| 2.14M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 60| 2.14M| } 61| 2.17M| for (j = 0; j < PARAMS_N/16; j++) { ------------------ | | 11| 2.17M|#define PARAMS_N 976 ------------------ | Branch (61:25): [True: 2.14M, False: 35.1k] ------------------ 62| 2.14M| _mm256_store_si256((__m256i*)&out[i*PARAMS_N + 16*j], acc[j]); ------------------ | | 11| 2.14M|#define PARAMS_N 976 ------------------ 63| 2.14M| } 64| 35.1k| } 65| 4.39k| } 66| | 67| 18| return 1; 68| 18|} oqs_kem_frodokem_1344_shake_mul_add_sa_plus_e_avx2: 7| 12|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 8| | // Inputs: s', e' (N_BAR x N) 9| | // Output: out = s'*A + e' (N_BAR x N) 10| 12| int i, j, kk; 11| | 12| 64.5k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 64.5k|#define PARAMS_N 1344 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 64.5k|#define PARAMS_NBAR 8 ------------------ | Branch (12:17): [True: 64.5k, False: 12] ------------------ 13| 64.5k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 14| 64.5k| } 15| | 16| 12| int t=0; 17| 12| ALIGN_HEADER(32) uint16_t a_cols[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 18| | 19| 12| uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 20| 12| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 21| 12| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 22| 12| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 23| 12| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 24| 12| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 25| 12| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 26| 12| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 27| 12| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 12|#define BYTES_SEED_A 16 ------------------ 28| 12| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 12|#define BYTES_SEED_A 16 ------------------ 29| 12| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 12|#define BYTES_SEED_A 16 ------------------ 30| 12| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 12|#define BYTES_SEED_A 16 ------------------ 31| | 32| 4.04k| for (kk = 0; kk < PARAMS_N; kk+=4) { ------------------ | | 11| 4.04k|#define PARAMS_N 1344 ------------------ | Branch (32:18): [True: 4.03k, False: 12] ------------------ 33| 4.03k| seed_A_origin_0[0] = UINT16_TO_LE(kk + 0); ------------------ | | 35| 4.03k| #define UINT16_TO_LE(n) (n) ------------------ 34| 4.03k| seed_A_origin_1[0] = UINT16_TO_LE(kk + 1); ------------------ | | 35| 4.03k| #define UINT16_TO_LE(n) (n) ------------------ 35| 4.03k| seed_A_origin_2[0] = UINT16_TO_LE(kk + 2); ------------------ | | 35| 4.03k| #define UINT16_TO_LE(n) (n) ------------------ 36| 4.03k| seed_A_origin_3[0] = UINT16_TO_LE(kk + 3); ------------------ | | 35| 4.03k| #define UINT16_TO_LE(n) (n) ------------------ 37| 4.03k| OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 4.03k|#define PARAMS_N 1344 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 4.03k|#define PARAMS_N 1344 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 4.03k|#define PARAMS_N 1344 ------------------ 38| 4.03k| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 4.03k|#define PARAMS_N 1344 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 4.03k|#define BYTES_SEED_A 16 ------------------ 39| | 40| 36.2k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 36.2k|#define PARAMS_NBAR 8 ------------------ | Branch (40:21): [True: 32.2k, False: 4.03k] ------------------ 41| 32.2k| __m256i a, b0, b1, b2, b3, acc[PARAMS_N/16]; 42| 32.2k| b0 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 0]); ------------------ | | 11| 32.2k|#define PARAMS_N 1344 ------------------ 43| 32.2k| b1 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 1]); ------------------ | | 11| 32.2k|#define PARAMS_N 1344 ------------------ 44| 32.2k| b2 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 2]); ------------------ | | 11| 32.2k|#define PARAMS_N 1344 ------------------ 45| 32.2k| b3 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 3]); ------------------ | | 11| 32.2k|#define PARAMS_N 1344 ------------------ 46| 2.74M| for (j = 0; j < PARAMS_N; j+=16) { // Matrix-vector multiplication ------------------ | | 11| 2.74M|#define PARAMS_N 1344 ------------------ | Branch (46:25): [True: 2.70M, False: 32.2k] ------------------ 47| 2.70M| acc[j/16] = _mm256_load_si256((__m256i*)&out[i*PARAMS_N + j]); ------------------ | | 11| 2.70M|#define PARAMS_N 1344 ------------------ 48| 2.70M| a = _mm256_load_si256((__m256i*)&a_cols[(t+0)*PARAMS_N + j]); ------------------ | | 11| 2.70M|#define PARAMS_N 1344 ------------------ 49| 2.70M| a = _mm256_mullo_epi16(a, b0); 50| 2.70M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 51| 2.70M| a = _mm256_load_si256((__m256i*)&a_cols[(t+1)*PARAMS_N + j]); ------------------ | | 11| 2.70M|#define PARAMS_N 1344 ------------------ 52| 2.70M| a = _mm256_mullo_epi16(a, b1); 53| 2.70M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 54| 2.70M| a = _mm256_load_si256((__m256i*)&a_cols[(t+2)*PARAMS_N + j]); ------------------ | | 11| 2.70M|#define PARAMS_N 1344 ------------------ 55| 2.70M| a = _mm256_mullo_epi16(a, b2); 56| 2.70M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 57| 2.70M| a = _mm256_load_si256((__m256i*)&a_cols[(t+3)*PARAMS_N + j]); ------------------ | | 11| 2.70M|#define PARAMS_N 1344 ------------------ 58| 2.70M| a = _mm256_mullo_epi16(a, b3); 59| 2.70M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 60| 2.70M| } 61| 2.74M| for (j = 0; j < PARAMS_N/16; j++) { ------------------ | | 11| 2.74M|#define PARAMS_N 1344 ------------------ | Branch (61:25): [True: 2.70M, False: 32.2k] ------------------ 62| 2.70M| _mm256_store_si256((__m256i*)&out[i*PARAMS_N + 16*j], acc[j]); ------------------ | | 11| 2.70M|#define PARAMS_N 1344 ------------------ 63| 2.70M| } 64| 32.2k| } 65| 4.03k| } 66| | 67| 12| return 1; 68| 12|} oqs_kem_efrodokem_640_shake_mul_add_sa_plus_e_avx2: 7| 4|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 8| | // Inputs: s', e' (N_BAR x N) 9| | // Output: out = s'*A + e' (N_BAR x N) 10| 4| int i, j, kk; 11| | 12| 10.2k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 10.2k|#define PARAMS_N 640 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 10.2k|#define PARAMS_NBAR 8 ------------------ | Branch (12:17): [True: 10.2k, False: 4] ------------------ 13| 10.2k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 14| 10.2k| } 15| | 16| 4| int t=0; 17| 4| ALIGN_HEADER(32) uint16_t a_cols[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 18| | 19| 4| uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 20| 4| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 21| 4| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 22| 4| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 23| 4| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 24| 4| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 25| 4| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 26| 4| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 27| 4| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ 28| 4| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ 29| 4| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ 30| 4| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 4|#define BYTES_SEED_A 16 ------------------ 31| | 32| 644| for (kk = 0; kk < PARAMS_N; kk+=4) { ------------------ | | 11| 644|#define PARAMS_N 640 ------------------ | Branch (32:18): [True: 640, False: 4] ------------------ 33| 640| seed_A_origin_0[0] = UINT16_TO_LE(kk + 0); ------------------ | | 35| 640| #define UINT16_TO_LE(n) (n) ------------------ 34| 640| seed_A_origin_1[0] = UINT16_TO_LE(kk + 1); ------------------ | | 35| 640| #define UINT16_TO_LE(n) (n) ------------------ 35| 640| seed_A_origin_2[0] = UINT16_TO_LE(kk + 2); ------------------ | | 35| 640| #define UINT16_TO_LE(n) (n) ------------------ 36| 640| seed_A_origin_3[0] = UINT16_TO_LE(kk + 3); ------------------ | | 35| 640| #define UINT16_TO_LE(n) (n) ------------------ 37| 640| OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 640|#define PARAMS_N 640 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 640|#define PARAMS_N 640 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 640|#define PARAMS_N 640 ------------------ 38| 640| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 640|#define PARAMS_N 640 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 640|#define BYTES_SEED_A 16 ------------------ 39| | 40| 5.76k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 5.76k|#define PARAMS_NBAR 8 ------------------ | Branch (40:21): [True: 5.12k, False: 640] ------------------ 41| 5.12k| __m256i a, b0, b1, b2, b3, acc[PARAMS_N/16]; 42| 5.12k| b0 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 0]); ------------------ | | 11| 5.12k|#define PARAMS_N 640 ------------------ 43| 5.12k| b1 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 1]); ------------------ | | 11| 5.12k|#define PARAMS_N 640 ------------------ 44| 5.12k| b2 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 2]); ------------------ | | 11| 5.12k|#define PARAMS_N 640 ------------------ 45| 5.12k| b3 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 3]); ------------------ | | 11| 5.12k|#define PARAMS_N 640 ------------------ 46| 209k| for (j = 0; j < PARAMS_N; j+=16) { // Matrix-vector multiplication ------------------ | | 11| 209k|#define PARAMS_N 640 ------------------ | Branch (46:25): [True: 204k, False: 5.12k] ------------------ 47| 204k| acc[j/16] = _mm256_load_si256((__m256i*)&out[i*PARAMS_N + j]); ------------------ | | 11| 204k|#define PARAMS_N 640 ------------------ 48| 204k| a = _mm256_load_si256((__m256i*)&a_cols[(t+0)*PARAMS_N + j]); ------------------ | | 11| 204k|#define PARAMS_N 640 ------------------ 49| 204k| a = _mm256_mullo_epi16(a, b0); 50| 204k| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 51| 204k| a = _mm256_load_si256((__m256i*)&a_cols[(t+1)*PARAMS_N + j]); ------------------ | | 11| 204k|#define PARAMS_N 640 ------------------ 52| 204k| a = _mm256_mullo_epi16(a, b1); 53| 204k| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 54| 204k| a = _mm256_load_si256((__m256i*)&a_cols[(t+2)*PARAMS_N + j]); ------------------ | | 11| 204k|#define PARAMS_N 640 ------------------ 55| 204k| a = _mm256_mullo_epi16(a, b2); 56| 204k| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 57| 204k| a = _mm256_load_si256((__m256i*)&a_cols[(t+3)*PARAMS_N + j]); ------------------ | | 11| 204k|#define PARAMS_N 640 ------------------ 58| 204k| a = _mm256_mullo_epi16(a, b3); 59| 204k| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 60| 204k| } 61| 209k| for (j = 0; j < PARAMS_N/16; j++) { ------------------ | | 11| 209k|#define PARAMS_N 640 ------------------ | Branch (61:25): [True: 204k, False: 5.12k] ------------------ 62| 204k| _mm256_store_si256((__m256i*)&out[i*PARAMS_N + 16*j], acc[j]); ------------------ | | 11| 204k|#define PARAMS_N 640 ------------------ 63| 204k| } 64| 5.12k| } 65| 640| } 66| | 67| 4| return 1; 68| 4|} oqs_kem_efrodokem_976_shake_mul_add_sa_plus_e_avx2: 7| 16|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 8| | // Inputs: s', e' (N_BAR x N) 9| | // Output: out = s'*A + e' (N_BAR x N) 10| 16| int i, j, kk; 11| | 12| 62.4k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 62.4k|#define PARAMS_N 976 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 62.4k|#define PARAMS_NBAR 8 ------------------ | Branch (12:17): [True: 62.4k, False: 16] ------------------ 13| 62.4k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 14| 62.4k| } 15| | 16| 16| int t=0; 17| 16| ALIGN_HEADER(32) uint16_t a_cols[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 18| | 19| 16| uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 20| 16| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 21| 16| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 22| 16| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 23| 16| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 24| 16| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 25| 16| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 26| 16| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 27| 16| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 16|#define BYTES_SEED_A 16 ------------------ 28| 16| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 16|#define BYTES_SEED_A 16 ------------------ 29| 16| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 16|#define BYTES_SEED_A 16 ------------------ 30| 16| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 16|#define BYTES_SEED_A 16 ------------------ 31| | 32| 3.92k| for (kk = 0; kk < PARAMS_N; kk+=4) { ------------------ | | 11| 3.92k|#define PARAMS_N 976 ------------------ | Branch (32:18): [True: 3.90k, False: 16] ------------------ 33| 3.90k| seed_A_origin_0[0] = UINT16_TO_LE(kk + 0); ------------------ | | 35| 3.90k| #define UINT16_TO_LE(n) (n) ------------------ 34| 3.90k| seed_A_origin_1[0] = UINT16_TO_LE(kk + 1); ------------------ | | 35| 3.90k| #define UINT16_TO_LE(n) (n) ------------------ 35| 3.90k| seed_A_origin_2[0] = UINT16_TO_LE(kk + 2); ------------------ | | 35| 3.90k| #define UINT16_TO_LE(n) (n) ------------------ 36| 3.90k| seed_A_origin_3[0] = UINT16_TO_LE(kk + 3); ------------------ | | 35| 3.90k| #define UINT16_TO_LE(n) (n) ------------------ 37| 3.90k| OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 3.90k|#define PARAMS_N 976 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 3.90k|#define PARAMS_N 976 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 3.90k|#define PARAMS_N 976 ------------------ 38| 3.90k| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 3.90k|#define PARAMS_N 976 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 3.90k|#define BYTES_SEED_A 16 ------------------ 39| | 40| 35.1k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 35.1k|#define PARAMS_NBAR 8 ------------------ | Branch (40:21): [True: 31.2k, False: 3.90k] ------------------ 41| 31.2k| __m256i a, b0, b1, b2, b3, acc[PARAMS_N/16]; 42| 31.2k| b0 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 0]); ------------------ | | 11| 31.2k|#define PARAMS_N 976 ------------------ 43| 31.2k| b1 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 1]); ------------------ | | 11| 31.2k|#define PARAMS_N 976 ------------------ 44| 31.2k| b2 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 2]); ------------------ | | 11| 31.2k|#define PARAMS_N 976 ------------------ 45| 31.2k| b3 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 3]); ------------------ | | 11| 31.2k|#define PARAMS_N 976 ------------------ 46| 1.93M| for (j = 0; j < PARAMS_N; j+=16) { // Matrix-vector multiplication ------------------ | | 11| 1.93M|#define PARAMS_N 976 ------------------ | Branch (46:25): [True: 1.90M, False: 31.2k] ------------------ 47| 1.90M| acc[j/16] = _mm256_load_si256((__m256i*)&out[i*PARAMS_N + j]); ------------------ | | 11| 1.90M|#define PARAMS_N 976 ------------------ 48| 1.90M| a = _mm256_load_si256((__m256i*)&a_cols[(t+0)*PARAMS_N + j]); ------------------ | | 11| 1.90M|#define PARAMS_N 976 ------------------ 49| 1.90M| a = _mm256_mullo_epi16(a, b0); 50| 1.90M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 51| 1.90M| a = _mm256_load_si256((__m256i*)&a_cols[(t+1)*PARAMS_N + j]); ------------------ | | 11| 1.90M|#define PARAMS_N 976 ------------------ 52| 1.90M| a = _mm256_mullo_epi16(a, b1); 53| 1.90M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 54| 1.90M| a = _mm256_load_si256((__m256i*)&a_cols[(t+2)*PARAMS_N + j]); ------------------ | | 11| 1.90M|#define PARAMS_N 976 ------------------ 55| 1.90M| a = _mm256_mullo_epi16(a, b2); 56| 1.90M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 57| 1.90M| a = _mm256_load_si256((__m256i*)&a_cols[(t+3)*PARAMS_N + j]); ------------------ | | 11| 1.90M|#define PARAMS_N 976 ------------------ 58| 1.90M| a = _mm256_mullo_epi16(a, b3); 59| 1.90M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 60| 1.90M| } 61| 1.93M| for (j = 0; j < PARAMS_N/16; j++) { ------------------ | | 11| 1.93M|#define PARAMS_N 976 ------------------ | Branch (61:25): [True: 1.90M, False: 31.2k] ------------------ 62| 1.90M| _mm256_store_si256((__m256i*)&out[i*PARAMS_N + 16*j], acc[j]); ------------------ | | 11| 1.90M|#define PARAMS_N 976 ------------------ 63| 1.90M| } 64| 31.2k| } 65| 3.90k| } 66| | 67| 16| return 1; 68| 16|} oqs_kem_efrodokem_1344_shake_mul_add_sa_plus_e_avx2: 7| 14|{ // Generate-and-multiply: generate matrix A (N x N) column-wise, multiply by s' on the left. 8| | // Inputs: s', e' (N_BAR x N) 9| | // Output: out = s'*A + e' (N_BAR x N) 10| 14| int i, j, kk; 11| | 12| 75.2k| for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 11| 75.2k|#define PARAMS_N 1344 ------------------ for (i = 0; i < (PARAMS_N*PARAMS_NBAR); i += 2) { ------------------ | | 12| 75.2k|#define PARAMS_NBAR 8 ------------------ | Branch (12:17): [True: 75.2k, False: 14] ------------------ 13| 75.2k| *((uint32_t*)&out[i]) = *((uint32_t*)&e[i]); 14| 75.2k| } 15| | 16| 14| int t=0; 17| 14| ALIGN_HEADER(32) uint16_t a_cols[4*PARAMS_N] ALIGN_FOOTER(32) = {0}; 18| | 19| 14| uint8_t seed_A_separated_0[2 + BYTES_SEED_A]; 20| 14| uint8_t seed_A_separated_1[2 + BYTES_SEED_A]; 21| 14| uint8_t seed_A_separated_2[2 + BYTES_SEED_A]; 22| 14| uint8_t seed_A_separated_3[2 + BYTES_SEED_A]; 23| 14| uint16_t* seed_A_origin_0 = (uint16_t*)&seed_A_separated_0; 24| 14| uint16_t* seed_A_origin_1 = (uint16_t*)&seed_A_separated_1; 25| 14| uint16_t* seed_A_origin_2 = (uint16_t*)&seed_A_separated_2; 26| 14| uint16_t* seed_A_origin_3 = (uint16_t*)&seed_A_separated_3; 27| 14| memcpy(&seed_A_separated_0[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 14|#define BYTES_SEED_A 16 ------------------ 28| 14| memcpy(&seed_A_separated_1[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 14|#define BYTES_SEED_A 16 ------------------ 29| 14| memcpy(&seed_A_separated_2[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 14|#define BYTES_SEED_A 16 ------------------ 30| 14| memcpy(&seed_A_separated_3[2], seed_A, BYTES_SEED_A); ------------------ | | 18| 14|#define BYTES_SEED_A 16 ------------------ 31| | 32| 4.71k| for (kk = 0; kk < PARAMS_N; kk+=4) { ------------------ | | 11| 4.71k|#define PARAMS_N 1344 ------------------ | Branch (32:18): [True: 4.70k, False: 14] ------------------ 33| 4.70k| seed_A_origin_0[0] = UINT16_TO_LE(kk + 0); ------------------ | | 35| 4.70k| #define UINT16_TO_LE(n) (n) ------------------ 34| 4.70k| seed_A_origin_1[0] = UINT16_TO_LE(kk + 1); ------------------ | | 35| 4.70k| #define UINT16_TO_LE(n) (n) ------------------ 35| 4.70k| seed_A_origin_2[0] = UINT16_TO_LE(kk + 2); ------------------ | | 35| 4.70k| #define UINT16_TO_LE(n) (n) ------------------ 36| 4.70k| seed_A_origin_3[0] = UINT16_TO_LE(kk + 3); ------------------ | | 35| 4.70k| #define UINT16_TO_LE(n) (n) ------------------ 37| 4.70k| OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 4.70k|#define PARAMS_N 1344 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 4.70k|#define PARAMS_N 1344 ------------------ OQS_SHA3_shake128_x4((unsigned char*)(a_cols), (unsigned char*)(a_cols + PARAMS_N), (unsigned char*)(a_cols + 2*PARAMS_N), (unsigned char*)(a_cols + 3*PARAMS_N), ------------------ | | 11| 4.70k|#define PARAMS_N 1344 ------------------ 38| 4.70k| (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 11| 4.70k|#define PARAMS_N 1344 ------------------ (unsigned long long)(2*PARAMS_N), seed_A_separated_0, seed_A_separated_1, seed_A_separated_2, seed_A_separated_3, 2 + BYTES_SEED_A); ------------------ | | 18| 4.70k|#define BYTES_SEED_A 16 ------------------ 39| | 40| 42.3k| for (i = 0; i < PARAMS_NBAR; i++) { ------------------ | | 12| 42.3k|#define PARAMS_NBAR 8 ------------------ | Branch (40:21): [True: 37.6k, False: 4.70k] ------------------ 41| 37.6k| __m256i a, b0, b1, b2, b3, acc[PARAMS_N/16]; 42| 37.6k| b0 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 0]); ------------------ | | 11| 37.6k|#define PARAMS_N 1344 ------------------ 43| 37.6k| b1 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 1]); ------------------ | | 11| 37.6k|#define PARAMS_N 1344 ------------------ 44| 37.6k| b2 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 2]); ------------------ | | 11| 37.6k|#define PARAMS_N 1344 ------------------ 45| 37.6k| b3 = _mm256_set1_epi16(s[i*PARAMS_N + kk + 3]); ------------------ | | 11| 37.6k|#define PARAMS_N 1344 ------------------ 46| 3.19M| for (j = 0; j < PARAMS_N; j+=16) { // Matrix-vector multiplication ------------------ | | 11| 3.19M|#define PARAMS_N 1344 ------------------ | Branch (46:25): [True: 3.16M, False: 37.6k] ------------------ 47| 3.16M| acc[j/16] = _mm256_load_si256((__m256i*)&out[i*PARAMS_N + j]); ------------------ | | 11| 3.16M|#define PARAMS_N 1344 ------------------ 48| 3.16M| a = _mm256_load_si256((__m256i*)&a_cols[(t+0)*PARAMS_N + j]); ------------------ | | 11| 3.16M|#define PARAMS_N 1344 ------------------ 49| 3.16M| a = _mm256_mullo_epi16(a, b0); 50| 3.16M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 51| 3.16M| a = _mm256_load_si256((__m256i*)&a_cols[(t+1)*PARAMS_N + j]); ------------------ | | 11| 3.16M|#define PARAMS_N 1344 ------------------ 52| 3.16M| a = _mm256_mullo_epi16(a, b1); 53| 3.16M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 54| 3.16M| a = _mm256_load_si256((__m256i*)&a_cols[(t+2)*PARAMS_N + j]); ------------------ | | 11| 3.16M|#define PARAMS_N 1344 ------------------ 55| 3.16M| a = _mm256_mullo_epi16(a, b2); 56| 3.16M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 57| 3.16M| a = _mm256_load_si256((__m256i*)&a_cols[(t+3)*PARAMS_N + j]); ------------------ | | 11| 3.16M|#define PARAMS_N 1344 ------------------ 58| 3.16M| a = _mm256_mullo_epi16(a, b3); 59| 3.16M| acc[j/16] = _mm256_add_epi16(a, acc[j/16]); 60| 3.16M| } 61| 3.19M| for (j = 0; j < PARAMS_N/16; j++) { ------------------ | | 11| 3.19M|#define PARAMS_N 1344 ------------------ | Branch (61:25): [True: 3.16M, False: 37.6k] ------------------ 62| 3.16M| _mm256_store_si256((__m256i*)&out[i*PARAMS_N + 16*j], acc[j]); ------------------ | | 11| 3.16M|#define PARAMS_N 1344 ------------------ 63| 3.16M| } 64| 37.6k| } 65| 4.70k| } 66| | 67| 14| return 1; 68| 14|} oqs_kem_frodokem_640_aes_sample_n: 8| 16|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 16| unsigned int i, j; 12| 16| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 25| 16|#define CDF_TABLE {4643, 13363, 20579, 25843, 29227, 31145, 32103, 32525, 32689, 32745, 32762, 32766, 32767} ------------------ 13| | 14| 61.7k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 61.6k, False: 16] ------------------ 15| 61.6k| uint16_t sample = 0; 16| 61.6k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 61.6k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 802k| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 26| 802k|#define CDF_TABLE_LEN 13 ------------------ | Branch (20:21): [True: 740k, False: 61.6k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 740k| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 740k| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 61.6k| s[i] = ((-sign) ^ sample) + sign; 26| 61.6k| } 27| 16|} oqs_kem_frodokem_640_shake_sample_n: 8| 24|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 24| unsigned int i, j; 12| 24| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 25| 24|#define CDF_TABLE {4643, 13363, 20579, 25843, 29227, 31145, 32103, 32525, 32689, 32745, 32762, 32766, 32767} ------------------ 13| | 14| 92.5k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 92.5k, False: 24] ------------------ 15| 92.5k| uint16_t sample = 0; 16| 92.5k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 92.5k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 1.20M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 26| 1.20M|#define CDF_TABLE_LEN 13 ------------------ | Branch (20:21): [True: 1.11M, False: 92.5k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 1.11M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 1.11M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 92.5k| s[i] = ((-sign) ^ sample) + sign; 26| 92.5k| } 27| 24|} oqs_kem_frodokem_976_aes_sample_n: 8| 72|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 72| unsigned int i, j; 12| 72| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 25| 72|#define CDF_TABLE {5638, 15915, 23689, 28571, 31116, 32217, 32613, 32731, 32760, 32766, 32767} ------------------ 13| | 14| 422k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 422k, False: 72] ------------------ 15| 422k| uint16_t sample = 0; 16| 422k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 422k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 4.65M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 26| 4.65M|#define CDF_TABLE_LEN 11 ------------------ | Branch (20:21): [True: 4.22M, False: 422k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 4.22M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 4.22M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 422k| s[i] = ((-sign) ^ sample) + sign; 26| 422k| } 27| 72|} oqs_kem_frodokem_976_shake_sample_n: 8| 72|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 72| unsigned int i, j; 12| 72| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 25| 72|#define CDF_TABLE {5638, 15915, 23689, 28571, 31116, 32217, 32613, 32731, 32760, 32766, 32767} ------------------ 13| | 14| 422k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 422k, False: 72] ------------------ 15| 422k| uint16_t sample = 0; 16| 422k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 422k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 4.65M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 26| 4.65M|#define CDF_TABLE_LEN 11 ------------------ | Branch (20:21): [True: 4.22M, False: 422k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 4.22M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 4.22M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 422k| s[i] = ((-sign) ^ sample) + sign; 26| 422k| } 27| 72|} oqs_kem_frodokem_1344_aes_sample_n: 8| 56|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 56| unsigned int i, j; 12| 56| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 25| 56|#define CDF_TABLE {9142, 23462, 30338, 32361, 32725, 32765, 32767} ------------------ 13| | 14| 452k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 452k, False: 56] ------------------ 15| 452k| uint16_t sample = 0; 16| 452k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 452k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 3.16M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 26| 3.16M|#define CDF_TABLE_LEN 7 ------------------ | Branch (20:21): [True: 2.71M, False: 452k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 2.71M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 2.71M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 452k| s[i] = ((-sign) ^ sample) + sign; 26| 452k| } 27| 56|} oqs_kem_frodokem_1344_shake_sample_n: 8| 48|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 48| unsigned int i, j; 12| 48| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 25| 48|#define CDF_TABLE {9142, 23462, 30338, 32361, 32725, 32765, 32767} ------------------ 13| | 14| 387k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 387k, False: 48] ------------------ 15| 387k| uint16_t sample = 0; 16| 387k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 387k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 2.71M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 26| 2.71M|#define CDF_TABLE_LEN 7 ------------------ | Branch (20:21): [True: 2.32M, False: 387k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 2.32M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 2.32M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 387k| s[i] = ((-sign) ^ sample) + sign; 26| 387k| } 27| 48|} oqs_kem_efrodokem_640_aes_sample_n: 8| 32|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 32| unsigned int i, j; 12| 32| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 23| 32|#define CDF_TABLE {4643, 13363, 20579, 25843, 29227, 31145, 32103, 32525, 32689, 32745, 32762, 32766, 32767} ------------------ 13| | 14| 123k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 123k, False: 32] ------------------ 15| 123k| uint16_t sample = 0; 16| 123k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 123k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 1.60M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 24| 1.60M|#define CDF_TABLE_LEN 13 ------------------ | Branch (20:21): [True: 1.48M, False: 123k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 1.48M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 1.48M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 123k| s[i] = ((-sign) ^ sample) + sign; 26| 123k| } 27| 32|} oqs_kem_efrodokem_640_shake_sample_n: 8| 16|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 16| unsigned int i, j; 12| 16| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 23| 16|#define CDF_TABLE {4643, 13363, 20579, 25843, 29227, 31145, 32103, 32525, 32689, 32745, 32762, 32766, 32767} ------------------ 13| | 14| 61.7k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 61.6k, False: 16] ------------------ 15| 61.6k| uint16_t sample = 0; 16| 61.6k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 61.6k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 802k| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 24| 802k|#define CDF_TABLE_LEN 13 ------------------ | Branch (20:21): [True: 740k, False: 61.6k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 740k| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 740k| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 61.6k| s[i] = ((-sign) ^ sample) + sign; 26| 61.6k| } 27| 16|} oqs_kem_efrodokem_976_aes_sample_n: 8| 72|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 72| unsigned int i, j; 12| 72| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 23| 72|#define CDF_TABLE {5638, 15915, 23689, 28571, 31116, 32217, 32613, 32731, 32760, 32766, 32767} ------------------ 13| | 14| 422k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 422k, False: 72] ------------------ 15| 422k| uint16_t sample = 0; 16| 422k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 422k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 4.65M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 24| 4.65M|#define CDF_TABLE_LEN 11 ------------------ | Branch (20:21): [True: 4.22M, False: 422k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 4.22M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 4.22M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 422k| s[i] = ((-sign) ^ sample) + sign; 26| 422k| } 27| 72|} oqs_kem_efrodokem_976_shake_sample_n: 8| 64|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 64| unsigned int i, j; 12| 64| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 23| 64|#define CDF_TABLE {5638, 15915, 23689, 28571, 31116, 32217, 32613, 32731, 32760, 32766, 32767} ------------------ 13| | 14| 375k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 375k, False: 64] ------------------ 15| 375k| uint16_t sample = 0; 16| 375k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 375k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 4.13M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 24| 4.13M|#define CDF_TABLE_LEN 11 ------------------ | Branch (20:21): [True: 3.75M, False: 375k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 3.75M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 3.75M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 375k| s[i] = ((-sign) ^ sample) + sign; 26| 375k| } 27| 64|} oqs_kem_efrodokem_1344_aes_sample_n: 8| 72|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 72| unsigned int i, j; 12| 72| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 23| 72|#define CDF_TABLE {9142, 23462, 30338, 32361, 32725, 32765, 32767} ------------------ 13| | 14| 581k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 581k, False: 72] ------------------ 15| 581k| uint16_t sample = 0; 16| 581k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 581k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 4.07M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 24| 4.07M|#define CDF_TABLE_LEN 7 ------------------ | Branch (20:21): [True: 3.49M, False: 581k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 3.49M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 3.49M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 581k| s[i] = ((-sign) ^ sample) + sign; 26| 581k| } 27| 72|} oqs_kem_efrodokem_1344_shake_sample_n: 8| 56|{ // Fills vector s with n samples from the noise distribution which requires 16 bits to sample. 9| | // The distribution is specified by its CDF. 10| | // Input: pseudo-random values (2*n bytes) passed in s. The input is overwritten by the output. 11| 56| unsigned int i, j; 12| 56| uint16_t cdf_table[CDF_TABLE_LEN] = CDF_TABLE; ------------------ | | 23| 56|#define CDF_TABLE {9142, 23462, 30338, 32361, 32725, 32765, 32767} ------------------ 13| | 14| 452k| for (i = 0; i < n; ++i) { ------------------ | Branch (14:17): [True: 452k, False: 56] ------------------ 15| 452k| uint16_t sample = 0; 16| 452k| uint16_t prnd = s[i] >> 1; // Drop the least significant bit 17| 452k| uint16_t sign = s[i] & 0x1; // Pick the least significant bit 18| | 19| | // No need to compare with the last value. 20| 3.16M| for (j = 0; j < (unsigned int)(CDF_TABLE_LEN - 1); j++) { ------------------ | | 24| 3.16M|#define CDF_TABLE_LEN 7 ------------------ | Branch (20:21): [True: 2.71M, False: 452k] ------------------ 21| | // Constant time comparison: 1 if CDF_TABLE[j] < s, 0 otherwise. Uses the fact that CDF_TABLE[j] and s fit in 15 bits. 22| 2.71M| sample += (uint16_t)(cdf_table[j] - prnd) >> 15; 23| 2.71M| } 24| | // Assuming that sign is either 0 or 1, flips sample iff sign = 1 25| 452k| s[i] = ((-sign) ^ sample) + sign; 26| 452k| } 27| 56|} oqs_kem_frodokem_640_aes_pack: 15| 6|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 6| memset(out, 0, outlen); 18| | 19| 6| size_t i = 0; // whole bytes already filled in 20| 6| size_t j = 0; // whole uint16_t already copied 21| 6| uint16_t w = 0; // the leftover, not yet copied 22| 6| unsigned char bits = 0; // the number of lsb in w 23| | 24| 38.6k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 38.6k, False: 6] | Branch (24:27): [True: 38.6k, False: 6] | Branch (24:41): [True: 6, False: 0] | Branch (24:57): [True: 6, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 38.6k| unsigned char b = 0; // bits in out[i] already filled in 37| 95.3k| while (b < 8) { ------------------ | Branch (37:16): [True: 56.6k, False: 38.6k] ------------------ 38| 56.6k| int nbits = min(8 - b, bits); ------------------ | | 11| 56.6k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 36.0k, False: 20.6k] | | ------------------ ------------------ 39| 56.6k| uint16_t mask = (1 << nbits) - 1; 40| 56.6k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 56.6k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 56.6k| b += nbits; 43| 56.6k| bits -= nbits; 44| 56.6k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 56.6k| if (bits == 0) { ------------------ | Branch (46:17): [True: 20.6k, False: 36.0k] ------------------ 47| 20.6k| if (j < inlen) { ------------------ | Branch (47:21): [True: 20.6k, False: 6] ------------------ 48| 20.6k| w = in[j]; 49| 20.6k| bits = lsb; 50| 20.6k| j++; 51| 20.6k| } else { 52| 6| break; // the input vector is exhausted 53| 6| } 54| 20.6k| } 55| 56.6k| } 56| 38.6k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 38.6k, False: 0] ------------------ 57| 38.6k| i++; 58| 38.6k| } 59| 38.6k| } 60| 6|} oqs_kem_frodokem_640_aes_unpack: 64| 8|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 8| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 8| size_t i = 0; // whole uint16_t already filled in 69| 8| size_t j = 0; // whole bytes already copied 70| 8| unsigned char w = 0; // the leftover, not yet copied 71| 8| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 30.8k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 30.8k, False: 8] | Branch (73:27): [True: 30.8k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 30.8k| unsigned char b = 0; // bits in out[i] already filled in 86| 115k| while (b < lsb) { ------------------ | Branch (86:16): [True: 84.8k, False: 30.8k] ------------------ 87| 84.8k| int nbits = min(lsb - b, bits); ------------------ | | 11| 84.8k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 26.9k, False: 57.8k] | | ------------------ ------------------ 88| 84.8k| uint16_t mask = (1 << nbits) - 1; 89| 84.8k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 84.8k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 84.8k| b += nbits; 92| 84.8k| bits -= nbits; 93| 84.8k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 84.8k| if (bits == 0) { ------------------ | Branch (95:17): [True: 57.8k, False: 26.9k] ------------------ 96| 57.8k| if (j < inlen) { ------------------ | Branch (96:21): [True: 57.8k, False: 8] ------------------ 97| 57.8k| w = in[j]; 98| 57.8k| bits = 8; 99| 57.8k| j++; 100| 57.8k| } else { 101| 8| break; // the input vector is exhausted 102| 8| } 103| 57.8k| } 104| 84.8k| } 105| 30.8k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 30.8k, False: 0] ------------------ 106| 30.8k| i++; 107| 30.8k| } 108| 30.8k| } 109| 8|} oqs_kem_frodokem_640_aes_ct_verify: 113| 4|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 4| uint16_t r = 0; 116| | 117| 10.3k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 10.3k, False: 4] ------------------ 118| 10.3k| r |= a[i] ^ b[i]; 119| 10.3k| } 120| | 121| 4| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 4| return (int8_t)r; 123| 4|} oqs_kem_frodokem_640_aes_ct_select: 127| 2|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 2| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 2| do { \ | | 59| 2| __asm__ volatile("" : "+r"(v) :); \ | | 60| 2| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 2] | | ------------------ ------------------ 130| 34| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 32, False: 2] ------------------ 131| 32| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 32| } 133| 2|} oqs_kem_frodokem_640_shake_pack: 15| 9|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 9| memset(out, 0, outlen); 18| | 19| 9| size_t i = 0; // whole bytes already filled in 20| 9| size_t j = 0; // whole uint16_t already copied 21| 9| uint16_t w = 0; // the leftover, not yet copied 22| 9| unsigned char bits = 0; // the number of lsb in w 23| | 24| 57.9k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 57.9k, False: 9] | Branch (24:27): [True: 57.9k, False: 9] | Branch (24:41): [True: 9, False: 0] | Branch (24:57): [True: 9, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 57.9k| unsigned char b = 0; // bits in out[i] already filled in 37| 142k| while (b < 8) { ------------------ | Branch (37:16): [True: 85.0k, False: 57.9k] ------------------ 38| 85.0k| int nbits = min(8 - b, bits); ------------------ | | 11| 85.0k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 54.0k, False: 30.9k] | | ------------------ ------------------ 39| 85.0k| uint16_t mask = (1 << nbits) - 1; 40| 85.0k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 85.0k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 85.0k| b += nbits; 43| 85.0k| bits -= nbits; 44| 85.0k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 85.0k| if (bits == 0) { ------------------ | Branch (46:17): [True: 30.9k, False: 54.0k] ------------------ 47| 30.9k| if (j < inlen) { ------------------ | Branch (47:21): [True: 30.9k, False: 9] ------------------ 48| 30.9k| w = in[j]; 49| 30.9k| bits = lsb; 50| 30.9k| j++; 51| 30.9k| } else { 52| 9| break; // the input vector is exhausted 53| 9| } 54| 30.9k| } 55| 85.0k| } 56| 57.9k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 57.9k, False: 0] ------------------ 57| 57.9k| i++; 58| 57.9k| } 59| 57.9k| } 60| 9|} oqs_kem_frodokem_640_shake_unpack: 64| 12|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 12| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 12| size_t i = 0; // whole uint16_t already filled in 69| 12| size_t j = 0; // whole bytes already copied 70| 12| unsigned char w = 0; // the leftover, not yet copied 71| 12| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 46.2k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 46.2k, False: 12] | Branch (73:27): [True: 46.2k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 46.2k| unsigned char b = 0; // bits in out[i] already filled in 86| 173k| while (b < lsb) { ------------------ | Branch (86:16): [True: 127k, False: 46.2k] ------------------ 87| 127k| int nbits = min(lsb - b, bits); ------------------ | | 11| 127k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 40.4k, False: 86.7k] | | ------------------ ------------------ 88| 127k| uint16_t mask = (1 << nbits) - 1; 89| 127k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 127k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 127k| b += nbits; 92| 127k| bits -= nbits; 93| 127k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 127k| if (bits == 0) { ------------------ | Branch (95:17): [True: 86.7k, False: 40.4k] ------------------ 96| 86.7k| if (j < inlen) { ------------------ | Branch (96:21): [True: 86.7k, False: 12] ------------------ 97| 86.7k| w = in[j]; 98| 86.7k| bits = 8; 99| 86.7k| j++; 100| 86.7k| } else { 101| 12| break; // the input vector is exhausted 102| 12| } 103| 86.7k| } 104| 127k| } 105| 46.2k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 46.2k, False: 0] ------------------ 106| 46.2k| i++; 107| 46.2k| } 108| 46.2k| } 109| 12|} oqs_kem_frodokem_640_shake_ct_verify: 113| 6|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 6| uint16_t r = 0; 116| | 117| 15.5k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 15.5k, False: 6] ------------------ 118| 15.5k| r |= a[i] ^ b[i]; 119| 15.5k| } 120| | 121| 6| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 6| return (int8_t)r; 123| 6|} oqs_kem_frodokem_640_shake_ct_select: 127| 3|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 3| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 3| do { \ | | 59| 3| __asm__ volatile("" : "+r"(v) :); \ | | 60| 3| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 3] | | ------------------ ------------------ 130| 51| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 48, False: 3] ------------------ 131| 48| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 48| } 133| 3|} oqs_kem_frodokem_976_aes_pack: 15| 27|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 27| memset(out, 0, outlen); 18| | 19| 27| size_t i = 0; // whole bytes already filled in 20| 27| size_t j = 0; // whole uint16_t already copied 21| 27| uint16_t w = 0; // the leftover, not yet copied 22| 27| unsigned char bits = 0; // the number of lsb in w 23| | 24| 282k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 282k, False: 27] | Branch (24:27): [True: 282k, False: 54] | Branch (24:41): [True: 54, False: 0] | Branch (24:57): [True: 54, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 282k| unsigned char b = 0; // bits in out[i] already filled in 37| 564k| while (b < 8) { ------------------ | Branch (37:16): [True: 282k, False: 282k] ------------------ 38| 282k| int nbits = min(8 - b, bits); ------------------ | | 11| 282k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 141k, False: 141k] | | ------------------ ------------------ 39| 282k| uint16_t mask = (1 << nbits) - 1; 40| 282k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 282k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 282k| b += nbits; 43| 282k| bits -= nbits; 44| 282k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 282k| if (bits == 0) { ------------------ | Branch (46:17): [True: 141k, False: 141k] ------------------ 47| 141k| if (j < inlen) { ------------------ | Branch (47:21): [True: 141k, False: 27] ------------------ 48| 141k| w = in[j]; 49| 141k| bits = lsb; 50| 141k| j++; 51| 141k| } else { 52| 27| break; // the input vector is exhausted 53| 27| } 54| 141k| } 55| 282k| } 56| 282k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 282k, False: 0] ------------------ 57| 282k| i++; 58| 282k| } 59| 282k| } 60| 27|} oqs_kem_frodokem_976_aes_unpack: 64| 36|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 36| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 36| size_t i = 0; // whole uint16_t already filled in 69| 36| size_t j = 0; // whole bytes already copied 70| 36| unsigned char w = 0; // the leftover, not yet copied 71| 36| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 211k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 211k, False: 36] | Branch (73:27): [True: 211k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 211k| unsigned char b = 0; // bits in out[i] already filled in 86| 634k| while (b < lsb) { ------------------ | Branch (86:16): [True: 422k, False: 211k] ------------------ 87| 422k| int nbits = min(lsb - b, bits); ------------------ | | 11| 422k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 0, False: 422k] | | ------------------ ------------------ 88| 422k| uint16_t mask = (1 << nbits) - 1; 89| 422k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 422k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 422k| b += nbits; 92| 422k| bits -= nbits; 93| 422k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 422k| if (bits == 0) { ------------------ | Branch (95:17): [True: 422k, False: 0] ------------------ 96| 422k| if (j < inlen) { ------------------ | Branch (96:21): [True: 422k, False: 36] ------------------ 97| 422k| w = in[j]; 98| 422k| bits = 8; 99| 422k| j++; 100| 422k| } else { 101| 36| break; // the input vector is exhausted 102| 36| } 103| 422k| } 104| 422k| } 105| 211k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 211k, False: 0] ------------------ 106| 211k| i++; 107| 211k| } 108| 211k| } 109| 36|} oqs_kem_frodokem_976_aes_ct_verify: 113| 18|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 18| uint16_t r = 0; 116| | 117| 70.8k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 70.8k, False: 18] ------------------ 118| 70.8k| r |= a[i] ^ b[i]; 119| 70.8k| } 120| | 121| 18| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 18| return (int8_t)r; 123| 18|} oqs_kem_frodokem_976_aes_ct_select: 127| 9|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 9| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 9| do { \ | | 59| 9| __asm__ volatile("" : "+r"(v) :); \ | | 60| 9| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 9] | | ------------------ ------------------ 130| 225| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 216, False: 9] ------------------ 131| 216| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 216| } 133| 9|} oqs_kem_frodokem_976_shake_pack: 15| 27|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 27| memset(out, 0, outlen); 18| | 19| 27| size_t i = 0; // whole bytes already filled in 20| 27| size_t j = 0; // whole uint16_t already copied 21| 27| uint16_t w = 0; // the leftover, not yet copied 22| 27| unsigned char bits = 0; // the number of lsb in w 23| | 24| 282k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 282k, False: 27] | Branch (24:27): [True: 282k, False: 54] | Branch (24:41): [True: 54, False: 0] | Branch (24:57): [True: 54, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 282k| unsigned char b = 0; // bits in out[i] already filled in 37| 564k| while (b < 8) { ------------------ | Branch (37:16): [True: 282k, False: 282k] ------------------ 38| 282k| int nbits = min(8 - b, bits); ------------------ | | 11| 282k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 141k, False: 141k] | | ------------------ ------------------ 39| 282k| uint16_t mask = (1 << nbits) - 1; 40| 282k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 282k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 282k| b += nbits; 43| 282k| bits -= nbits; 44| 282k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 282k| if (bits == 0) { ------------------ | Branch (46:17): [True: 141k, False: 141k] ------------------ 47| 141k| if (j < inlen) { ------------------ | Branch (47:21): [True: 141k, False: 27] ------------------ 48| 141k| w = in[j]; 49| 141k| bits = lsb; 50| 141k| j++; 51| 141k| } else { 52| 27| break; // the input vector is exhausted 53| 27| } 54| 141k| } 55| 282k| } 56| 282k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 282k, False: 0] ------------------ 57| 282k| i++; 58| 282k| } 59| 282k| } 60| 27|} oqs_kem_frodokem_976_shake_unpack: 64| 36|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 36| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 36| size_t i = 0; // whole uint16_t already filled in 69| 36| size_t j = 0; // whole bytes already copied 70| 36| unsigned char w = 0; // the leftover, not yet copied 71| 36| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 211k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 211k, False: 36] | Branch (73:27): [True: 211k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 211k| unsigned char b = 0; // bits in out[i] already filled in 86| 634k| while (b < lsb) { ------------------ | Branch (86:16): [True: 422k, False: 211k] ------------------ 87| 422k| int nbits = min(lsb - b, bits); ------------------ | | 11| 422k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 0, False: 422k] | | ------------------ ------------------ 88| 422k| uint16_t mask = (1 << nbits) - 1; 89| 422k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 422k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 422k| b += nbits; 92| 422k| bits -= nbits; 93| 422k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 422k| if (bits == 0) { ------------------ | Branch (95:17): [True: 422k, False: 0] ------------------ 96| 422k| if (j < inlen) { ------------------ | Branch (96:21): [True: 422k, False: 36] ------------------ 97| 422k| w = in[j]; 98| 422k| bits = 8; 99| 422k| j++; 100| 422k| } else { 101| 36| break; // the input vector is exhausted 102| 36| } 103| 422k| } 104| 422k| } 105| 211k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 211k, False: 0] ------------------ 106| 211k| i++; 107| 211k| } 108| 211k| } 109| 36|} oqs_kem_frodokem_976_shake_ct_verify: 113| 18|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 18| uint16_t r = 0; 116| | 117| 70.8k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 70.8k, False: 18] ------------------ 118| 70.8k| r |= a[i] ^ b[i]; 119| 70.8k| } 120| | 121| 18| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 18| return (int8_t)r; 123| 18|} oqs_kem_frodokem_976_shake_ct_select: 127| 9|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 9| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 9| do { \ | | 59| 9| __asm__ volatile("" : "+r"(v) :); \ | | 60| 9| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 9] | | ------------------ ------------------ 130| 225| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 216, False: 9] ------------------ 131| 216| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 216| } 133| 9|} oqs_kem_frodokem_1344_aes_pack: 15| 21|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 21| memset(out, 0, outlen); 18| | 19| 21| size_t i = 0; // whole bytes already filled in 20| 21| size_t j = 0; // whole uint16_t already copied 21| 21| uint16_t w = 0; // the leftover, not yet copied 22| 21| unsigned char bits = 0; // the number of lsb in w 23| | 24| 301k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 301k, False: 21] | Branch (24:27): [True: 301k, False: 42] | Branch (24:41): [True: 42, False: 0] | Branch (24:57): [True: 42, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 301k| unsigned char b = 0; // bits in out[i] already filled in 37| 603k| while (b < 8) { ------------------ | Branch (37:16): [True: 301k, False: 301k] ------------------ 38| 301k| int nbits = min(8 - b, bits); ------------------ | | 11| 301k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 150k, False: 150k] | | ------------------ ------------------ 39| 301k| uint16_t mask = (1 << nbits) - 1; 40| 301k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 301k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 301k| b += nbits; 43| 301k| bits -= nbits; 44| 301k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 301k| if (bits == 0) { ------------------ | Branch (46:17): [True: 150k, False: 150k] ------------------ 47| 150k| if (j < inlen) { ------------------ | Branch (47:21): [True: 150k, False: 21] ------------------ 48| 150k| w = in[j]; 49| 150k| bits = lsb; 50| 150k| j++; 51| 150k| } else { 52| 21| break; // the input vector is exhausted 53| 21| } 54| 150k| } 55| 301k| } 56| 301k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 301k, False: 0] ------------------ 57| 301k| i++; 58| 301k| } 59| 301k| } 60| 21|} oqs_kem_frodokem_1344_aes_unpack: 64| 28|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 28| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 28| size_t i = 0; // whole uint16_t already filled in 69| 28| size_t j = 0; // whole bytes already copied 70| 28| unsigned char w = 0; // the leftover, not yet copied 71| 28| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 226k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 226k, False: 28] | Branch (73:27): [True: 226k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 226k| unsigned char b = 0; // bits in out[i] already filled in 86| 678k| while (b < lsb) { ------------------ | Branch (86:16): [True: 452k, False: 226k] ------------------ 87| 452k| int nbits = min(lsb - b, bits); ------------------ | | 11| 452k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 0, False: 452k] | | ------------------ ------------------ 88| 452k| uint16_t mask = (1 << nbits) - 1; 89| 452k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 452k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 452k| b += nbits; 92| 452k| bits -= nbits; 93| 452k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 452k| if (bits == 0) { ------------------ | Branch (95:17): [True: 452k, False: 0] ------------------ 96| 452k| if (j < inlen) { ------------------ | Branch (96:21): [True: 452k, False: 28] ------------------ 97| 452k| w = in[j]; 98| 452k| bits = 8; 99| 452k| j++; 100| 452k| } else { 101| 28| break; // the input vector is exhausted 102| 28| } 103| 452k| } 104| 452k| } 105| 226k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 226k, False: 0] ------------------ 106| 226k| i++; 107| 226k| } 108| 226k| } 109| 28|} oqs_kem_frodokem_1344_aes_ct_verify: 113| 14|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 14| uint16_t r = 0; 116| | 117| 75.7k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 75.7k, False: 14] ------------------ 118| 75.7k| r |= a[i] ^ b[i]; 119| 75.7k| } 120| | 121| 14| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 14| return (int8_t)r; 123| 14|} oqs_kem_frodokem_1344_aes_ct_select: 127| 7|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 7| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 7| do { \ | | 59| 7| __asm__ volatile("" : "+r"(v) :); \ | | 60| 7| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 7] | | ------------------ ------------------ 130| 231| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 224, False: 7] ------------------ 131| 224| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 224| } 133| 7|} oqs_kem_frodokem_1344_shake_pack: 15| 18|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 18| memset(out, 0, outlen); 18| | 19| 18| size_t i = 0; // whole bytes already filled in 20| 18| size_t j = 0; // whole uint16_t already copied 21| 18| uint16_t w = 0; // the leftover, not yet copied 22| 18| unsigned char bits = 0; // the number of lsb in w 23| | 24| 258k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 258k, False: 18] | Branch (24:27): [True: 258k, False: 36] | Branch (24:41): [True: 36, False: 0] | Branch (24:57): [True: 36, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 258k| unsigned char b = 0; // bits in out[i] already filled in 37| 517k| while (b < 8) { ------------------ | Branch (37:16): [True: 258k, False: 258k] ------------------ 38| 258k| int nbits = min(8 - b, bits); ------------------ | | 11| 258k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 129k, False: 129k] | | ------------------ ------------------ 39| 258k| uint16_t mask = (1 << nbits) - 1; 40| 258k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 258k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 258k| b += nbits; 43| 258k| bits -= nbits; 44| 258k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 258k| if (bits == 0) { ------------------ | Branch (46:17): [True: 129k, False: 129k] ------------------ 47| 129k| if (j < inlen) { ------------------ | Branch (47:21): [True: 129k, False: 18] ------------------ 48| 129k| w = in[j]; 49| 129k| bits = lsb; 50| 129k| j++; 51| 129k| } else { 52| 18| break; // the input vector is exhausted 53| 18| } 54| 129k| } 55| 258k| } 56| 258k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 258k, False: 0] ------------------ 57| 258k| i++; 58| 258k| } 59| 258k| } 60| 18|} oqs_kem_frodokem_1344_shake_unpack: 64| 24|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 24| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 24| size_t i = 0; // whole uint16_t already filled in 69| 24| size_t j = 0; // whole bytes already copied 70| 24| unsigned char w = 0; // the leftover, not yet copied 71| 24| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 193k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 193k, False: 24] | Branch (73:27): [True: 193k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 193k| unsigned char b = 0; // bits in out[i] already filled in 86| 581k| while (b < lsb) { ------------------ | Branch (86:16): [True: 387k, False: 193k] ------------------ 87| 387k| int nbits = min(lsb - b, bits); ------------------ | | 11| 387k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 0, False: 387k] | | ------------------ ------------------ 88| 387k| uint16_t mask = (1 << nbits) - 1; 89| 387k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 387k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 387k| b += nbits; 92| 387k| bits -= nbits; 93| 387k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 387k| if (bits == 0) { ------------------ | Branch (95:17): [True: 387k, False: 0] ------------------ 96| 387k| if (j < inlen) { ------------------ | Branch (96:21): [True: 387k, False: 24] ------------------ 97| 387k| w = in[j]; 98| 387k| bits = 8; 99| 387k| j++; 100| 387k| } else { 101| 24| break; // the input vector is exhausted 102| 24| } 103| 387k| } 104| 387k| } 105| 193k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 193k, False: 0] ------------------ 106| 193k| i++; 107| 193k| } 108| 193k| } 109| 24|} oqs_kem_frodokem_1344_shake_ct_verify: 113| 12|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 12| uint16_t r = 0; 116| | 117| 64.9k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 64.8k, False: 12] ------------------ 118| 64.8k| r |= a[i] ^ b[i]; 119| 64.8k| } 120| | 121| 12| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 12| return (int8_t)r; 123| 12|} oqs_kem_frodokem_1344_shake_ct_select: 127| 6|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 6| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 6| do { \ | | 59| 6| __asm__ volatile("" : "+r"(v) :); \ | | 60| 6| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 6] | | ------------------ ------------------ 130| 198| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 192, False: 6] ------------------ 131| 192| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 192| } 133| 6|} oqs_kem_efrodokem_640_aes_pack: 15| 12|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 12| memset(out, 0, outlen); 18| | 19| 12| size_t i = 0; // whole bytes already filled in 20| 12| size_t j = 0; // whole uint16_t already copied 21| 12| uint16_t w = 0; // the leftover, not yet copied 22| 12| unsigned char bits = 0; // the number of lsb in w 23| | 24| 77.2k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 77.2k, False: 12] | Branch (24:27): [True: 77.2k, False: 12] | Branch (24:41): [True: 12, False: 0] | Branch (24:57): [True: 12, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 77.2k| unsigned char b = 0; // bits in out[i] already filled in 37| 190k| while (b < 8) { ------------------ | Branch (37:16): [True: 113k, False: 77.2k] ------------------ 38| 113k| int nbits = min(8 - b, bits); ------------------ | | 11| 113k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 72.1k, False: 41.2k] | | ------------------ ------------------ 39| 113k| uint16_t mask = (1 << nbits) - 1; 40| 113k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 113k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 113k| b += nbits; 43| 113k| bits -= nbits; 44| 113k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 113k| if (bits == 0) { ------------------ | Branch (46:17): [True: 41.2k, False: 72.1k] ------------------ 47| 41.2k| if (j < inlen) { ------------------ | Branch (47:21): [True: 41.2k, False: 12] ------------------ 48| 41.2k| w = in[j]; 49| 41.2k| bits = lsb; 50| 41.2k| j++; 51| 41.2k| } else { 52| 12| break; // the input vector is exhausted 53| 12| } 54| 41.2k| } 55| 113k| } 56| 77.2k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 77.2k, False: 0] ------------------ 57| 77.2k| i++; 58| 77.2k| } 59| 77.2k| } 60| 12|} oqs_kem_efrodokem_640_aes_unpack: 64| 16|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 16| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 16| size_t i = 0; // whole uint16_t already filled in 69| 16| size_t j = 0; // whole bytes already copied 70| 16| unsigned char w = 0; // the leftover, not yet copied 71| 16| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 61.7k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 61.6k, False: 16] | Branch (73:27): [True: 61.6k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 61.6k| unsigned char b = 0; // bits in out[i] already filled in 86| 231k| while (b < lsb) { ------------------ | Branch (86:16): [True: 169k, False: 61.6k] ------------------ 87| 169k| int nbits = min(lsb - b, bits); ------------------ | | 11| 169k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 53.9k, False: 115k] | | ------------------ ------------------ 88| 169k| uint16_t mask = (1 << nbits) - 1; 89| 169k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 169k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 169k| b += nbits; 92| 169k| bits -= nbits; 93| 169k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 169k| if (bits == 0) { ------------------ | Branch (95:17): [True: 115k, False: 53.9k] ------------------ 96| 115k| if (j < inlen) { ------------------ | Branch (96:21): [True: 115k, False: 16] ------------------ 97| 115k| w = in[j]; 98| 115k| bits = 8; 99| 115k| j++; 100| 115k| } else { 101| 16| break; // the input vector is exhausted 102| 16| } 103| 115k| } 104| 169k| } 105| 61.6k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 61.6k, False: 0] ------------------ 106| 61.6k| i++; 107| 61.6k| } 108| 61.6k| } 109| 16|} oqs_kem_efrodokem_640_aes_ct_verify: 113| 8|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 8| uint16_t r = 0; 116| | 117| 20.7k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 20.7k, False: 8] ------------------ 118| 20.7k| r |= a[i] ^ b[i]; 119| 20.7k| } 120| | 121| 8| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 8| return (int8_t)r; 123| 8|} oqs_kem_efrodokem_640_aes_ct_select: 127| 4|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 4| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 4| do { \ | | 59| 4| __asm__ volatile("" : "+r"(v) :); \ | | 60| 4| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 4] | | ------------------ ------------------ 130| 68| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 64, False: 4] ------------------ 131| 64| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 64| } 133| 4|} oqs_kem_efrodokem_640_shake_pack: 15| 6|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 6| memset(out, 0, outlen); 18| | 19| 6| size_t i = 0; // whole bytes already filled in 20| 6| size_t j = 0; // whole uint16_t already copied 21| 6| uint16_t w = 0; // the leftover, not yet copied 22| 6| unsigned char bits = 0; // the number of lsb in w 23| | 24| 38.6k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 38.6k, False: 6] | Branch (24:27): [True: 38.6k, False: 6] | Branch (24:41): [True: 6, False: 0] | Branch (24:57): [True: 6, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 38.6k| unsigned char b = 0; // bits in out[i] already filled in 37| 95.3k| while (b < 8) { ------------------ | Branch (37:16): [True: 56.6k, False: 38.6k] ------------------ 38| 56.6k| int nbits = min(8 - b, bits); ------------------ | | 11| 56.6k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 36.0k, False: 20.6k] | | ------------------ ------------------ 39| 56.6k| uint16_t mask = (1 << nbits) - 1; 40| 56.6k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 56.6k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 56.6k| b += nbits; 43| 56.6k| bits -= nbits; 44| 56.6k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 56.6k| if (bits == 0) { ------------------ | Branch (46:17): [True: 20.6k, False: 36.0k] ------------------ 47| 20.6k| if (j < inlen) { ------------------ | Branch (47:21): [True: 20.6k, False: 6] ------------------ 48| 20.6k| w = in[j]; 49| 20.6k| bits = lsb; 50| 20.6k| j++; 51| 20.6k| } else { 52| 6| break; // the input vector is exhausted 53| 6| } 54| 20.6k| } 55| 56.6k| } 56| 38.6k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 38.6k, False: 0] ------------------ 57| 38.6k| i++; 58| 38.6k| } 59| 38.6k| } 60| 6|} oqs_kem_efrodokem_640_shake_unpack: 64| 8|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 8| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 8| size_t i = 0; // whole uint16_t already filled in 69| 8| size_t j = 0; // whole bytes already copied 70| 8| unsigned char w = 0; // the leftover, not yet copied 71| 8| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 30.8k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 30.8k, False: 8] | Branch (73:27): [True: 30.8k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 30.8k| unsigned char b = 0; // bits in out[i] already filled in 86| 115k| while (b < lsb) { ------------------ | Branch (86:16): [True: 84.8k, False: 30.8k] ------------------ 87| 84.8k| int nbits = min(lsb - b, bits); ------------------ | | 11| 84.8k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 26.9k, False: 57.8k] | | ------------------ ------------------ 88| 84.8k| uint16_t mask = (1 << nbits) - 1; 89| 84.8k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 84.8k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 84.8k| b += nbits; 92| 84.8k| bits -= nbits; 93| 84.8k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 84.8k| if (bits == 0) { ------------------ | Branch (95:17): [True: 57.8k, False: 26.9k] ------------------ 96| 57.8k| if (j < inlen) { ------------------ | Branch (96:21): [True: 57.8k, False: 8] ------------------ 97| 57.8k| w = in[j]; 98| 57.8k| bits = 8; 99| 57.8k| j++; 100| 57.8k| } else { 101| 8| break; // the input vector is exhausted 102| 8| } 103| 57.8k| } 104| 84.8k| } 105| 30.8k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 30.8k, False: 0] ------------------ 106| 30.8k| i++; 107| 30.8k| } 108| 30.8k| } 109| 8|} oqs_kem_efrodokem_640_shake_ct_verify: 113| 4|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 4| uint16_t r = 0; 116| | 117| 10.3k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 10.3k, False: 4] ------------------ 118| 10.3k| r |= a[i] ^ b[i]; 119| 10.3k| } 120| | 121| 4| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 4| return (int8_t)r; 123| 4|} oqs_kem_efrodokem_640_shake_ct_select: 127| 2|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 2| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 2| do { \ | | 59| 2| __asm__ volatile("" : "+r"(v) :); \ | | 60| 2| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 2] | | ------------------ ------------------ 130| 34| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 32, False: 2] ------------------ 131| 32| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 32| } 133| 2|} oqs_kem_efrodokem_976_aes_pack: 15| 27|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 27| memset(out, 0, outlen); 18| | 19| 27| size_t i = 0; // whole bytes already filled in 20| 27| size_t j = 0; // whole uint16_t already copied 21| 27| uint16_t w = 0; // the leftover, not yet copied 22| 27| unsigned char bits = 0; // the number of lsb in w 23| | 24| 282k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 282k, False: 27] | Branch (24:27): [True: 282k, False: 54] | Branch (24:41): [True: 54, False: 0] | Branch (24:57): [True: 54, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 282k| unsigned char b = 0; // bits in out[i] already filled in 37| 564k| while (b < 8) { ------------------ | Branch (37:16): [True: 282k, False: 282k] ------------------ 38| 282k| int nbits = min(8 - b, bits); ------------------ | | 11| 282k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 141k, False: 141k] | | ------------------ ------------------ 39| 282k| uint16_t mask = (1 << nbits) - 1; 40| 282k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 282k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 282k| b += nbits; 43| 282k| bits -= nbits; 44| 282k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 282k| if (bits == 0) { ------------------ | Branch (46:17): [True: 141k, False: 141k] ------------------ 47| 141k| if (j < inlen) { ------------------ | Branch (47:21): [True: 141k, False: 27] ------------------ 48| 141k| w = in[j]; 49| 141k| bits = lsb; 50| 141k| j++; 51| 141k| } else { 52| 27| break; // the input vector is exhausted 53| 27| } 54| 141k| } 55| 282k| } 56| 282k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 282k, False: 0] ------------------ 57| 282k| i++; 58| 282k| } 59| 282k| } 60| 27|} oqs_kem_efrodokem_976_aes_unpack: 64| 36|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 36| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 36| size_t i = 0; // whole uint16_t already filled in 69| 36| size_t j = 0; // whole bytes already copied 70| 36| unsigned char w = 0; // the leftover, not yet copied 71| 36| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 211k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 211k, False: 36] | Branch (73:27): [True: 211k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 211k| unsigned char b = 0; // bits in out[i] already filled in 86| 634k| while (b < lsb) { ------------------ | Branch (86:16): [True: 422k, False: 211k] ------------------ 87| 422k| int nbits = min(lsb - b, bits); ------------------ | | 11| 422k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 0, False: 422k] | | ------------------ ------------------ 88| 422k| uint16_t mask = (1 << nbits) - 1; 89| 422k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 422k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 422k| b += nbits; 92| 422k| bits -= nbits; 93| 422k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 422k| if (bits == 0) { ------------------ | Branch (95:17): [True: 422k, False: 0] ------------------ 96| 422k| if (j < inlen) { ------------------ | Branch (96:21): [True: 422k, False: 36] ------------------ 97| 422k| w = in[j]; 98| 422k| bits = 8; 99| 422k| j++; 100| 422k| } else { 101| 36| break; // the input vector is exhausted 102| 36| } 103| 422k| } 104| 422k| } 105| 211k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 211k, False: 0] ------------------ 106| 211k| i++; 107| 211k| } 108| 211k| } 109| 36|} oqs_kem_efrodokem_976_aes_ct_verify: 113| 18|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 18| uint16_t r = 0; 116| | 117| 70.8k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 70.8k, False: 18] ------------------ 118| 70.8k| r |= a[i] ^ b[i]; 119| 70.8k| } 120| | 121| 18| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 18| return (int8_t)r; 123| 18|} oqs_kem_efrodokem_976_aes_ct_select: 127| 9|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 9| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 9| do { \ | | 59| 9| __asm__ volatile("" : "+r"(v) :); \ | | 60| 9| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 9] | | ------------------ ------------------ 130| 225| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 216, False: 9] ------------------ 131| 216| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 216| } 133| 9|} oqs_kem_efrodokem_976_shake_pack: 15| 24|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 24| memset(out, 0, outlen); 18| | 19| 24| size_t i = 0; // whole bytes already filled in 20| 24| size_t j = 0; // whole uint16_t already copied 21| 24| uint16_t w = 0; // the leftover, not yet copied 22| 24| unsigned char bits = 0; // the number of lsb in w 23| | 24| 250k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 250k, False: 24] | Branch (24:27): [True: 250k, False: 48] | Branch (24:41): [True: 48, False: 0] | Branch (24:57): [True: 48, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 250k| unsigned char b = 0; // bits in out[i] already filled in 37| 501k| while (b < 8) { ------------------ | Branch (37:16): [True: 250k, False: 250k] ------------------ 38| 250k| int nbits = min(8 - b, bits); ------------------ | | 11| 250k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 125k, False: 125k] | | ------------------ ------------------ 39| 250k| uint16_t mask = (1 << nbits) - 1; 40| 250k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 250k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 250k| b += nbits; 43| 250k| bits -= nbits; 44| 250k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 250k| if (bits == 0) { ------------------ | Branch (46:17): [True: 125k, False: 125k] ------------------ 47| 125k| if (j < inlen) { ------------------ | Branch (47:21): [True: 125k, False: 24] ------------------ 48| 125k| w = in[j]; 49| 125k| bits = lsb; 50| 125k| j++; 51| 125k| } else { 52| 24| break; // the input vector is exhausted 53| 24| } 54| 125k| } 55| 250k| } 56| 250k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 250k, False: 0] ------------------ 57| 250k| i++; 58| 250k| } 59| 250k| } 60| 24|} oqs_kem_efrodokem_976_shake_unpack: 64| 32|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 32| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 32| size_t i = 0; // whole uint16_t already filled in 69| 32| size_t j = 0; // whole bytes already copied 70| 32| unsigned char w = 0; // the leftover, not yet copied 71| 32| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 187k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 187k, False: 32] | Branch (73:27): [True: 187k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 187k| unsigned char b = 0; // bits in out[i] already filled in 86| 563k| while (b < lsb) { ------------------ | Branch (86:16): [True: 375k, False: 187k] ------------------ 87| 375k| int nbits = min(lsb - b, bits); ------------------ | | 11| 375k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 0, False: 375k] | | ------------------ ------------------ 88| 375k| uint16_t mask = (1 << nbits) - 1; 89| 375k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 375k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 375k| b += nbits; 92| 375k| bits -= nbits; 93| 375k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 375k| if (bits == 0) { ------------------ | Branch (95:17): [True: 375k, False: 0] ------------------ 96| 375k| if (j < inlen) { ------------------ | Branch (96:21): [True: 375k, False: 32] ------------------ 97| 375k| w = in[j]; 98| 375k| bits = 8; 99| 375k| j++; 100| 375k| } else { 101| 32| break; // the input vector is exhausted 102| 32| } 103| 375k| } 104| 375k| } 105| 187k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 187k, False: 0] ------------------ 106| 187k| i++; 107| 187k| } 108| 187k| } 109| 32|} oqs_kem_efrodokem_976_shake_ct_verify: 113| 16|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 16| uint16_t r = 0; 116| | 117| 62.9k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 62.9k, False: 16] ------------------ 118| 62.9k| r |= a[i] ^ b[i]; 119| 62.9k| } 120| | 121| 16| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 16| return (int8_t)r; 123| 16|} oqs_kem_efrodokem_976_shake_ct_select: 127| 8|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 8| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 8| do { \ | | 59| 8| __asm__ volatile("" : "+r"(v) :); \ | | 60| 8| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 8] | | ------------------ ------------------ 130| 200| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 192, False: 8] ------------------ 131| 192| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 192| } 133| 8|} oqs_kem_efrodokem_1344_aes_pack: 15| 27|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 27| memset(out, 0, outlen); 18| | 19| 27| size_t i = 0; // whole bytes already filled in 20| 27| size_t j = 0; // whole uint16_t already copied 21| 27| uint16_t w = 0; // the leftover, not yet copied 22| 27| unsigned char bits = 0; // the number of lsb in w 23| | 24| 388k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 388k, False: 27] | Branch (24:27): [True: 388k, False: 54] | Branch (24:41): [True: 54, False: 0] | Branch (24:57): [True: 54, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 388k| unsigned char b = 0; // bits in out[i] already filled in 37| 776k| while (b < 8) { ------------------ | Branch (37:16): [True: 388k, False: 388k] ------------------ 38| 388k| int nbits = min(8 - b, bits); ------------------ | | 11| 388k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 194k, False: 194k] | | ------------------ ------------------ 39| 388k| uint16_t mask = (1 << nbits) - 1; 40| 388k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 388k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 388k| b += nbits; 43| 388k| bits -= nbits; 44| 388k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 388k| if (bits == 0) { ------------------ | Branch (46:17): [True: 194k, False: 194k] ------------------ 47| 194k| if (j < inlen) { ------------------ | Branch (47:21): [True: 194k, False: 27] ------------------ 48| 194k| w = in[j]; 49| 194k| bits = lsb; 50| 194k| j++; 51| 194k| } else { 52| 27| break; // the input vector is exhausted 53| 27| } 54| 194k| } 55| 388k| } 56| 388k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 388k, False: 0] ------------------ 57| 388k| i++; 58| 388k| } 59| 388k| } 60| 27|} oqs_kem_efrodokem_1344_aes_unpack: 64| 36|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 36| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 36| size_t i = 0; // whole uint16_t already filled in 69| 36| size_t j = 0; // whole bytes already copied 70| 36| unsigned char w = 0; // the leftover, not yet copied 71| 36| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 290k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 290k, False: 36] | Branch (73:27): [True: 290k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 290k| unsigned char b = 0; // bits in out[i] already filled in 86| 872k| while (b < lsb) { ------------------ | Branch (86:16): [True: 581k, False: 290k] ------------------ 87| 581k| int nbits = min(lsb - b, bits); ------------------ | | 11| 581k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 0, False: 581k] | | ------------------ ------------------ 88| 581k| uint16_t mask = (1 << nbits) - 1; 89| 581k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 581k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 581k| b += nbits; 92| 581k| bits -= nbits; 93| 581k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 581k| if (bits == 0) { ------------------ | Branch (95:17): [True: 581k, False: 0] ------------------ 96| 581k| if (j < inlen) { ------------------ | Branch (96:21): [True: 581k, False: 36] ------------------ 97| 581k| w = in[j]; 98| 581k| bits = 8; 99| 581k| j++; 100| 581k| } else { 101| 36| break; // the input vector is exhausted 102| 36| } 103| 581k| } 104| 581k| } 105| 290k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 290k, False: 0] ------------------ 106| 290k| i++; 107| 290k| } 108| 290k| } 109| 36|} oqs_kem_efrodokem_1344_aes_ct_verify: 113| 18|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 18| uint16_t r = 0; 116| | 117| 97.3k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 97.3k, False: 18] ------------------ 118| 97.3k| r |= a[i] ^ b[i]; 119| 97.3k| } 120| | 121| 18| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 18| return (int8_t)r; 123| 18|} oqs_kem_efrodokem_1344_aes_ct_select: 127| 9|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 9| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 9| do { \ | | 59| 9| __asm__ volatile("" : "+r"(v) :); \ | | 60| 9| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 9] | | ------------------ ------------------ 130| 297| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 288, False: 9] ------------------ 131| 288| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 288| } 133| 9|} oqs_kem_efrodokem_1344_shake_pack: 15| 21|{ // Pack the input uint16 vector into a char output vector, copying lsb bits from each input element. 16| | // If inlen * lsb / 8 > outlen, only outlen * 8 bits are copied. 17| 21| memset(out, 0, outlen); 18| | 19| 21| size_t i = 0; // whole bytes already filled in 20| 21| size_t j = 0; // whole uint16_t already copied 21| 21| uint16_t w = 0; // the leftover, not yet copied 22| 21| unsigned char bits = 0; // the number of lsb in w 23| | 24| 301k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (24:12): [True: 301k, False: 21] | Branch (24:27): [True: 301k, False: 42] | Branch (24:41): [True: 42, False: 0] | Branch (24:57): [True: 42, False: 0] ------------------ 25| | /* 26| | in: | | |********|********| 27| | ^ 28| | j 29| | w : | ****| 30| | ^ 31| | bits 32| | out:|**|**|**|**|**|**|**|**|* | 33| | ^^ 34| | ib 35| | */ 36| 301k| unsigned char b = 0; // bits in out[i] already filled in 37| 603k| while (b < 8) { ------------------ | Branch (37:16): [True: 301k, False: 301k] ------------------ 38| 301k| int nbits = min(8 - b, bits); ------------------ | | 11| 301k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 150k, False: 150k] | | ------------------ ------------------ 39| 301k| uint16_t mask = (1 << nbits) - 1; 40| 301k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 41| 301k| out[i] = out[i] + (t << (8 - b - nbits)); 42| 301k| b += nbits; 43| 301k| bits -= nbits; 44| 301k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 45| | 46| 301k| if (bits == 0) { ------------------ | Branch (46:17): [True: 150k, False: 150k] ------------------ 47| 150k| if (j < inlen) { ------------------ | Branch (47:21): [True: 150k, False: 21] ------------------ 48| 150k| w = in[j]; 49| 150k| bits = lsb; 50| 150k| j++; 51| 150k| } else { 52| 21| break; // the input vector is exhausted 53| 21| } 54| 150k| } 55| 301k| } 56| 301k| if (b == 8) { // out[i] is filled in ------------------ | Branch (56:13): [True: 301k, False: 0] ------------------ 57| 301k| i++; 58| 301k| } 59| 301k| } 60| 21|} oqs_kem_efrodokem_1344_shake_unpack: 64| 28|{ // Unpack the input char vector into a uint16_t output vector, copying lsb bits 65| | // for each output element from input. outlen must be at least ceil(inlen * 8 / lsb). 66| 28| memset(out, 0, outlen * sizeof(uint16_t)); 67| | 68| 28| size_t i = 0; // whole uint16_t already filled in 69| 28| size_t j = 0; // whole bytes already copied 70| 28| unsigned char w = 0; // the leftover, not yet copied 71| 28| unsigned char bits = 0; // the number of lsb bits of w 72| | 73| 226k| while (i < outlen && (j < inlen || ((j == inlen) && (bits > 0)))) { ------------------ | Branch (73:12): [True: 226k, False: 28] | Branch (73:27): [True: 226k, False: 0] | Branch (73:41): [True: 0, False: 0] | Branch (73:57): [True: 0, False: 0] ------------------ 74| | /* 75| | in: | | | | | | |**|**|... 76| | ^ 77| | j 78| | w : | *| 79| | ^ 80| | bits 81| | out:| *****| *****| *** | |... 82| | ^ ^ 83| | i b 84| | */ 85| 226k| unsigned char b = 0; // bits in out[i] already filled in 86| 678k| while (b < lsb) { ------------------ | Branch (86:16): [True: 452k, False: 226k] ------------------ 87| 452k| int nbits = min(lsb - b, bits); ------------------ | | 11| 452k|#define min(x, y) (((x) < (y)) ? (x) : (y)) | | ------------------ | | | Branch (11:20): [True: 0, False: 452k] | | ------------------ ------------------ 88| 452k| uint16_t mask = (1 << nbits) - 1; 89| 452k| unsigned char t = (w >> (bits - nbits)) & mask; // the bits to copy from w to out 90| 452k| out[i] = out[i] + (t << (lsb - b - nbits)); 91| 452k| b += nbits; 92| 452k| bits -= nbits; 93| 452k| w &= ~(mask << bits); // not strictly necessary; mostly for debugging 94| | 95| 452k| if (bits == 0) { ------------------ | Branch (95:17): [True: 452k, False: 0] ------------------ 96| 452k| if (j < inlen) { ------------------ | Branch (96:21): [True: 452k, False: 28] ------------------ 97| 452k| w = in[j]; 98| 452k| bits = 8; 99| 452k| j++; 100| 452k| } else { 101| 28| break; // the input vector is exhausted 102| 28| } 103| 452k| } 104| 452k| } 105| 226k| if (b == lsb) { // out[i] is filled in ------------------ | Branch (105:13): [True: 226k, False: 0] ------------------ 106| 226k| i++; 107| 226k| } 108| 226k| } 109| 28|} oqs_kem_efrodokem_1344_shake_ct_verify: 113| 14|{ // Compare two arrays in constant time. 114| | // Returns 0 if the byte arrays are equal, -1 otherwise. 115| 14| uint16_t r = 0; 116| | 117| 75.7k| for (size_t i = 0; i < len; i++) { ------------------ | Branch (117:24): [True: 75.7k, False: 14] ------------------ 118| 75.7k| r |= a[i] ^ b[i]; 119| 75.7k| } 120| | 121| 14| r = (-(int16_t)(r >> 1) | -(int16_t)(r & 1)) >> (8*sizeof(uint16_t)-1); 122| 14| return (int8_t)r; 123| 14|} oqs_kem_efrodokem_1344_shake_ct_select: 127| 7|{ // Select one of the two input arrays to be moved to r 128| | // If (selector == 0) then load r with a, else if (selector == -1) load r with b 129| 7| OQS_MEM_BLACK_BOX(selector); ------------------ | | 58| 7| do { \ | | 59| 7| __asm__ volatile("" : "+r"(v) :); \ | | 60| 7| } while (0) | | ------------------ | | | Branch (60:14): [Folded, False: 7] | | ------------------ ------------------ 130| 231| for (size_t i = 0; i < len; i++) { ------------------ | Branch (130:24): [True: 224, False: 7] ------------------ 131| 224| r[i] = (~selector & a[i]) | (selector & b[i]); 132| 224| } 133| 7|} OQS_KEM_efrodokem_1344_aes_new: 9| 9|OQS_KEM *OQS_KEM_efrodokem_1344_aes_new(void) { 10| | 11| 9| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 9| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 9] ------------------ 13| 0| return NULL; 14| 0| } 15| 9| kem->method_name = OQS_KEM_alg_efrodokem_1344_aes; ------------------ | | 115| 9|#define OQS_KEM_alg_efrodokem_1344_aes "eFrodoKEM-1344-AES" ------------------ 16| 9| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 9| kem->claimed_nist_level = 5; 19| 9| kem->ind_cca = true; 20| | 21| 9| kem->length_public_key = OQS_KEM_efrodokem_1344_aes_length_public_key; ------------------ | | 159| 9|#define OQS_KEM_efrodokem_1344_aes_length_public_key 21520 ------------------ 22| 9| kem->length_secret_key = OQS_KEM_efrodokem_1344_aes_length_secret_key; ------------------ | | 160| 9|#define OQS_KEM_efrodokem_1344_aes_length_secret_key 43088 ------------------ 23| 9| kem->length_ciphertext = OQS_KEM_efrodokem_1344_aes_length_ciphertext; ------------------ | | 161| 9|#define OQS_KEM_efrodokem_1344_aes_length_ciphertext 21632 ------------------ 24| 9| kem->length_shared_secret = OQS_KEM_efrodokem_1344_aes_length_shared_secret; ------------------ | | 162| 9|#define OQS_KEM_efrodokem_1344_aes_length_shared_secret 32 ------------------ 25| 9| kem->length_keypair_seed = OQS_KEM_efrodokem_1344_aes_length_keypair_seed; ------------------ | | 163| 9|#define OQS_KEM_efrodokem_1344_aes_length_keypair_seed 0 ------------------ 26| 9| kem->length_encaps_seed = OQS_KEM_efrodokem_1344_aes_length_encaps_seed; ------------------ | | 164| 9|#define OQS_KEM_efrodokem_1344_aes_length_encaps_seed 0 ------------------ 27| | 28| 9| kem->keypair = OQS_KEM_efrodokem_1344_aes_keypair; 29| 9| kem->keypair_derand = OQS_KEM_efrodokem_1344_aes_keypair_derand; 30| 9| kem->encaps = OQS_KEM_efrodokem_1344_aes_encaps; 31| 9| kem->encaps_derand = OQS_KEM_efrodokem_1344_aes_encaps_derand; 32| 9| kem->decaps = OQS_KEM_efrodokem_1344_aes_decaps; 33| | 34| 9| return kem; 35| 9|} OQS_KEM_efrodokem_1344_shake_new: 9| 7|OQS_KEM *OQS_KEM_efrodokem_1344_shake_new(void) { 10| | 11| 7| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 7| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 7] ------------------ 13| 0| return NULL; 14| 0| } 15| 7| kem->method_name = OQS_KEM_alg_efrodokem_1344_shake; ------------------ | | 117| 7|#define OQS_KEM_alg_efrodokem_1344_shake "eFrodoKEM-1344-SHAKE" ------------------ 16| 7| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 7| kem->claimed_nist_level = 5; 19| 7| kem->ind_cca = true; 20| | 21| 7| kem->length_public_key = OQS_KEM_efrodokem_1344_shake_length_public_key; ------------------ | | 174| 7|#define OQS_KEM_efrodokem_1344_shake_length_public_key 21520 ------------------ 22| 7| kem->length_secret_key = OQS_KEM_efrodokem_1344_shake_length_secret_key; ------------------ | | 175| 7|#define OQS_KEM_efrodokem_1344_shake_length_secret_key 43088 ------------------ 23| 7| kem->length_ciphertext = OQS_KEM_efrodokem_1344_shake_length_ciphertext; ------------------ | | 176| 7|#define OQS_KEM_efrodokem_1344_shake_length_ciphertext 21632 ------------------ 24| 7| kem->length_shared_secret = OQS_KEM_efrodokem_1344_shake_length_shared_secret; ------------------ | | 177| 7|#define OQS_KEM_efrodokem_1344_shake_length_shared_secret 32 ------------------ 25| 7| kem->length_keypair_seed = OQS_KEM_efrodokem_1344_shake_length_keypair_seed; ------------------ | | 178| 7|#define OQS_KEM_efrodokem_1344_shake_length_keypair_seed 0 ------------------ 26| 7| kem->length_encaps_seed = OQS_KEM_efrodokem_1344_shake_length_encaps_seed; ------------------ | | 179| 7|#define OQS_KEM_efrodokem_1344_shake_length_encaps_seed 0 ------------------ 27| | 28| 7| kem->keypair = OQS_KEM_efrodokem_1344_shake_keypair; 29| 7| kem->keypair_derand = OQS_KEM_efrodokem_1344_shake_keypair_derand; 30| 7| kem->encaps = OQS_KEM_efrodokem_1344_shake_encaps; 31| 7| kem->encaps_derand = OQS_KEM_efrodokem_1344_shake_encaps_derand; 32| 7| kem->decaps = OQS_KEM_efrodokem_1344_shake_decaps; 33| | 34| 7| return kem; 35| 7|} OQS_KEM_efrodokem_640_aes_new: 9| 4|OQS_KEM *OQS_KEM_efrodokem_640_aes_new(void) { 10| | 11| 4| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 4| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 4] ------------------ 13| 0| return NULL; 14| 0| } 15| 4| kem->method_name = OQS_KEM_alg_efrodokem_640_aes; ------------------ | | 107| 4|#define OQS_KEM_alg_efrodokem_640_aes "eFrodoKEM-640-AES" ------------------ 16| 4| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 4| kem->claimed_nist_level = 1; 19| 4| kem->ind_cca = true; 20| | 21| 4| kem->length_public_key = OQS_KEM_efrodokem_640_aes_length_public_key; ------------------ | | 99| 4|#define OQS_KEM_efrodokem_640_aes_length_public_key 9616 ------------------ 22| 4| kem->length_secret_key = OQS_KEM_efrodokem_640_aes_length_secret_key; ------------------ | | 100| 4|#define OQS_KEM_efrodokem_640_aes_length_secret_key 19888 ------------------ 23| 4| kem->length_ciphertext = OQS_KEM_efrodokem_640_aes_length_ciphertext; ------------------ | | 101| 4|#define OQS_KEM_efrodokem_640_aes_length_ciphertext 9720 ------------------ 24| 4| kem->length_shared_secret = OQS_KEM_efrodokem_640_aes_length_shared_secret; ------------------ | | 102| 4|#define OQS_KEM_efrodokem_640_aes_length_shared_secret 16 ------------------ 25| 4| kem->length_keypair_seed = OQS_KEM_efrodokem_640_aes_length_keypair_seed; ------------------ | | 103| 4|#define OQS_KEM_efrodokem_640_aes_length_keypair_seed 0 ------------------ 26| 4| kem->length_encaps_seed = OQS_KEM_efrodokem_640_aes_length_encaps_seed; ------------------ | | 104| 4|#define OQS_KEM_efrodokem_640_aes_length_encaps_seed 0 ------------------ 27| | 28| 4| kem->keypair = OQS_KEM_efrodokem_640_aes_keypair; 29| 4| kem->keypair_derand = OQS_KEM_efrodokem_640_aes_keypair_derand; 30| 4| kem->encaps = OQS_KEM_efrodokem_640_aes_encaps; 31| 4| kem->encaps_derand = OQS_KEM_efrodokem_640_aes_encaps_derand; 32| 4| kem->decaps = OQS_KEM_efrodokem_640_aes_decaps; 33| | 34| 4| return kem; 35| 4|} OQS_KEM_efrodokem_640_shake_new: 9| 2|OQS_KEM *OQS_KEM_efrodokem_640_shake_new(void) { 10| | 11| 2| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 2| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 2] ------------------ 13| 0| return NULL; 14| 0| } 15| 2| kem->method_name = OQS_KEM_alg_efrodokem_640_shake; ------------------ | | 109| 2|#define OQS_KEM_alg_efrodokem_640_shake "eFrodoKEM-640-SHAKE" ------------------ 16| 2| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 2| kem->claimed_nist_level = 1; 19| 2| kem->ind_cca = true; 20| | 21| 2| kem->length_public_key = OQS_KEM_efrodokem_640_shake_length_public_key; ------------------ | | 114| 2|#define OQS_KEM_efrodokem_640_shake_length_public_key 9616 ------------------ 22| 2| kem->length_secret_key = OQS_KEM_efrodokem_640_shake_length_secret_key; ------------------ | | 115| 2|#define OQS_KEM_efrodokem_640_shake_length_secret_key 19888 ------------------ 23| 2| kem->length_ciphertext = OQS_KEM_efrodokem_640_shake_length_ciphertext; ------------------ | | 116| 2|#define OQS_KEM_efrodokem_640_shake_length_ciphertext 9720 ------------------ 24| 2| kem->length_shared_secret = OQS_KEM_efrodokem_640_shake_length_shared_secret; ------------------ | | 117| 2|#define OQS_KEM_efrodokem_640_shake_length_shared_secret 16 ------------------ 25| 2| kem->length_keypair_seed = OQS_KEM_efrodokem_640_shake_length_keypair_seed; ------------------ | | 118| 2|#define OQS_KEM_efrodokem_640_shake_length_keypair_seed 0 ------------------ 26| 2| kem->length_encaps_seed = OQS_KEM_efrodokem_640_shake_length_encaps_seed; ------------------ | | 119| 2|#define OQS_KEM_efrodokem_640_shake_length_encaps_seed 0 ------------------ 27| | 28| 2| kem->keypair = OQS_KEM_efrodokem_640_shake_keypair; 29| 2| kem->keypair_derand = OQS_KEM_efrodokem_640_shake_keypair_derand; 30| 2| kem->encaps = OQS_KEM_efrodokem_640_shake_encaps; 31| 2| kem->encaps_derand = OQS_KEM_efrodokem_640_shake_encaps_derand; 32| 2| kem->decaps = OQS_KEM_efrodokem_640_shake_decaps; 33| | 34| 2| return kem; 35| 2|} OQS_KEM_efrodokem_976_aes_new: 9| 9|OQS_KEM *OQS_KEM_efrodokem_976_aes_new(void) { 10| | 11| 9| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 9| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 9] ------------------ 13| 0| return NULL; 14| 0| } 15| 9| kem->method_name = OQS_KEM_alg_efrodokem_976_aes; ------------------ | | 111| 9|#define OQS_KEM_alg_efrodokem_976_aes "eFrodoKEM-976-AES" ------------------ 16| 9| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 9| kem->claimed_nist_level = 3; 19| 9| kem->ind_cca = true; 20| | 21| 9| kem->length_public_key = OQS_KEM_efrodokem_976_aes_length_public_key; ------------------ | | 129| 9|#define OQS_KEM_efrodokem_976_aes_length_public_key 15632 ------------------ 22| 9| kem->length_secret_key = OQS_KEM_efrodokem_976_aes_length_secret_key; ------------------ | | 130| 9|#define OQS_KEM_efrodokem_976_aes_length_secret_key 31296 ------------------ 23| 9| kem->length_ciphertext = OQS_KEM_efrodokem_976_aes_length_ciphertext; ------------------ | | 131| 9|#define OQS_KEM_efrodokem_976_aes_length_ciphertext 15744 ------------------ 24| 9| kem->length_shared_secret = OQS_KEM_efrodokem_976_aes_length_shared_secret; ------------------ | | 132| 9|#define OQS_KEM_efrodokem_976_aes_length_shared_secret 24 ------------------ 25| 9| kem->length_keypair_seed = OQS_KEM_efrodokem_976_aes_length_keypair_seed; ------------------ | | 133| 9|#define OQS_KEM_efrodokem_976_aes_length_keypair_seed 0 ------------------ 26| 9| kem->length_encaps_seed = OQS_KEM_efrodokem_976_aes_length_encaps_seed; ------------------ | | 134| 9|#define OQS_KEM_efrodokem_976_aes_length_encaps_seed 0 ------------------ 27| | 28| 9| kem->keypair = OQS_KEM_efrodokem_976_aes_keypair; 29| 9| kem->keypair_derand = OQS_KEM_efrodokem_976_aes_keypair_derand; 30| 9| kem->encaps = OQS_KEM_efrodokem_976_aes_encaps; 31| 9| kem->encaps_derand = OQS_KEM_efrodokem_976_aes_encaps_derand; 32| 9| kem->decaps = OQS_KEM_efrodokem_976_aes_decaps; 33| | 34| 9| return kem; 35| 9|} OQS_KEM_efrodokem_976_shake_new: 9| 8|OQS_KEM *OQS_KEM_efrodokem_976_shake_new(void) { 10| | 11| 8| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 8| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 8] ------------------ 13| 0| return NULL; 14| 0| } 15| 8| kem->method_name = OQS_KEM_alg_efrodokem_976_shake; ------------------ | | 113| 8|#define OQS_KEM_alg_efrodokem_976_shake "eFrodoKEM-976-SHAKE" ------------------ 16| 8| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 8| kem->claimed_nist_level = 3; 19| 8| kem->ind_cca = true; 20| | 21| 8| kem->length_public_key = OQS_KEM_efrodokem_976_shake_length_public_key; ------------------ | | 144| 8|#define OQS_KEM_efrodokem_976_shake_length_public_key 15632 ------------------ 22| 8| kem->length_secret_key = OQS_KEM_efrodokem_976_shake_length_secret_key; ------------------ | | 145| 8|#define OQS_KEM_efrodokem_976_shake_length_secret_key 31296 ------------------ 23| 8| kem->length_ciphertext = OQS_KEM_efrodokem_976_shake_length_ciphertext; ------------------ | | 146| 8|#define OQS_KEM_efrodokem_976_shake_length_ciphertext 15744 ------------------ 24| 8| kem->length_shared_secret = OQS_KEM_efrodokem_976_shake_length_shared_secret; ------------------ | | 147| 8|#define OQS_KEM_efrodokem_976_shake_length_shared_secret 24 ------------------ 25| 8| kem->length_keypair_seed = OQS_KEM_efrodokem_976_shake_length_keypair_seed; ------------------ | | 148| 8|#define OQS_KEM_efrodokem_976_shake_length_keypair_seed 0 ------------------ 26| 8| kem->length_encaps_seed = OQS_KEM_efrodokem_976_shake_length_encaps_seed; ------------------ | | 149| 8|#define OQS_KEM_efrodokem_976_shake_length_encaps_seed 0 ------------------ 27| | 28| 8| kem->keypair = OQS_KEM_efrodokem_976_shake_keypair; 29| 8| kem->keypair_derand = OQS_KEM_efrodokem_976_shake_keypair_derand; 30| 8| kem->encaps = OQS_KEM_efrodokem_976_shake_encaps; 31| 8| kem->encaps_derand = OQS_KEM_efrodokem_976_shake_encaps_derand; 32| 8| kem->decaps = OQS_KEM_efrodokem_976_shake_decaps; 33| | 34| 8| return kem; 35| 8|} OQS_KEM_frodokem_1344_aes_new: 9| 7|OQS_KEM *OQS_KEM_frodokem_1344_aes_new(void) { 10| | 11| 7| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 7| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 7] ------------------ 13| 0| return NULL; 14| 0| } 15| 7| kem->method_name = OQS_KEM_alg_frodokem_1344_aes; ------------------ | | 103| 7|#define OQS_KEM_alg_frodokem_1344_aes "FrodoKEM-1344-AES" ------------------ 16| 7| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 7| kem->claimed_nist_level = 5; 19| 7| kem->ind_cca = true; 20| | 21| 7| kem->length_public_key = OQS_KEM_frodokem_1344_aes_length_public_key; ------------------ | | 69| 7|#define OQS_KEM_frodokem_1344_aes_length_public_key 21520 ------------------ 22| 7| kem->length_secret_key = OQS_KEM_frodokem_1344_aes_length_secret_key; ------------------ | | 70| 7|#define OQS_KEM_frodokem_1344_aes_length_secret_key 43088 ------------------ 23| 7| kem->length_ciphertext = OQS_KEM_frodokem_1344_aes_length_ciphertext; ------------------ | | 71| 7|#define OQS_KEM_frodokem_1344_aes_length_ciphertext 21696 ------------------ 24| 7| kem->length_shared_secret = OQS_KEM_frodokem_1344_aes_length_shared_secret; ------------------ | | 72| 7|#define OQS_KEM_frodokem_1344_aes_length_shared_secret 32 ------------------ 25| 7| kem->length_keypair_seed = OQS_KEM_frodokem_1344_aes_length_keypair_seed; ------------------ | | 73| 7|#define OQS_KEM_frodokem_1344_aes_length_keypair_seed 0 ------------------ 26| 7| kem->length_encaps_seed = OQS_KEM_frodokem_1344_aes_length_encaps_seed; ------------------ | | 74| 7|#define OQS_KEM_frodokem_1344_aes_length_encaps_seed 0 ------------------ 27| | 28| 7| kem->keypair = OQS_KEM_frodokem_1344_aes_keypair; 29| 7| kem->keypair_derand = OQS_KEM_frodokem_1344_aes_keypair_derand; 30| 7| kem->encaps = OQS_KEM_frodokem_1344_aes_encaps; 31| 7| kem->encaps_derand = OQS_KEM_frodokem_1344_aes_encaps_derand; 32| 7| kem->decaps = OQS_KEM_frodokem_1344_aes_decaps; 33| | 34| 7| return kem; 35| 7|} OQS_KEM_frodokem_1344_shake_new: 9| 6|OQS_KEM *OQS_KEM_frodokem_1344_shake_new(void) { 10| | 11| 6| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 6| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 6] ------------------ 13| 0| return NULL; 14| 0| } 15| 6| kem->method_name = OQS_KEM_alg_frodokem_1344_shake; ------------------ | | 105| 6|#define OQS_KEM_alg_frodokem_1344_shake "FrodoKEM-1344-SHAKE" ------------------ 16| 6| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 6| kem->claimed_nist_level = 5; 19| 6| kem->ind_cca = true; 20| | 21| 6| kem->length_public_key = OQS_KEM_frodokem_1344_shake_length_public_key; ------------------ | | 84| 6|#define OQS_KEM_frodokem_1344_shake_length_public_key 21520 ------------------ 22| 6| kem->length_secret_key = OQS_KEM_frodokem_1344_shake_length_secret_key; ------------------ | | 85| 6|#define OQS_KEM_frodokem_1344_shake_length_secret_key 43088 ------------------ 23| 6| kem->length_ciphertext = OQS_KEM_frodokem_1344_shake_length_ciphertext; ------------------ | | 86| 6|#define OQS_KEM_frodokem_1344_shake_length_ciphertext 21696 ------------------ 24| 6| kem->length_shared_secret = OQS_KEM_frodokem_1344_shake_length_shared_secret; ------------------ | | 87| 6|#define OQS_KEM_frodokem_1344_shake_length_shared_secret 32 ------------------ 25| 6| kem->length_keypair_seed = OQS_KEM_frodokem_1344_shake_length_keypair_seed; ------------------ | | 88| 6|#define OQS_KEM_frodokem_1344_shake_length_keypair_seed 0 ------------------ 26| 6| kem->length_encaps_seed = OQS_KEM_frodokem_1344_shake_length_encaps_seed; ------------------ | | 89| 6|#define OQS_KEM_frodokem_1344_shake_length_encaps_seed 0 ------------------ 27| | 28| 6| kem->keypair = OQS_KEM_frodokem_1344_shake_keypair; 29| 6| kem->keypair_derand = OQS_KEM_frodokem_1344_shake_keypair_derand; 30| 6| kem->encaps = OQS_KEM_frodokem_1344_shake_encaps; 31| 6| kem->encaps_derand = OQS_KEM_frodokem_1344_shake_encaps_derand; 32| 6| kem->decaps = OQS_KEM_frodokem_1344_shake_decaps; 33| | 34| 6| return kem; 35| 6|} OQS_KEM_frodokem_640_aes_new: 9| 2|OQS_KEM *OQS_KEM_frodokem_640_aes_new(void) { 10| | 11| 2| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 2| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 2] ------------------ 13| 0| return NULL; 14| 0| } 15| 2| kem->method_name = OQS_KEM_alg_frodokem_640_aes; ------------------ | | 95| 2|#define OQS_KEM_alg_frodokem_640_aes "FrodoKEM-640-AES" ------------------ 16| 2| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 2| kem->claimed_nist_level = 1; 19| 2| kem->ind_cca = true; 20| | 21| 2| kem->length_public_key = OQS_KEM_frodokem_640_aes_length_public_key; ------------------ | | 9| 2|#define OQS_KEM_frodokem_640_aes_length_public_key 9616 ------------------ 22| 2| kem->length_secret_key = OQS_KEM_frodokem_640_aes_length_secret_key; ------------------ | | 10| 2|#define OQS_KEM_frodokem_640_aes_length_secret_key 19888 ------------------ 23| 2| kem->length_ciphertext = OQS_KEM_frodokem_640_aes_length_ciphertext; ------------------ | | 11| 2|#define OQS_KEM_frodokem_640_aes_length_ciphertext 9752 ------------------ 24| 2| kem->length_shared_secret = OQS_KEM_frodokem_640_aes_length_shared_secret; ------------------ | | 12| 2|#define OQS_KEM_frodokem_640_aes_length_shared_secret 16 ------------------ 25| 2| kem->length_keypair_seed = OQS_KEM_frodokem_640_aes_length_keypair_seed; ------------------ | | 13| 2|#define OQS_KEM_frodokem_640_aes_length_keypair_seed 0 ------------------ 26| 2| kem->length_encaps_seed = OQS_KEM_frodokem_640_aes_length_encaps_seed; ------------------ | | 14| 2|#define OQS_KEM_frodokem_640_aes_length_encaps_seed 0 ------------------ 27| | 28| 2| kem->keypair = OQS_KEM_frodokem_640_aes_keypair; 29| 2| kem->keypair_derand = OQS_KEM_frodokem_640_aes_keypair_derand; 30| 2| kem->encaps = OQS_KEM_frodokem_640_aes_encaps; 31| 2| kem->encaps_derand = OQS_KEM_frodokem_640_aes_encaps_derand; 32| 2| kem->decaps = OQS_KEM_frodokem_640_aes_decaps; 33| | 34| 2| return kem; 35| 2|} OQS_KEM_frodokem_640_shake_new: 9| 3|OQS_KEM *OQS_KEM_frodokem_640_shake_new(void) { 10| | 11| 3| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 3| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 3] ------------------ 13| 0| return NULL; 14| 0| } 15| 3| kem->method_name = OQS_KEM_alg_frodokem_640_shake; ------------------ | | 97| 3|#define OQS_KEM_alg_frodokem_640_shake "FrodoKEM-640-SHAKE" ------------------ 16| 3| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 3| kem->claimed_nist_level = 1; 19| 3| kem->ind_cca = true; 20| | 21| 3| kem->length_public_key = OQS_KEM_frodokem_640_shake_length_public_key; ------------------ | | 24| 3|#define OQS_KEM_frodokem_640_shake_length_public_key 9616 ------------------ 22| 3| kem->length_secret_key = OQS_KEM_frodokem_640_shake_length_secret_key; ------------------ | | 25| 3|#define OQS_KEM_frodokem_640_shake_length_secret_key 19888 ------------------ 23| 3| kem->length_ciphertext = OQS_KEM_frodokem_640_shake_length_ciphertext; ------------------ | | 26| 3|#define OQS_KEM_frodokem_640_shake_length_ciphertext 9752 ------------------ 24| 3| kem->length_shared_secret = OQS_KEM_frodokem_640_shake_length_shared_secret; ------------------ | | 27| 3|#define OQS_KEM_frodokem_640_shake_length_shared_secret 16 ------------------ 25| 3| kem->length_keypair_seed = OQS_KEM_frodokem_640_shake_length_keypair_seed; ------------------ | | 28| 3|#define OQS_KEM_frodokem_640_shake_length_keypair_seed 0 ------------------ 26| 3| kem->length_encaps_seed = OQS_KEM_frodokem_640_shake_length_encaps_seed; ------------------ | | 29| 3|#define OQS_KEM_frodokem_640_shake_length_encaps_seed 0 ------------------ 27| | 28| 3| kem->keypair = OQS_KEM_frodokem_640_shake_keypair; 29| 3| kem->keypair_derand = OQS_KEM_frodokem_640_shake_keypair_derand; 30| 3| kem->encaps = OQS_KEM_frodokem_640_shake_encaps; 31| 3| kem->encaps_derand = OQS_KEM_frodokem_640_shake_encaps_derand; 32| 3| kem->decaps = OQS_KEM_frodokem_640_shake_decaps; 33| | 34| 3| return kem; 35| 3|} OQS_KEM_frodokem_976_aes_new: 9| 9|OQS_KEM *OQS_KEM_frodokem_976_aes_new(void) { 10| | 11| 9| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 9| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 9] ------------------ 13| 0| return NULL; 14| 0| } 15| 9| kem->method_name = OQS_KEM_alg_frodokem_976_aes; ------------------ | | 99| 9|#define OQS_KEM_alg_frodokem_976_aes "FrodoKEM-976-AES" ------------------ 16| 9| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 9| kem->claimed_nist_level = 3; 19| 9| kem->ind_cca = true; 20| | 21| 9| kem->length_public_key = OQS_KEM_frodokem_976_aes_length_public_key; ------------------ | | 39| 9|#define OQS_KEM_frodokem_976_aes_length_public_key 15632 ------------------ 22| 9| kem->length_secret_key = OQS_KEM_frodokem_976_aes_length_secret_key; ------------------ | | 40| 9|#define OQS_KEM_frodokem_976_aes_length_secret_key 31296 ------------------ 23| 9| kem->length_ciphertext = OQS_KEM_frodokem_976_aes_length_ciphertext; ------------------ | | 41| 9|#define OQS_KEM_frodokem_976_aes_length_ciphertext 15792 ------------------ 24| 9| kem->length_shared_secret = OQS_KEM_frodokem_976_aes_length_shared_secret; ------------------ | | 42| 9|#define OQS_KEM_frodokem_976_aes_length_shared_secret 24 ------------------ 25| 9| kem->length_keypair_seed = OQS_KEM_frodokem_976_aes_length_keypair_seed; ------------------ | | 43| 9|#define OQS_KEM_frodokem_976_aes_length_keypair_seed 0 ------------------ 26| 9| kem->length_encaps_seed = OQS_KEM_frodokem_976_aes_length_encaps_seed; ------------------ | | 44| 9|#define OQS_KEM_frodokem_976_aes_length_encaps_seed 0 ------------------ 27| | 28| 9| kem->keypair = OQS_KEM_frodokem_976_aes_keypair; 29| 9| kem->keypair_derand = OQS_KEM_frodokem_976_aes_keypair_derand; 30| 9| kem->encaps = OQS_KEM_frodokem_976_aes_encaps; 31| 9| kem->encaps_derand = OQS_KEM_frodokem_976_aes_encaps_derand; 32| 9| kem->decaps = OQS_KEM_frodokem_976_aes_decaps; 33| | 34| 9| return kem; 35| 9|} OQS_KEM_frodokem_976_shake_new: 9| 9|OQS_KEM *OQS_KEM_frodokem_976_shake_new(void) { 10| | 11| 9| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 9| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 9] ------------------ 13| 0| return NULL; 14| 0| } 15| 9| kem->method_name = OQS_KEM_alg_frodokem_976_shake; ------------------ | | 101| 9|#define OQS_KEM_alg_frodokem_976_shake "FrodoKEM-976-SHAKE" ------------------ 16| 9| kem->alg_version = "https://github.com/microsoft/PQCrypto-LWEKE/commit/a2f9dec8917ccc3464b3378d46b140fa7353320d"; 17| | 18| 9| kem->claimed_nist_level = 3; 19| 9| kem->ind_cca = true; 20| | 21| 9| kem->length_public_key = OQS_KEM_frodokem_976_shake_length_public_key; ------------------ | | 54| 9|#define OQS_KEM_frodokem_976_shake_length_public_key 15632 ------------------ 22| 9| kem->length_secret_key = OQS_KEM_frodokem_976_shake_length_secret_key; ------------------ | | 55| 9|#define OQS_KEM_frodokem_976_shake_length_secret_key 31296 ------------------ 23| 9| kem->length_ciphertext = OQS_KEM_frodokem_976_shake_length_ciphertext; ------------------ | | 56| 9|#define OQS_KEM_frodokem_976_shake_length_ciphertext 15792 ------------------ 24| 9| kem->length_shared_secret = OQS_KEM_frodokem_976_shake_length_shared_secret; ------------------ | | 57| 9|#define OQS_KEM_frodokem_976_shake_length_shared_secret 24 ------------------ 25| 9| kem->length_keypair_seed = OQS_KEM_frodokem_976_shake_length_keypair_seed; ------------------ | | 58| 9|#define OQS_KEM_frodokem_976_shake_length_keypair_seed 0 ------------------ 26| 9| kem->length_encaps_seed = OQS_KEM_frodokem_976_shake_length_encaps_seed; ------------------ | | 59| 9|#define OQS_KEM_frodokem_976_shake_length_encaps_seed 0 ------------------ 27| | 28| 9| kem->keypair = OQS_KEM_frodokem_976_shake_keypair; 29| 9| kem->keypair_derand = OQS_KEM_frodokem_976_shake_keypair_derand; 30| 9| kem->encaps = OQS_KEM_frodokem_976_shake_encaps; 31| 9| kem->encaps_derand = OQS_KEM_frodokem_976_shake_encaps_derand; 32| 9| kem->decaps = OQS_KEM_frodokem_976_shake_decaps; 33| | 34| 9| return kem; 35| 9|} OQS_KEM_hqc_1_new: 9| 38|OQS_KEM *OQS_KEM_hqc_1_new(void) { 10| | 11| 38| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 38| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 38] ------------------ 13| 0| return NULL; 14| 0| } 15| 38| kem->method_name = OQS_KEM_alg_hqc_1; ------------------ | | 62| 38|#define OQS_KEM_alg_hqc_1 "HQC-1" ------------------ 16| 38| kem->alg_version = "https://gitlab.com/pqc-hqc/hqc@161cd4f"; 17| | 18| 38| kem->claimed_nist_level = 1; 19| 38| kem->ind_cca = true; 20| | 21| 38| kem->length_public_key = OQS_KEM_hqc_1_length_public_key; ------------------ | | 9| 38|#define OQS_KEM_hqc_1_length_public_key 2241 ------------------ 22| 38| kem->length_secret_key = OQS_KEM_hqc_1_length_secret_key; ------------------ | | 10| 38|#define OQS_KEM_hqc_1_length_secret_key 2321 ------------------ 23| 38| kem->length_ciphertext = OQS_KEM_hqc_1_length_ciphertext; ------------------ | | 11| 38|#define OQS_KEM_hqc_1_length_ciphertext 4433 ------------------ 24| 38| kem->length_shared_secret = OQS_KEM_hqc_1_length_shared_secret; ------------------ | | 12| 38|#define OQS_KEM_hqc_1_length_shared_secret 32 ------------------ 25| 38| kem->length_keypair_seed = OQS_KEM_hqc_1_length_keypair_seed; ------------------ | | 13| 38|#define OQS_KEM_hqc_1_length_keypair_seed 0 ------------------ 26| 38| kem->length_encaps_seed = OQS_KEM_hqc_1_length_encaps_seed; ------------------ | | 14| 38|#define OQS_KEM_hqc_1_length_encaps_seed 0 ------------------ 27| | 28| 38| kem->keypair = OQS_KEM_hqc_1_keypair; 29| 38| kem->keypair_derand = OQS_KEM_hqc_1_keypair_derand; 30| 38| kem->encaps = OQS_KEM_hqc_1_encaps; 31| 38| kem->encaps_derand = OQS_KEM_hqc_1_encaps_derand; 32| 38| kem->decaps = OQS_KEM_hqc_1_decaps; 33| | 34| 38| return kem; 35| 38|} OQS_KEM_hqc_1_keypair: 48| 38|OQS_API OQS_STATUS OQS_KEM_hqc_1_keypair(uint8_t *public_key, uint8_t *secret_key) { 49| 38| return (OQS_STATUS) PQCHQC_HQC1_C_crypto_kem_keypair(public_key, secret_key); 50| 38|} OQS_KEM_hqc_1_encaps: 60| 38|OQS_API OQS_STATUS OQS_KEM_hqc_1_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 61| 38| return (OQS_STATUS) PQCHQC_HQC1_C_crypto_kem_enc(ciphertext, shared_secret, public_key); 62| 38|} OQS_KEM_hqc_1_decaps: 64| 38|OQS_API OQS_STATUS OQS_KEM_hqc_1_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 65| 38| return (OQS_STATUS) PQCHQC_HQC1_C_crypto_kem_dec(shared_secret, ciphertext, secret_key); 66| 38|} OQS_KEM_hqc_3_new: 9| 42|OQS_KEM *OQS_KEM_hqc_3_new(void) { 10| | 11| 42| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 42| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 42] ------------------ 13| 0| return NULL; 14| 0| } 15| 42| kem->method_name = OQS_KEM_alg_hqc_3; ------------------ | | 64| 42|#define OQS_KEM_alg_hqc_3 "HQC-3" ------------------ 16| 42| kem->alg_version = "https://gitlab.com/pqc-hqc/hqc@161cd4f"; 17| | 18| 42| kem->claimed_nist_level = 3; 19| 42| kem->ind_cca = true; 20| | 21| 42| kem->length_public_key = OQS_KEM_hqc_3_length_public_key; ------------------ | | 24| 42|#define OQS_KEM_hqc_3_length_public_key 4514 ------------------ 22| 42| kem->length_secret_key = OQS_KEM_hqc_3_length_secret_key; ------------------ | | 25| 42|#define OQS_KEM_hqc_3_length_secret_key 4602 ------------------ 23| 42| kem->length_ciphertext = OQS_KEM_hqc_3_length_ciphertext; ------------------ | | 26| 42|#define OQS_KEM_hqc_3_length_ciphertext 8978 ------------------ 24| 42| kem->length_shared_secret = OQS_KEM_hqc_3_length_shared_secret; ------------------ | | 27| 42|#define OQS_KEM_hqc_3_length_shared_secret 32 ------------------ 25| 42| kem->length_keypair_seed = OQS_KEM_hqc_3_length_keypair_seed; ------------------ | | 28| 42|#define OQS_KEM_hqc_3_length_keypair_seed 0 ------------------ 26| 42| kem->length_encaps_seed = OQS_KEM_hqc_3_length_encaps_seed; ------------------ | | 29| 42|#define OQS_KEM_hqc_3_length_encaps_seed 0 ------------------ 27| | 28| 42| kem->keypair = OQS_KEM_hqc_3_keypair; 29| 42| kem->keypair_derand = OQS_KEM_hqc_3_keypair_derand; 30| 42| kem->encaps = OQS_KEM_hqc_3_encaps; 31| 42| kem->encaps_derand = OQS_KEM_hqc_3_encaps_derand; 32| 42| kem->decaps = OQS_KEM_hqc_3_decaps; 33| | 34| 42| return kem; 35| 42|} OQS_KEM_hqc_3_keypair: 48| 42|OQS_API OQS_STATUS OQS_KEM_hqc_3_keypair(uint8_t *public_key, uint8_t *secret_key) { 49| 42| return (OQS_STATUS) PQCHQC_HQC3_C_crypto_kem_keypair(public_key, secret_key); 50| 42|} OQS_KEM_hqc_3_encaps: 60| 42|OQS_API OQS_STATUS OQS_KEM_hqc_3_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 61| 42| return (OQS_STATUS) PQCHQC_HQC3_C_crypto_kem_enc(ciphertext, shared_secret, public_key); 62| 42|} OQS_KEM_hqc_3_decaps: 64| 42|OQS_API OQS_STATUS OQS_KEM_hqc_3_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 65| 42| return (OQS_STATUS) PQCHQC_HQC3_C_crypto_kem_dec(shared_secret, ciphertext, secret_key); 66| 42|} OQS_KEM_hqc_5_new: 9| 42|OQS_KEM *OQS_KEM_hqc_5_new(void) { 10| | 11| 42| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 42| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 42] ------------------ 13| 0| return NULL; 14| 0| } 15| 42| kem->method_name = OQS_KEM_alg_hqc_5; ------------------ | | 66| 42|#define OQS_KEM_alg_hqc_5 "HQC-5" ------------------ 16| 42| kem->alg_version = "https://gitlab.com/pqc-hqc/hqc@161cd4f"; 17| | 18| 42| kem->claimed_nist_level = 5; 19| 42| kem->ind_cca = true; 20| | 21| 42| kem->length_public_key = OQS_KEM_hqc_5_length_public_key; ------------------ | | 39| 42|#define OQS_KEM_hqc_5_length_public_key 7237 ------------------ 22| 42| kem->length_secret_key = OQS_KEM_hqc_5_length_secret_key; ------------------ | | 40| 42|#define OQS_KEM_hqc_5_length_secret_key 7333 ------------------ 23| 42| kem->length_ciphertext = OQS_KEM_hqc_5_length_ciphertext; ------------------ | | 41| 42|#define OQS_KEM_hqc_5_length_ciphertext 14421 ------------------ 24| 42| kem->length_shared_secret = OQS_KEM_hqc_5_length_shared_secret; ------------------ | | 42| 42|#define OQS_KEM_hqc_5_length_shared_secret 32 ------------------ 25| 42| kem->length_keypair_seed = OQS_KEM_hqc_5_length_keypair_seed; ------------------ | | 43| 42|#define OQS_KEM_hqc_5_length_keypair_seed 0 ------------------ 26| 42| kem->length_encaps_seed = OQS_KEM_hqc_5_length_encaps_seed; ------------------ | | 44| 42|#define OQS_KEM_hqc_5_length_encaps_seed 0 ------------------ 27| | 28| 42| kem->keypair = OQS_KEM_hqc_5_keypair; 29| 42| kem->keypair_derand = OQS_KEM_hqc_5_keypair_derand; 30| 42| kem->encaps = OQS_KEM_hqc_5_encaps; 31| 42| kem->encaps_derand = OQS_KEM_hqc_5_encaps_derand; 32| 42| kem->decaps = OQS_KEM_hqc_5_decaps; 33| | 34| 42| return kem; 35| 42|} OQS_KEM_hqc_5_keypair: 48| 42|OQS_API OQS_STATUS OQS_KEM_hqc_5_keypair(uint8_t *public_key, uint8_t *secret_key) { 49| 42| return (OQS_STATUS) PQCHQC_HQC5_C_crypto_kem_keypair(public_key, secret_key); 50| 42|} OQS_KEM_hqc_5_encaps: 60| 42|OQS_API OQS_STATUS OQS_KEM_hqc_5_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 61| 42| return (OQS_STATUS) PQCHQC_HQC5_C_crypto_kem_enc(ciphertext, shared_secret, public_key); 62| 42|} OQS_KEM_hqc_5_decaps: 64| 42|OQS_API OQS_STATUS OQS_KEM_hqc_5_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 65| 42| return (OQS_STATUS) PQCHQC_HQC5_C_crypto_kem_dec(shared_secret, ciphertext, secret_key); 66| 42|} PQCHQC_HQC1_C_code_encode: 27| 76|void code_encode(uint64_t *em, const uint64_t *m) { 28| 76| uint64_t tmp[VEC_N1_SIZE_64] = {0}; 29| | 30| 76| reed_solomon_encode(tmp, m); ------------------ | | 84| 76|#define reed_solomon_encode PQCHQC_NAMESPACE(reed_solomon_encode) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 31| 76| reed_muller_encode(em, tmp); ------------------ | | 14| 76|#define reed_muller_encode PQCHQC_NAMESPACE(reed_muller_encode) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 32| | 33| |#ifdef VERBOSE 34| | printf("\n\nReed-Solomon code word: "); 35| | vect_print(tmp, VEC_N1_SIZE_BYTES); 36| | printf("\n\nConcatenated code word: "); 37| | vect_print(em, VEC_N1N2_SIZE_BYTES); 38| |#endif 39| | // Zeroize sensitive data 40| 76| memset_zero(tmp, sizeof tmp); ------------------ | | 22| 76|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 76|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 41| 76|} PQCHQC_HQC1_C_code_decode: 49| 38|void code_decode(uint64_t *m, const uint64_t *em) { 50| 38| uint64_t tmp[VEC_N1_SIZE_64] = {0}; 51| | 52| 38| reed_muller_decode(tmp, em); ------------------ | | 15| 38|#define reed_muller_decode PQCHQC_NAMESPACE(reed_muller_decode) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 53| 38| reed_solomon_decode(m, tmp); ------------------ | | 85| 38|#define reed_solomon_decode PQCHQC_NAMESPACE(reed_solomon_decode) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| | 55| |#ifdef VERBOSE 56| | printf("\n\nReed-Muller decoding result (the input for the Reed-Solomon decoding algorithm): "); 57| | vect_print(tmp, VEC_N1_SIZE_BYTES); 58| |#endif 59| | 60| | // Zeroize sensitive data 61| 38| memset_zero(tmp, sizeof tmp); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 62| 38|} PQCHQC_HQC1_C_fft: 274| 38|void fft(uint16_t *w, const uint16_t *f, size_t f_coeffs) { 275| 38| uint16_t betas[PARAM_M - 1] = {0}; 276| 38| uint16_t betas_sums[1 << (PARAM_M - 1)] = {0}; 277| 38| uint16_t f0[1 << (PARAM_FFT - 1)] = {0}; 278| 38| uint16_t f1[1 << (PARAM_FFT - 1)] = {0}; 279| 38| uint16_t deltas[PARAM_M - 1] = {0}; 280| 38| uint16_t u[1 << (PARAM_M - 1)] = {0}; 281| 38| uint16_t v[1 << (PARAM_M - 1)] = {0}; 282| | 283| 38| size_t i, k; 284| | 285| | // Follows Gao and Mateer algorithm 286| 38| compute_fft_betas(betas); 287| | 288| | // Step 1: PARAM_FFT > 1, nothing to do 289| | 290| | // Compute gammas sums 291| 38| compute_subset_sums(betas_sums, betas, PARAM_M - 1); ------------------ | | 41| 38|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 292| | 293| | // Step 2: beta_m = 1, nothing to do 294| | 295| | // Step 3 296| 38| radix(f0, f1, f, PARAM_FFT); ------------------ | | 46| 38|#define PARAM_FFT 4 ///< Exponent for additive FFT (2^PARAM_FFT points) ------------------ 297| | 298| | // Step 4: Compute deltas 299| 304| for (i = 0; i < PARAM_M - 1; ++i) { ------------------ | | 41| 304|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ | Branch (299:17): [True: 266, False: 38] ------------------ 300| 266| deltas[i] = gf_square(betas[i]) ^ betas[i]; ------------------ | | 52| 266|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 266|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 266|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 266|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 301| 266| } 302| | 303| | // Step 5 304| 38| fft_rec(u, f0, (f_coeffs + 1) / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 41| 38|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ fft_rec(u, f0, (f_coeffs + 1) / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 46| 38|#define PARAM_FFT 4 ///< Exponent for additive FFT (2^PARAM_FFT points) ------------------ 305| 38| fft_rec(v, f1, f_coeffs / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 41| 38|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ fft_rec(v, f1, f_coeffs / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 46| 38|#define PARAM_FFT 4 ///< Exponent for additive FFT (2^PARAM_FFT points) ------------------ 306| | 307| 38| k = 1 << (PARAM_M - 1); ------------------ | | 41| 38|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 308| | // Step 6, 7 and error polynomial computation 309| 38| memcpy(w + k, v, 2 * k); 310| | 311| | // Check if 0 is root 312| 38| w[0] = u[0]; 313| | 314| | // Check if 1 is root 315| 38| w[k] ^= u[0]; 316| | 317| | // Find other roots 318| 4.86k| for (i = 1; i < k; ++i) { ------------------ | Branch (318:17): [True: 4.82k, False: 38] ------------------ 319| 4.82k| w[i] = u[i] ^ gf_mul(betas_sums[i], v[i]); ------------------ | | 51| 4.82k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 4.82k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 4.82k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 4.82k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 320| 4.82k| w[k + i] ^= w[i]; 321| 4.82k| } 322| 38|} PQCHQC_HQC1_C_fft_retrieve_error_poly: 331| 38|void fft_retrieve_error_poly(uint8_t *error, const uint16_t *w) { 332| 38| uint16_t gammas[PARAM_M - 1] = {0}; 333| 38| uint16_t gammas_sums[1 << (PARAM_M - 1)] = {0}; 334| 38| uint16_t k; 335| 38| size_t i, index; 336| | 337| 38| compute_fft_betas(gammas); 338| 38| compute_subset_sums(gammas_sums, gammas, PARAM_M - 1); ------------------ | | 41| 38|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 339| | 340| 38| k = 1 << (PARAM_M - 1); ------------------ | | 41| 38|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 341| 38| error[0] ^= 1 ^ ((uint16_t)-w[0] >> 15); 342| 38| error[0] ^= 1 ^ ((uint16_t)-w[k] >> 15); 343| | 344| 4.86k| for (i = 1; i < k; ++i) { ------------------ | Branch (344:17): [True: 4.82k, False: 38] ------------------ 345| 4.82k| index = PARAM_GF_MUL_ORDER - gf_log[gammas_sums[i]]; ------------------ | | 43| 4.82k|#define PARAM_GF_MUL_ORDER 255 ///< Size of the multiplicative group of GF(2^PARAM_M) (2^PARAM_M−1) ------------------ 346| 4.82k| error[index] ^= 1 ^ ((uint16_t)-w[i] >> 15); 347| | 348| 4.82k| index = PARAM_GF_MUL_ORDER - gf_log[gammas_sums[i] ^ 1]; ------------------ | | 43| 4.82k|#define PARAM_GF_MUL_ORDER 255 ///< Size of the multiplicative group of GF(2^PARAM_M) (2^PARAM_M−1) ------------------ 349| 4.82k| error[index] ^= 1 ^ ((uint16_t)-w[k + i] >> 15); 350| 4.82k| } 351| 38|} fft.c:compute_fft_betas: 29| 244|static void compute_fft_betas(uint16_t *betas) { 30| 244| size_t i; 31| 1.95k| for (i = 0; i < PARAM_M - 1; ++i) { ------------------ | | 41| 1.95k|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ | Branch (31:17): [True: 1.70k, False: 244] ------------------ 32| 1.70k| betas[i] = 1 << (PARAM_M - 1 - i); ------------------ | | 41| 1.70k|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 33| 1.70k| } 34| 244|} fft.c:compute_subset_sums: 46| 1.64k|static void compute_subset_sums(uint16_t *subset_sums, const uint16_t *set, uint16_t set_size) { 47| 1.64k| uint16_t i, j; 48| 1.64k| subset_sums[0] = 0; 49| | 50| 9.94k| for (i = 0; i < set_size; ++i) { ------------------ | Branch (50:17): [True: 8.30k, False: 1.64k] ------------------ 51| 79.8k| for (j = 0; j < (1 << i); ++j) { ------------------ | Branch (51:21): [True: 71.5k, False: 8.30k] ------------------ 52| 71.5k| subset_sums[(1 << i) + j] = set[i] ^ subset_sums[j]; 53| 71.5k| } 54| 8.30k| } 55| 1.64k|} fft.c:radix: 69| 1.69k|static void radix(uint16_t *f0, uint16_t *f1, const uint16_t *f, uint32_t m_f) { 70| 1.69k| switch (m_f) { 71| 374| case 4: ------------------ | Branch (71:9): [True: 374, False: 1.32k] ------------------ 72| 374| f0[4] = f[8] ^ f[12]; 73| 374| f0[6] = f[12] ^ f[14]; 74| 374| f0[7] = f[14] ^ f[15]; 75| 374| f1[5] = f[11] ^ f[13]; 76| 374| f1[6] = f[13] ^ f[14]; 77| 374| f1[7] = f[15]; 78| 374| f0[5] = f[10] ^ f[12] ^ f1[5]; 79| 374| f1[4] = f[9] ^ f[13] ^ f0[5]; 80| | 81| 374| f0[0] = f[0]; 82| 374| f1[3] = f[7] ^ f[11] ^ f[15]; 83| 374| f0[3] = f[6] ^ f[10] ^ f[14] ^ f1[3]; 84| 374| f0[2] = f[4] ^ f0[4] ^ f0[3] ^ f1[3]; 85| 374| f1[1] = f[3] ^ f[5] ^ f[9] ^ f[13] ^ f1[3]; 86| 374| f1[2] = f[3] ^ f1[1] ^ f0[3]; 87| 374| f0[1] = f[2] ^ f0[2] ^ f1[1]; 88| 374| f1[0] = f[1] ^ f0[1]; 89| 374| break; 90| | 91| 412| case 3: ------------------ | Branch (91:9): [True: 412, False: 1.28k] ------------------ 92| 412| f0[0] = f[0]; 93| 412| f0[2] = f[4] ^ f[6]; 94| 412| f0[3] = f[6] ^ f[7]; 95| 412| f1[1] = f[3] ^ f[5] ^ f[7]; 96| 412| f1[2] = f[5] ^ f[6]; 97| 412| f1[3] = f[7]; 98| 412| f0[1] = f[2] ^ f0[2] ^ f1[1]; 99| 412| f1[0] = f[1] ^ f0[1]; 100| 412| break; 101| | 102| 824| case 2: ------------------ | Branch (102:9): [True: 824, False: 870] ------------------ 103| 824| f0[0] = f[0]; 104| 824| f0[1] = f[2] ^ f[3]; 105| 824| f1[0] = f[1] ^ f0[1]; 106| 824| f1[1] = f[3]; 107| 824| break; 108| | 109| 0| case 1: ------------------ | Branch (109:9): [True: 0, False: 1.69k] ------------------ 110| 0| f0[0] = f[0]; 111| 0| f1[0] = f[1]; 112| 0| break; 113| | 114| 84| default: ------------------ | Branch (114:9): [True: 84, False: 1.61k] ------------------ 115| 84| radix_big(f0, f1, f, m_f); 116| 84| break; 117| 1.69k| } 118| 1.69k|} fft.c:radix_big: 131| 84|static void radix_big(uint16_t *f0, uint16_t *f1, const uint16_t *f, uint32_t m_f) { 132| 84| uint16_t Q[2 * (1 << (PARAM_FFT - 2)) + 1] = {0}; 133| 84| uint16_t R[2 * (1 << (PARAM_FFT - 2)) + 1] = {0}; 134| | 135| 84| uint16_t Q0[1 << (PARAM_FFT - 2)] = {0}; 136| 84| uint16_t Q1[1 << (PARAM_FFT - 2)] = {0}; 137| 84| uint16_t R0[1 << (PARAM_FFT - 2)] = {0}; 138| 84| uint16_t R1[1 << (PARAM_FFT - 2)] = {0}; 139| | 140| 84| size_t i, n; 141| | 142| 84| n = 1; 143| 84| n <<= (m_f - 2); 144| 84| memcpy(Q, f + 3 * n, 2 * n); 145| 84| memcpy(Q + n, f + 3 * n, 2 * n); 146| 84| memcpy(R, f, 4 * n); 147| | 148| 756| for (i = 0; i < n; ++i) { ------------------ | Branch (148:17): [True: 672, False: 84] ------------------ 149| 672| Q[i] ^= f[2 * n + i]; 150| 672| R[n + i] ^= Q[i]; 151| 672| } 152| | 153| 84| radix(Q0, Q1, Q, m_f - 1); 154| 84| radix(R0, R1, R, m_f - 1); 155| | 156| 84| memcpy(f0, R0, 2 * n); 157| 84| memcpy(f0 + n, Q0, 2 * n); 158| 84| memcpy(f1, R1, 2 * n); 159| 84| memcpy(f1 + n, Q1, 2 * n); 160| 84|} fft.c:fft_rec: 174| 2.63k|static void fft_rec(uint16_t *w, uint16_t *f, size_t f_coeffs, uint8_t m, uint32_t m_f, const uint16_t *betas) { 175| 2.63k| uint16_t f0[1 << (PARAM_FFT - 2)] = {0}; 176| 2.63k| uint16_t f1[1 << (PARAM_FFT - 2)] = {0}; 177| 2.63k| uint16_t gammas[PARAM_M - 2] = {0}; 178| 2.63k| uint16_t deltas[PARAM_M - 2] = {0}; 179| 2.63k| uint16_t gammas_sums[1 << (PARAM_M - 2)] = {0}; 180| 2.63k| uint16_t u[1 << (PARAM_M - 2)] = {0}; 181| 2.63k| uint16_t v[1 << (PARAM_M - 2)] = {0}; 182| 2.63k| uint16_t tmp[PARAM_M - (PARAM_FFT - 1)] = {0}; 183| | 184| 2.63k| uint16_t beta_m_pow; 185| 2.63k| size_t i, j, k; 186| 2.63k| size_t x; 187| | 188| | // Step 1 189| 2.63k| if (m_f == 1) { ------------------ | Branch (189:9): [True: 1.22k, False: 1.40k] ------------------ 190| 6.44k| for (i = 0; i < m; ++i) { ------------------ | Branch (190:21): [True: 5.21k, False: 1.22k] ------------------ 191| 5.21k| tmp[i] = gf_mul(betas[i], f[1]); ------------------ | | 51| 5.21k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 5.21k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.21k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.21k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 192| 5.21k| } 193| | 194| 1.22k| w[0] = f[0]; 195| 1.22k| x = 1; 196| 6.44k| for (j = 0; j < m; ++j) { ------------------ | Branch (196:21): [True: 5.21k, False: 1.22k] ------------------ 197| 28.5k| for (k = 0; k < x; ++k) { ------------------ | Branch (197:25): [True: 23.2k, False: 5.21k] ------------------ 198| 23.2k| w[x + k] = w[k] ^ tmp[j]; 199| 23.2k| } 200| 5.21k| x <<= 1; 201| 5.21k| } 202| | 203| 1.22k| return; 204| 1.22k| } 205| | 206| | // Step 2: compute g 207| 1.40k| if (betas[m - 1] != 1) { ------------------ | Branch (207:9): [True: 1.40k, False: 0] ------------------ 208| 1.40k| beta_m_pow = 1; 209| 1.40k| x = 1; 210| 1.40k| x <<= m_f; 211| 9.28k| for (i = 1; i < x; ++i) { ------------------ | Branch (211:21): [True: 7.87k, False: 1.40k] ------------------ 212| 7.87k| beta_m_pow = gf_mul(beta_m_pow, betas[m - 1]); ------------------ | | 51| 7.87k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 7.87k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.87k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.87k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 213| 7.87k| f[i] = gf_mul(beta_m_pow, f[i]); ------------------ | | 51| 7.87k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 7.87k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.87k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.87k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 214| 7.87k| } 215| 1.40k| } 216| | 217| | // Step 3 218| 1.40k| radix(f0, f1, f, m_f); 219| | 220| | // Step 4: compute gammas and deltas 221| 7.99k| for (i = 0; i + 1 < m; ++i) { ------------------ | Branch (221:17): [True: 6.59k, False: 1.40k] ------------------ 222| 6.59k| gammas[i] = gf_mul(betas[i], gf_inverse(betas[m - 1])); ------------------ | | 51| 6.59k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 6.59k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 6.59k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 6.59k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ gammas[i] = gf_mul(betas[i], gf_inverse(betas[m - 1])); ------------------ | | 53| 6.59k|#define gf_inverse PQCHQC_NAMESPACE(gf_inverse) | | ------------------ | | | | 17| 6.59k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 6.59k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 6.59k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 223| 6.59k| deltas[i] = gf_square(gammas[i]) ^ gammas[i]; ------------------ | | 52| 6.59k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 6.59k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 6.59k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 6.59k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 224| 6.59k| } 225| | 226| | // Compute gammas sums 227| 1.40k| compute_subset_sums(gammas_sums, gammas, m - 1); 228| | 229| | // Step 5 230| 1.40k| fft_rec(u, f0, (f_coeffs + 1) / 2, m - 1, m_f - 1, deltas); 231| | 232| 1.40k| k = 1; 233| 1.40k| k <<= ((m - 1) & 0xf); // &0xf is to let the compiler know that m-1 is small. 234| 1.40k| if (f_coeffs <= 3) { // 3-coefficient polynomial f case: f1 is constant ------------------ | Branch (234:9): [True: 420, False: 984] ------------------ 235| 420| w[0] = u[0]; 236| 420| w[k] = u[0] ^ f1[0]; 237| 6.72k| for (i = 1; i < k; ++i) { ------------------ | Branch (237:21): [True: 6.30k, False: 420] ------------------ 238| 6.30k| w[i] = u[i] ^ gf_mul(gammas_sums[i], f1[0]); ------------------ | | 51| 6.30k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 6.30k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 6.30k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 6.30k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 239| 6.30k| w[k + i] = w[i] ^ f1[0]; 240| 6.30k| } 241| 984| } else { 242| 984| fft_rec(v, f1, f_coeffs / 2, m - 1, m_f - 1, deltas); 243| | 244| | // Step 6 245| 984| memcpy(w + k, v, 2 * k); 246| 984| w[0] = u[0]; 247| 984| w[k] ^= u[0]; 248| 35.2k| for (i = 1; i < k; ++i) { ------------------ | Branch (248:21): [True: 34.2k, False: 984] ------------------ 249| 34.2k| w[i] = u[i] ^ gf_mul(gammas_sums[i], v[i]); ------------------ | | 51| 34.2k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 34.2k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 34.2k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 34.2k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 250| 34.2k| w[k + i] ^= w[i]; 251| 34.2k| } 252| 984| } 253| 1.40k|} PQCHQC_HQC1_C_gf_mul: 153| 189k|uint16_t gf_mul(uint16_t a, uint16_t b) { 154| 189k| uint8_t c[2] = {0}; 155| 189k| gf_carryless_mul(c, (uint8_t)a, (uint8_t)b); 156| 189k| uint16_t tmp = (uint16_t)(c[0] ^ (c[1] << 8)); 157| 189k| return gf_reduce(tmp); 158| 189k|} PQCHQC_HQC1_C_gf_square: 165| 22.4k|uint16_t gf_square(uint16_t a) { 166| 22.4k| uint32_t b = a; 167| 22.4k| uint32_t s = b & 1; 168| 179k| for (size_t i = 1; i < PARAM_M; ++i) { ------------------ | | 41| 179k|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ | Branch (168:24): [True: 157k, False: 22.4k] ------------------ 169| 157k| b <<= 1; 170| 157k| s ^= b & (1 << 2 * i); 171| 157k| } 172| | 173| 22.4k| return gf_reduce(s); 174| 22.4k|} PQCHQC_HQC1_C_gf_inverse: 182| 3.49k|uint16_t gf_inverse(uint16_t a) { 183| 3.49k| uint16_t inv = a; 184| 3.49k| uint16_t tmp1, tmp2; 185| | 186| 3.49k| inv = gf_square(a); /* a^2 */ ------------------ | | 52| 3.49k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 3.49k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.49k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.49k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 187| 3.49k| tmp1 = gf_mul(inv, a); /* a^3 */ ------------------ | | 51| 3.49k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 3.49k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.49k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.49k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 188| 3.49k| inv = gf_square(inv); /* a^4 */ ------------------ | | 52| 3.49k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 3.49k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.49k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.49k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 189| 3.49k| tmp2 = gf_mul(inv, tmp1); /* a^7 */ ------------------ | | 51| 3.49k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 3.49k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.49k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.49k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 190| 3.49k| tmp1 = gf_mul(inv, tmp2); /* a^11 */ ------------------ | | 51| 3.49k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 3.49k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.49k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.49k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 191| 3.49k| inv = gf_mul(tmp1, inv); /* a^15 */ ------------------ | | 51| 3.49k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 3.49k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.49k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.49k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 192| 3.49k| inv = gf_square(inv); /* a^30 */ ------------------ | | 52| 3.49k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 3.49k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.49k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.49k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 193| 3.49k| inv = gf_square(inv); /* a^60 */ ------------------ | | 52| 3.49k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 3.49k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.49k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.49k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 194| 3.49k| inv = gf_square(inv); /* a^120 */ ------------------ | | 52| 3.49k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 3.49k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.49k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.49k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 195| 3.49k| inv = gf_mul(inv, tmp2); /* a^127 */ ------------------ | | 51| 3.49k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 3.49k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.49k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.49k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 196| 3.49k| inv = gf_square(inv); /* a^254 */ ------------------ | | 52| 3.49k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 3.49k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 3.49k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 3.49k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 197| 3.49k| return inv; 198| 3.49k|} gf.c:gf_carryless_mul: 109| 1.18M|static void gf_carryless_mul(uint8_t *c, uint8_t a, uint8_t b) { 110| 1.18M| uint16_t h = 0, l = 0, g, u[4]; 111| 1.18M| u[0] = 0; 112| 1.18M| u[1] = b & ((1UL << 7) - 1UL); 113| 1.18M| u[2] = u[1] << 1; 114| 1.18M| u[3] = u[2] ^ u[1]; 115| | 116| 1.18M| g = 0; 117| 1.18M| uint16_t tmp1 = a & 3; 118| | 119| 5.90M| for (int i = 0; i < 4; i++) { ------------------ | Branch (119:21): [True: 4.72M, False: 1.18M] ------------------ 120| 4.72M| uint32_t tmp2 = tmp1 - i; 121| 4.72M| g ^= (u[i] & -(1 - ((tmp2 | -tmp2) >> 31))); 122| 4.72M| } 123| | 124| 1.18M| l = g; 125| 1.18M| h = 0; 126| | 127| 4.72M| for (uint8_t i = 2; i < 8; i += 2) { ------------------ | Branch (127:25): [True: 3.54M, False: 1.18M] ------------------ 128| 3.54M| g = 0; 129| 3.54M| uint16_t tmp3 = (a >> i) & 3; 130| 17.7M| for (int j = 0; j < 4; ++j) { ------------------ | Branch (130:25): [True: 14.1M, False: 3.54M] ------------------ 131| 14.1M| uint32_t tmp2 = tmp3 - j; 132| 14.1M| g ^= (u[j] & -(1 - ((tmp2 | -tmp2) >> 31))); 133| 14.1M| } 134| | 135| 3.54M| l ^= g << i; 136| 3.54M| h ^= g >> (8 - i); 137| 3.54M| } 138| | 139| 1.18M| uint16_t mask = (-((b >> 7) & 1)); 140| 1.18M| l ^= ((a << 7) & mask); 141| 1.18M| h ^= ((a >> (1)) & mask); 142| | 143| 1.18M| c[0] = l; 144| 1.18M| c[1] = h; 145| 1.18M|} gf.c:gf_reduce: 76| 1.28M|uint16_t gf_reduce(uint16_t x) { 77| 1.28M| uint64_t mod; 78| 1.28M| const int reduction_steps = 2; // For deg(x) = 2 * (8 - 1) = 14, reduce twice to bring degree < 8 79| 1.28M| const size_t gf_reduction_tap_count = 3; // Number of feedback positions 80| | 81| 3.86M| for (int i = 0; i < reduction_steps; ++i) { ------------------ | Branch (81:21): [True: 2.57M, False: 1.28M] ------------------ 82| 2.57M| mod = x >> PARAM_M; // Extract upper bits ------------------ | | 41| 2.57M|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 83| 2.57M| x &= (1 << PARAM_M) - 1; // Keep lower bits ------------------ | | 41| 2.57M|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 84| 2.57M| x ^= mod; // Pre-XOR with no shift 85| | 86| 2.57M| uint16_t z1 = 0; 87| 10.3M| for (size_t j = gf_reduction_tap_count; j; --j) { ------------------ | Branch (87:49): [True: 7.72M, False: 2.57M] ------------------ 88| 7.72M| uint16_t z2 = gf_reduction_taps[j - 1]; 89| 7.72M| uint16_t dist = z2 - z1; 90| 7.72M| mod <<= dist; 91| 7.72M| x ^= mod; 92| 7.72M| z1 = z2; 93| 7.72M| } 94| 2.57M| } 95| | 96| 1.28M| return x; 97| 1.28M|} PQCHQC_HQC1_C_vect_mul: 151| 228|void vect_mul(uint64_t *o, const uint64_t *a1, const uint64_t *a2) { 152| 228| uint64_t unreduced[2 * VEC_N_SIZE_64]; 153| 228| uint64_t tmp_buffer[TMP_BUFFER_WORDS]; 154| | 155| | /* multiply via Karatsuba into unreduced */ 156| 228| karatsuba_mul(unreduced, a1, a2, VEC_N_SIZE_64, tmp_buffer); ------------------ | | 36| 228|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 228|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 228] | | | | ------------------ | | ------------------ ------------------ 157| | 158| | /* reduce modulo X^n - 1 */ 159| 228| reduce(o, unreduced); 160| 228|} gf2x.c:karatsuba_mul: 74| 633k|static void karatsuba_mul(uint64_t *r, const uint64_t *a, const uint64_t *b, size_t n, uint64_t *tmp_buffer) { 75| 633k| if (n <= KARATSUBA_THRESHOLD) { ------------------ | | 22| 633k|#define KARATSUBA_THRESHOLD 16 ------------------ | Branch (75:9): [True: 422k, False: 211k] ------------------ 76| 422k| schoolbook_mul(r, a, b, n); 77| 422k| return; 78| 422k| } 79| | 80| 211k| size_t m = n >> 1; 81| 211k| size_t n0 = m; 82| 211k| size_t n1 = n - m; 83| | 84| | /* take successive chunks of tmp_buffer for each intermediate result */ 85| 211k| uint64_t *z0 = tmp_buffer; /* low-half product, size 2*n words */ 86| 211k| uint64_t *z2 = z0 + 2 * n; /* high-half product, size 2*n words */ 87| 211k| uint64_t *zmid = z2 + 2 * n; /* middle product, size 2*n words */ 88| | 89| | /* ta and tb hold the sums of low and high halves: */ 90| | /* ta[i] = a0[i] XOR a1[i], tb[i] = b0[i] XOR b1[i] for i < n1 */ 91| 211k| uint64_t *ta = zmid + 2 * n; 92| 211k| uint64_t *tb = ta + n; 93| | 94| | /* buffer for child recursions */ 95| 211k| uint64_t *child_buffer = tmp_buffer + 8 * n; 96| | 97| | /* 1) low * low */ 98| 211k| karatsuba_mul(z0, a, b, n0, child_buffer); 99| | 100| | /* 2) high * high */ 101| 211k| karatsuba_mul(z2, a + m, b + m, n1, child_buffer); 102| | 103| | /* 3) (a0+a1)*(b0+b1) */ 104| 4.52M| for (size_t i = 0; i < n1; i++) { ------------------ | Branch (104:24): [True: 4.31M, False: 211k] ------------------ 105| 4.31M| uint64_t loa = (i < n0 ? a[i] : 0); ------------------ | Branch (105:25): [True: 4.21M, False: 92.6k] ------------------ 106| 4.31M| uint64_t lob = (i < n0 ? b[i] : 0); ------------------ | Branch (106:25): [True: 4.21M, False: 92.6k] ------------------ 107| 4.31M| ta[i] = loa ^ a[m + i]; 108| 4.31M| tb[i] = lob ^ b[m + i]; 109| 4.31M| } 110| 211k| karatsuba_mul(zmid, ta, tb, n1, child_buffer); 111| | 112| | /* 4) assemble into r */ 113| 211k| memset(r, 0, 2 * n * sizeof(uint64_t)); 114| 8.64M| for (size_t i = 0; i < 2 * n0; i++) r[i] ^= z0[i]; ------------------ | Branch (114:24): [True: 8.43M, False: 211k] ------------------ 115| 8.83M| for (size_t i = 0; i < 2 * n1; i++) r[2 * m + i] ^= z2[i]; ------------------ | Branch (115:24): [True: 8.62M, False: 211k] ------------------ 116| 8.83M| for (size_t i = 0; i < 2 * n1; i++) { ------------------ | Branch (116:24): [True: 8.62M, False: 211k] ------------------ 117| 8.62M| uint64_t z0i = (i < 2 * n0 ? z0[i] : 0); ------------------ | Branch (117:25): [True: 8.43M, False: 185k] ------------------ 118| 8.62M| uint64_t z2i = (i < 2 * n1 ? z2[i] : 0); ------------------ | Branch (118:25): [True: 8.62M, False: 0] ------------------ 119| 8.62M| uint64_t mid = zmid[i] ^ z0i ^ z2i; 120| 8.62M| r[m + i] ^= mid; 121| 8.62M| } 122| 211k|} gf2x.c:schoolbook_mul: 39| 422k|static void schoolbook_mul(uint64_t *r, const uint64_t *a, const uint64_t *b, size_t n) { 40| 422k| memset(r, 0, 2 * n * sizeof(uint64_t)); 41| 5.16M| for (size_t i = 0; i < n; i++) { ------------------ | Branch (41:24): [True: 4.74M, False: 422k] ------------------ 42| 4.74M| uint64_t ai = a[i]; 43| 308M| for (int bit = 0; bit < 64; bit++) { ------------------ | Branch (43:27): [True: 303M, False: 4.74M] ------------------ 44| 303M| uint64_t mask = -((ai >> bit) & 1ULL); 45| 303M| size_t base = i; 46| 303M| int sh = bit; 47| 303M| int inv = 64 - sh; 48| 303M| if (sh == 0) { ------------------ | Branch (48:17): [True: 4.74M, False: 298M] ------------------ 49| 60.9M| for (size_t j = 0; j < n; j++) { ------------------ | Branch (49:36): [True: 56.2M, False: 4.74M] ------------------ 50| 56.2M| r[base + j] ^= b[j] & mask; 51| 56.2M| } 52| 298M| } else { 53| 3.84G| for (size_t j = 0; j < n; j++) { ------------------ | Branch (53:36): [True: 3.54G, False: 298M] ------------------ 54| 3.54G| r[base + j] ^= (b[j] << sh) & mask; 55| 3.54G| r[base + j + 1] ^= (b[j] >> inv) & mask; 56| 3.54G| } 57| 298M| } 58| 303M| } 59| 4.74M| } 60| 422k|} gf2x.c:reduce: 133| 732|static void reduce(uint64_t *o, const uint64_t *a) { 134| 432k| for (size_t i = 0; i < VEC_N_SIZE_64; i++) { ------------------ | | 36| 432k|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 432k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 432k] | | | | ------------------ | | ------------------ ------------------ | Branch (134:24): [True: 431k, False: 732] ------------------ 135| 431k| uint64_t r = a[i + VEC_N_SIZE_64 - 1] >> (PARAM_N & 0x3F); ------------------ | | 36| 431k|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 431k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 431k] | | | | ------------------ | | ------------------ ------------------ uint64_t r = a[i + VEC_N_SIZE_64 - 1] >> (PARAM_N & 0x3F); ------------------ | | 15| 431k|#define PARAM_N 17669 ///< Define the parameter n of the scheme ------------------ 136| 431k| uint64_t carry = a[i + VEC_N_SIZE_64] << (64 - (PARAM_N & 0x3F)); ------------------ | | 36| 431k|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 431k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 431k] | | | | ------------------ | | ------------------ ------------------ uint64_t carry = a[i + VEC_N_SIZE_64] << (64 - (PARAM_N & 0x3F)); ------------------ | | 15| 431k|#define PARAM_N 17669 ///< Define the parameter n of the scheme ------------------ 137| 431k| o[i] = a[i] ^ r ^ carry; 138| 431k| } 139| 732| o[VEC_N_SIZE_64 - 1] &= BITMASK(PARAM_N, 64); ------------------ | | 36| 732|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 732|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 732] | | | | ------------------ | | ------------------ ------------------ o[VEC_N_SIZE_64 - 1] &= BITMASK(PARAM_N, 64); ------------------ | | 13| 732|#define BITMASK(a, size) ((((uint64_t) 1UL) << (a % size)) - 1) /*!< Create a mask*/ ------------------ 140| 732|} PQCHQC_HQC1_C_hqc_pke_keygen: 30| 38|void hqc_pke_keygen(uint8_t *ek_pke, uint8_t *dk_pke, uint8_t *seed) { 31| 38| uint8_t keypair_seed[2 * SEED_BYTES] = {0}; 32| 38| uint8_t *seed_dk = keypair_seed; 33| 38| uint8_t *seed_ek = keypair_seed + SEED_BYTES; ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 34| 38| shake256_xof_ctx dk_xof_ctx = {0}; 35| 38| shake256_xof_ctx ek_xof_ctx = {0}; 36| | 37| 38| uint64_t x[VEC_N_SIZE_64] = {0}; 38| 38| uint64_t y[VEC_N_SIZE_64] = {0}; 39| 38| uint64_t h[VEC_N_SIZE_64] = {0}; 40| 38| uint64_t s[VEC_N_SIZE_64] = {0}; 41| | 42| | // Derive keypair seeds 43| 38| hash_i(keypair_seed, seed); ------------------ | | 79| 38|#define hash_i PQCHQC_NAMESPACE(hash_i) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 44| | 45| | // Compute decryption key 46| 38| xof_init(&dk_xof_ctx, seed_dk, SEED_BYTES); ------------------ | | 74| 38|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&dk_xof_ctx, seed_dk, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 47| 38| vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 16| 38|#define vect_sample_fixed_weight1 PQCHQC_NAMESPACE(vect_sample_fixed_weight1) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 19| 38|#define PARAM_OMEGA 66 ///< Define the parameter omega of the scheme ------------------ 48| 38| vect_sample_fixed_weight1(&dk_xof_ctx, x, PARAM_OMEGA); ------------------ | | 16| 38|#define vect_sample_fixed_weight1 PQCHQC_NAMESPACE(vect_sample_fixed_weight1) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight1(&dk_xof_ctx, x, PARAM_OMEGA); ------------------ | | 19| 38|#define PARAM_OMEGA 66 ///< Define the parameter omega of the scheme ------------------ 49| 38| xof_ctx_release(&dk_xof_ctx); ------------------ | | 76| 38|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 50| | 51| | // Compute encryption key 52| 38| xof_init(&ek_xof_ctx, seed_ek, SEED_BYTES); ------------------ | | 74| 38|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&ek_xof_ctx, seed_ek, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 53| 38| vect_set_random(&ek_xof_ctx, h); ------------------ | | 18| 38|#define vect_set_random PQCHQC_NAMESPACE(vect_set_random) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 38| xof_ctx_release(&ek_xof_ctx); ------------------ | | 76| 38|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 55| 38| vect_mul(s, y, h); ------------------ | | 12| 38|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 56| 38| vect_add(s, x, s, VEC_N_SIZE_64); ------------------ | | 19| 38|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(s, x, s, VEC_N_SIZE_64); ------------------ | | 36| 38|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 38] | | | | ------------------ | | ------------------ ------------------ 57| | 58| | // Parse encryption key to string 59| 38| memcpy(ek_pke, seed_ek, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 60| 38| memcpy(ek_pke + SEED_BYTES, s, VEC_N_SIZE_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(ek_pke + SEED_BYTES, s, VEC_N_SIZE_BYTES); ------------------ | | 31| 38|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 38] | | | | ------------------ | | ------------------ ------------------ 61| | 62| | // Parse decryption key to string 63| 38| memcpy(dk_pke, seed_dk, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 64| | 65| |#ifdef VERBOSE 66| | printf("\n\nseed_dk: "); 67| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_dk[i]); 68| | printf("\n\nseed_ek: "); 69| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_ek[i]); 70| | printf("\n\ny: "); 71| | vect_print(y, VEC_N_SIZE_BYTES); 72| | printf("\n\nx: "); 73| | vect_print(x, VEC_N_SIZE_BYTES); 74| | printf("\n\nh: "); 75| | vect_print(h, VEC_N_SIZE_BYTES); 76| | printf("\n\ns: "); 77| | vect_print(s, VEC_N_SIZE_BYTES); 78| |#endif 79| | 80| | // Zeroize sensitive data 81| 38| memset_zero(keypair_seed, sizeof keypair_seed); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 82| 38| memset_zero(x, sizeof x); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 83| 38| memset_zero(y, sizeof y); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 84| 38| memset_zero(&dk_xof_ctx, sizeof dk_xof_ctx); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 85| 38|} PQCHQC_HQC1_C_hqc_pke_encrypt: 99| 76|void hqc_pke_encrypt(ciphertext_pke_t *c_pke, const uint8_t *ek_pke, const uint64_t *m, const uint8_t *theta) { 100| 76| shake256_xof_ctx theta_xof_ctx = {0}; 101| 76| uint64_t h[VEC_N_SIZE_64] = {0}; 102| 76| uint64_t s[VEC_N_SIZE_64] = {0}; 103| 76| uint64_t r1[VEC_N_SIZE_64] = {0}; 104| 76| uint64_t r2[VEC_N_SIZE_64] = {0}; 105| 76| uint64_t e[VEC_N_SIZE_64] = {0}; 106| 76| uint64_t tmp[VEC_N_SIZE_64] = {0}; 107| | 108| | // Initialize Xof using theta 109| 76| xof_init(&theta_xof_ctx, theta, SEED_BYTES); ------------------ | | 74| 76|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&theta_xof_ctx, theta, SEED_BYTES); ------------------ | | 52| 76|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 110| | 111| | // Retrieve h and s from public key 112| 76| hqc_ek_pke_from_string(h, s, ek_pke); ------------------ | | 15| 76|#define hqc_ek_pke_from_string PQCHQC_NAMESPACE(hqc_ek_pke_from_string) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 113| | 114| | // Generate re, e and r1 115| 76| vect_sample_fixed_weight2(&theta_xof_ctx, r2, PARAM_OMEGA_R); ------------------ | | 17| 76|#define vect_sample_fixed_weight2 PQCHQC_NAMESPACE(vect_sample_fixed_weight2) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight2(&theta_xof_ctx, r2, PARAM_OMEGA_R); ------------------ | | 21| 76|#define PARAM_OMEGA_R 75 ///< Define the parameter omega_r of the scheme ------------------ 116| 76| vect_sample_fixed_weight2(&theta_xof_ctx, e, PARAM_OMEGA_E); ------------------ | | 17| 76|#define vect_sample_fixed_weight2 PQCHQC_NAMESPACE(vect_sample_fixed_weight2) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight2(&theta_xof_ctx, e, PARAM_OMEGA_E); ------------------ | | 20| 76|#define PARAM_OMEGA_E 75 ///< Define the parameter omega_e of the scheme ------------------ 117| 76| vect_sample_fixed_weight2(&theta_xof_ctx, r1, PARAM_OMEGA_R); ------------------ | | 17| 76|#define vect_sample_fixed_weight2 PQCHQC_NAMESPACE(vect_sample_fixed_weight2) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight2(&theta_xof_ctx, r1, PARAM_OMEGA_R); ------------------ | | 21| 76|#define PARAM_OMEGA_R 75 ///< Define the parameter omega_r of the scheme ------------------ 118| 76| xof_ctx_release(&theta_xof_ctx); ------------------ | | 76| 76|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 119| | 120| | // Compute u = r1 + r2.h 121| 76| vect_mul(c_pke->u, r2, h); ------------------ | | 12| 76|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 122| 76| vect_add(c_pke->u, r1, c_pke->u, VEC_N_SIZE_64); ------------------ | | 19| 76|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(c_pke->u, r1, c_pke->u, VEC_N_SIZE_64); ------------------ | | 36| 76|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 76|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 76] | | | | ------------------ | | ------------------ ------------------ 123| | 124| | // Compute v = C.encode(m) 125| 76| code_encode(c_pke->v, m); ------------------ | | 14| 76|#define code_encode PQCHQC_NAMESPACE(code_encode) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 126| | 127| | // Compute v = C.encode(m) + Truncate(s.r2 + e) 128| 76| vect_mul(tmp, r2, s); ------------------ | | 12| 76|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 129| 76| vect_add(tmp, e, tmp, VEC_N_SIZE_64); ------------------ | | 19| 76|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(tmp, e, tmp, VEC_N_SIZE_64); ------------------ | | 36| 76|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 76|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 76] | | | | ------------------ | | ------------------ ------------------ 130| 76| vect_truncate(tmp); ------------------ | | 21| 76|#define vect_truncate PQCHQC_NAMESPACE(vect_truncate) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 131| 76| vect_add(c_pke->v, c_pke->v, tmp, VEC_N1N2_SIZE_64); ------------------ | | 19| 76|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(c_pke->v, c_pke->v, tmp, VEC_N1N2_SIZE_64); ------------------ | | 38| 76|#define VEC_N1N2_SIZE_64 CEIL_DIVIDE(PARAM_N1N2, 64) ///< Size of array to store PARAM_N1N2 bits in 64-bit words | | ------------------ | | | | 12| 76|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 76, Folded] | | | | ------------------ | | ------------------ ------------------ 132| | 133| |#ifdef VERBOSE 134| | printf("\n\nh: "); 135| | vect_print(h, VEC_N_SIZE_BYTES); 136| | printf("\n\ns: "); 137| | vect_print(s, VEC_N_SIZE_BYTES); 138| | printf("\n\nr1: "); 139| | vect_print(r1, VEC_N_SIZE_BYTES); 140| | printf("\n\nr2: "); 141| | vect_print(r2, VEC_N_SIZE_BYTES); 142| | printf("\n\ne: "); 143| | vect_print(e, VEC_N_SIZE_BYTES); 144| | printf("\n\nTruncate(s.r2 + e): "); 145| | vect_print(tmp, VEC_N1N2_SIZE_BYTES); 146| | printf("\n\nc_pke->u: "); 147| | vect_print(c_pke->u, VEC_N_SIZE_BYTES); 148| | printf("\n\nc_pke->v: "); 149| | vect_print(c_pke->v, VEC_N1N2_SIZE_BYTES); 150| |#endif 151| | 152| | // Zeroize sensitive data 153| 76| memset_zero(r1, sizeof r1); ------------------ | | 22| 76|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 76|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 154| 76| memset_zero(r2, sizeof r2); ------------------ | | 22| 76|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 76|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 155| 76| memset_zero(e, sizeof e); ------------------ | | 22| 76|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 76|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 156| 76| memset_zero(tmp, sizeof tmp); ------------------ | | 22| 76|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 76|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 157| 76| memset_zero(&theta_xof_ctx, sizeof theta_xof_ctx); ------------------ | | 22| 76|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 76|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 76|} PQCHQC_HQC1_C_hqc_pke_decrypt: 173| 38|uint8_t hqc_pke_decrypt(uint64_t *m, const uint8_t *dk_pke, const ciphertext_pke_t *c_pke) { 174| 38| uint64_t y[VEC_N_SIZE_64] = {0}; 175| 38| uint64_t tmp1[VEC_N_SIZE_64] = {0}; 176| 38| uint64_t tmp2[VEC_N_SIZE_64] = {0}; 177| | 178| | // Parse decryption key dk_pke 179| 38| hqc_dk_pke_from_string(y, dk_pke); ------------------ | | 14| 38|#define hqc_dk_pke_from_string PQCHQC_NAMESPACE(hqc_dk_pke_from_string) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 180| | 181| | // Compute u.y 182| 38| vect_mul(tmp1, y, c_pke->u); ------------------ | | 12| 38|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 183| | // Truncate(u.y) 184| 38| vect_truncate(tmp1); ------------------ | | 21| 38|#define vect_truncate PQCHQC_NAMESPACE(vect_truncate) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 185| | // Compute v - Truncate(u.y) 186| 38| vect_add(tmp2, c_pke->v, tmp1, VEC_N1N2_SIZE_64); ------------------ | | 19| 38|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(tmp2, c_pke->v, tmp1, VEC_N1N2_SIZE_64); ------------------ | | 38| 38|#define VEC_N1N2_SIZE_64 CEIL_DIVIDE(PARAM_N1N2, 64) ///< Size of array to store PARAM_N1N2 bits in 64-bit words | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 38, Folded] | | | | ------------------ | | ------------------ ------------------ 187| | 188| |#ifdef VERBOSE 189| | printf("\n\nc_pke.u: "); 190| | vect_print(c_pke->u, VEC_N_SIZE_BYTES); 191| | printf("\n\nc_pke.v: "); 192| | vect_print(c_pke->v, VEC_N1N2_SIZE_BYTES); 193| | printf("\n\ny: "); 194| | vect_print(y, VEC_N_SIZE_BYTES); 195| | printf("\n\nTruncate(u.y): "); 196| | vect_print(tmp1, VEC_N1N2_SIZE_BYTES); 197| | printf("\n\nv - Truncate(u.y): "); 198| | vect_print(tmp2, VEC_N1N2_SIZE_BYTES); 199| |#endif 200| | 201| | // Compute plaintext m 202| 38| code_decode(m, tmp2); ------------------ | | 15| 38|#define code_decode PQCHQC_NAMESPACE(code_decode) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 203| | 204| | // Zeroize sensitive data 205| 38| memset_zero(y, sizeof y); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 206| 38| memset_zero(tmp1, sizeof tmp1); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 207| 38| memset_zero(tmp2, sizeof tmp2); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 208| | 209| 38| return 0; 210| 38|} PQCHQC_HQC1_C_crypto_kem_keypair: 39| 38|int crypto_kem_keypair(uint8_t *ek_kem, uint8_t *dk_kem) { 40| |#ifdef VERBOSE 41| | printf("\n\n\n### KEYGEN ###"); 42| |#endif 43| 38| uint8_t seed_kem[SEED_BYTES] = {0}; 44| 38| uint8_t sigma[PARAM_SECURITY_BYTES] = {0}; 45| 38| uint8_t seed_pke[SEED_BYTES] = {0}; 46| 38| shake256_xof_ctx ctx_kem; 47| | 48| 38| uint8_t ek_pke[PUBLIC_KEY_BYTES] = {0}; 49| 38| uint8_t dk_pke[SEED_BYTES] = {0}; 50| | 51| 38| prng_get_bytes(seed_kem, SEED_BYTES); ------------------ | | 73| 38|#define prng_get_bytes PQCHQC_NAMESPACE(prng_get_bytes) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ prng_get_bytes(seed_kem, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 52| | 53| | // Compute seed_pke and randomness sigma 54| 38| xof_init(&ctx_kem, seed_kem, SEED_BYTES); ------------------ | | 74| 38|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&ctx_kem, seed_kem, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 55| 38| xof_get_bytes(&ctx_kem, seed_pke, SEED_BYTES); ------------------ | | 75| 38|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_get_bytes(&ctx_kem, seed_pke, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 56| 38| xof_get_bytes(&ctx_kem, sigma, PARAM_SECURITY_BYTES); ------------------ | | 75| 38|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_get_bytes(&ctx_kem, sigma, PARAM_SECURITY_BYTES); ------------------ | | 23| 38|#define PARAM_SECURITY_BYTES 16 ///< Define the security level in bytes ------------------ 57| 38| xof_ctx_release(&ctx_kem); ------------------ | | 76| 38|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 58| | 59| | // Compute HQC-PKE keypair 60| 38| hqc_pke_keygen(ek_pke, dk_pke, seed_pke); ------------------ | | 14| 38|#define hqc_pke_keygen PQCHQC_NAMESPACE(hqc_pke_keygen) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 61| | 62| | // Compute HQC-KEM keypair 63| 38| memcpy(ek_kem, ek_pke, PUBLIC_KEY_BYTES); ------------------ | | 27| 38|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 38|#define CRYPTO_PUBLICKEYBYTES 2241 | | ------------------ ------------------ 64| 38| memcpy(dk_kem, ek_kem, PUBLIC_KEY_BYTES); ------------------ | | 27| 38|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 38|#define CRYPTO_PUBLICKEYBYTES 2241 | | ------------------ ------------------ 65| 38| memcpy(dk_kem + PUBLIC_KEY_BYTES, dk_pke, SEED_BYTES); ------------------ | | 27| 38|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 38|#define CRYPTO_PUBLICKEYBYTES 2241 | | ------------------ ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES, dk_pke, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 66| 38| memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, sigma, PARAM_SECURITY_BYTES); ------------------ | | 27| 38|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 38|#define CRYPTO_PUBLICKEYBYTES 2241 | | ------------------ ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, sigma, PARAM_SECURITY_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, sigma, PARAM_SECURITY_BYTES); ------------------ | | 23| 38|#define PARAM_SECURITY_BYTES 16 ///< Define the security level in bytes ------------------ 67| 38| memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 27| 38|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 38|#define CRYPTO_PUBLICKEYBYTES 2241 | | ------------------ ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 23| 38|#define PARAM_SECURITY_BYTES 16 ///< Define the security level in bytes ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 68| | 69| |#ifdef VERBOSE 70| | printf("\n\nseed_kem: "); 71| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_kem[i]); 72| | printf("\n\nseed_pke: "); 73| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_pke[i]); 74| | printf("\n\nsigma: "); 75| | for (int i = 0; i < PARAM_SECURITY_BYTES; ++i) printf("%02x", sigma[i]); 76| |#endif 77| | 78| | // Zeroize sensitive data 79| 38| memset_zero(seed_kem, sizeof seed_kem); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 80| 38| memset_zero(sigma, sizeof sigma); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 81| 38| memset_zero(seed_pke, sizeof seed_pke); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 82| 38| memset_zero(dk_pke, sizeof dk_pke); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 83| | 84| 38| return 0; 85| 38|} PQCHQC_HQC1_C_crypto_kem_enc: 105| 38|int crypto_kem_enc(uint8_t *c_kem, uint8_t *K, const uint8_t *ek_kem) { 106| |#ifdef VERBOSE 107| | printf("\n\n\n\n### ENCAPS ###"); 108| |#endif 109| | 110| 38| uint8_t m[PARAM_SECURITY_BYTES] = {0}; 111| 38| uint8_t K_theta[SHARED_SECRET_BYTES + SEED_BYTES] = {0}; 112| 38| uint8_t theta[SEED_BYTES] = {0}; 113| 38| uint8_t hash_ek_kem[SEED_BYTES] = {0}; 114| 38| ciphertext_kem_t c_kem_t = {0}; 115| | 116| | // Sample message m and salt 117| 38| prng_get_bytes(m, PARAM_SECURITY_BYTES); ------------------ | | 73| 38|#define prng_get_bytes PQCHQC_NAMESPACE(prng_get_bytes) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ prng_get_bytes(m, PARAM_SECURITY_BYTES); ------------------ | | 23| 38|#define PARAM_SECURITY_BYTES 16 ///< Define the security level in bytes ------------------ 118| 38| prng_get_bytes(c_kem_t.salt, SALT_BYTES); ------------------ | | 73| 38|#define prng_get_bytes PQCHQC_NAMESPACE(prng_get_bytes) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ prng_get_bytes(c_kem_t.salt, SALT_BYTES); ------------------ | | 53| 38|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 119| | 120| | // Compute shared key K and ciphertext c_kem 121| 38| hash_h(hash_ek_kem, ek_kem); ------------------ | | 78| 38|#define hash_h PQCHQC_NAMESPACE(hash_h) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 122| 38| hash_g(K_theta, hash_ek_kem, m, c_kem_t.salt); ------------------ | | 77| 38|#define hash_g PQCHQC_NAMESPACE(hash_g) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 123| 38| memcpy(theta, K_theta + SEED_BYTES, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(theta, K_theta + SEED_BYTES, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 124| 38| hqc_pke_encrypt(&c_kem_t.c_pke, ek_kem, (uint64_t *)m, theta); ------------------ | | 15| 38|#define hqc_pke_encrypt PQCHQC_NAMESPACE(hqc_pke_encrypt) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 125| | 126| 38| hqc_c_kem_to_string(c_kem, &c_kem_t); ------------------ | | 16| 38|#define hqc_c_kem_to_string PQCHQC_NAMESPACE(hqc_c_kem_to_string) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 127| 38| memcpy(K, K_theta, SHARED_SECRET_BYTES); ------------------ | | 28| 38|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 38|#define CRYPTO_BYTES 32 | | ------------------ ------------------ 128| | 129| |#ifdef VERBOSE 130| | printf("\n\nek_kem: "); 131| | for (int i = 0; i < PUBLIC_KEY_BYTES; ++i) printf("%02x", ek_kem[i]); 132| | printf("\n\nm: "); 133| | vect_print((uint64_t *)m, PARAM_SECURITY_BYTES); 134| | printf("\n\nsalt: "); 135| | for (int i = 0; i < SALT_BYTES; ++i) printf("%02x", c_kem_t.salt[i]); 136| | printf("\n\nH(ek_kem): "); 137| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", hash_ek_kem[i]); 138| | printf("\n\ntheta: "); 139| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", theta[i]); 140| | printf("\n\nc_kem: "); 141| | for (int i = 0; i < CIPHERTEXT_BYTES; ++i) printf("%02x", c_kem[i]); 142| | printf("\n\nK: "); 143| | for (int i = 0; i < SHARED_SECRET_BYTES; ++i) printf("%02x", K[i]); 144| |#endif 145| | 146| | // Zeroize sensitive data 147| 38| memset_zero(m, sizeof m); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 148| 38| memset_zero(K_theta, sizeof K_theta); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 38| memset_zero(theta, sizeof theta); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 150| | 151| 38| return 0; 152| 38|} PQCHQC_HQC1_C_crypto_kem_dec: 166| 38|int crypto_kem_dec(uint8_t *K_prime, const uint8_t *c_kem, const uint8_t *dk_kem) { 167| |#ifdef VERBOSE 168| | printf("\n\n\n\n### DECAPS ###"); 169| |#endif 170| | 171| 38| uint8_t ek_pke[PUBLIC_KEY_BYTES] = {0}; 172| 38| uint8_t dk_pke[SEED_BYTES] = {0}; 173| 38| uint8_t sigma[PARAM_SECURITY_BYTES] = {0}; 174| 38| uint8_t m_prime[PARAM_SECURITY_BYTES] = {0}; 175| 38| uint8_t hash_ek_kem[SEED_BYTES] = {0}; 176| 38| uint8_t K_theta_prime[SHARED_SECRET_BYTES + SEED_BYTES] = {0}; 177| 38| uint8_t K_bar[SHARED_SECRET_BYTES] = {0}; 178| 38| uint8_t theta_prime[SEED_BYTES] = {0}; 179| 38| ciphertext_kem_t c_kem_t = {0}; 180| 38| ciphertext_kem_t c_kem_prime_t = {0}; 181| 38| uint8_t result; 182| | 183| | // Parse decapsulation key dk_kem 184| 38| memcpy(ek_pke, dk_kem, PUBLIC_KEY_BYTES); ------------------ | | 27| 38|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 38|#define CRYPTO_PUBLICKEYBYTES 2241 | | ------------------ ------------------ 185| 38| memcpy(dk_pke, dk_kem + PUBLIC_KEY_BYTES, SEED_BYTES); ------------------ | | 27| 38|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 38|#define CRYPTO_PUBLICKEYBYTES 2241 | | ------------------ ------------------ memcpy(dk_pke, dk_kem + PUBLIC_KEY_BYTES, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 186| 38| memcpy(sigma, dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, PARAM_SECURITY_BYTES); ------------------ | | 27| 38|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 38|#define CRYPTO_PUBLICKEYBYTES 2241 | | ------------------ ------------------ memcpy(sigma, dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, PARAM_SECURITY_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(sigma, dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, PARAM_SECURITY_BYTES); ------------------ | | 23| 38|#define PARAM_SECURITY_BYTES 16 ///< Define the security level in bytes ------------------ 187| | 188| | // Parse ciphertext c_kem 189| 38| hqc_c_kem_from_string(&c_kem_t.c_pke, c_kem_t.salt, c_kem); ------------------ | | 17| 38|#define hqc_c_kem_from_string PQCHQC_NAMESPACE(hqc_c_kem_from_string) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 190| | 191| | // Compute message m_prime 192| 38| result = hqc_pke_decrypt((uint64_t *)m_prime, dk_pke, &c_kem_t.c_pke); ------------------ | | 16| 38|#define hqc_pke_decrypt PQCHQC_NAMESPACE(hqc_pke_decrypt) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 193| | 194| | // Compute shared key K_prime and ciphertext c_kem_prime 195| 38| hash_h(hash_ek_kem, ek_pke); ------------------ | | 78| 38|#define hash_h PQCHQC_NAMESPACE(hash_h) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 196| 38| hash_g(K_theta_prime, hash_ek_kem, m_prime, c_kem_t.salt); ------------------ | | 77| 38|#define hash_g PQCHQC_NAMESPACE(hash_g) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 197| 38| memcpy(K_prime, K_theta_prime, SHARED_SECRET_BYTES); ------------------ | | 28| 38|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 38|#define CRYPTO_BYTES 32 | | ------------------ ------------------ 198| 38| memcpy(theta_prime, K_theta_prime + SHARED_SECRET_BYTES, SEED_BYTES); ------------------ | | 28| 38|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 38|#define CRYPTO_BYTES 32 | | ------------------ ------------------ memcpy(theta_prime, K_theta_prime + SHARED_SECRET_BYTES, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 199| | 200| 38| hqc_pke_encrypt(&c_kem_prime_t.c_pke, ek_pke, (uint64_t *)m_prime, theta_prime); ------------------ | | 15| 38|#define hqc_pke_encrypt PQCHQC_NAMESPACE(hqc_pke_encrypt) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 201| 38| memcpy(c_kem_prime_t.salt, c_kem_t.salt, SALT_BYTES); ------------------ | | 53| 38|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 202| | 203| | // Compute rejection key K_bar 204| 38| hash_j(K_bar, hash_ek_kem, sigma, &c_kem_t); ------------------ | | 80| 38|#define hash_j PQCHQC_NAMESPACE(hash_j) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 205| 38| result |= vect_compare((uint8_t *)c_kem_t.c_pke.u, (uint8_t *)c_kem_prime_t.c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 20| 38|#define vect_compare PQCHQC_NAMESPACE(vect_compare) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ result |= vect_compare((uint8_t *)c_kem_t.c_pke.u, (uint8_t *)c_kem_prime_t.c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 31| 38|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 38] | | | | ------------------ | | ------------------ ------------------ 206| 38| result |= vect_compare((uint8_t *)c_kem_t.c_pke.v, (uint8_t *)c_kem_prime_t.c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 20| 38|#define vect_compare PQCHQC_NAMESPACE(vect_compare) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ result |= vect_compare((uint8_t *)c_kem_t.c_pke.v, (uint8_t *)c_kem_prime_t.c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 38|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 38, Folded] | | | | ------------------ | | ------------------ ------------------ 207| 38| result |= vect_compare(c_kem_t.salt, c_kem_prime_t.salt, SALT_BYTES); ------------------ | | 20| 38|#define vect_compare PQCHQC_NAMESPACE(vect_compare) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ result |= vect_compare(c_kem_t.salt, c_kem_prime_t.salt, SALT_BYTES); ------------------ | | 53| 38|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 208| 38| result -= 1; 209| 1.25k| for (size_t i = 0; i < SHARED_SECRET_BYTES; ++i) { ------------------ | | 28| 1.25k|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 1.25k|#define CRYPTO_BYTES 32 | | ------------------ ------------------ | Branch (209:24): [True: 1.21k, False: 38] ------------------ 210| 1.21k| K_prime[i] = (K_prime[i] & result) ^ (K_bar[i] & ~result); 211| 1.21k| } 212| | 213| |#ifdef VERBOSE 214| | printf("\n\nek_pke: "); 215| | for (int i = 0; i < PUBLIC_KEY_BYTES; ++i) printf("%02x", ek_pke[i]); 216| | printf("\n\ndk_pke: "); 217| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", dk_pke[i]); 218| | printf("\n\nc_kem: "); 219| | for (int i = 0; i < CIPHERTEXT_BYTES; ++i) printf("%02x", c_kem[i]); 220| | printf("\n\nm_prime: "); 221| | vect_print((uint64_t *)m_prime, PARAM_SECURITY_BYTES); 222| | printf("\n\nH(ek_kem): "); 223| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", hash_ek_kem[i]); 224| | printf("\n\ntheta_prime: "); 225| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", theta_prime[i]); 226| | printf("\n\n\n# Checking Ciphertext - Begin #"); 227| | printf("\n\nc_kem_prime_t.c_pke.u: "); 228| | vect_print(c_kem_prime_t.c_pke.u, VEC_N_SIZE_BYTES); 229| | printf("\n\nc_kem_prime_t.c_pke.v: "); 230| | vect_print(c_kem_prime_t.c_pke.v, VEC_N1N2_SIZE_BYTES); 231| | printf("\n\nsalt: "); 232| | for (int i = 0; i < SALT_BYTES; ++i) printf("%02x", c_kem_prime_t.salt[i]); 233| | printf("\n\n# Checking Ciphertext - End #\n"); 234| | printf("\n\nK_prime: "); 235| | for (int i = 0; i < SHARED_SECRET_BYTES; ++i) printf("%02x", K_prime[i]); 236| |#endif 237| | 238| | // Zeroize sensitive data 239| 38| memset_zero(dk_pke, sizeof dk_pke); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 240| 38| memset_zero(sigma, sizeof sigma); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 241| 38| memset_zero(m_prime, sizeof m_prime); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 242| 38| memset_zero(K_theta_prime, sizeof K_theta_prime); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 243| 38| memset_zero(K_bar, sizeof K_bar); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 244| 38| memset_zero(theta_prime, sizeof theta_prime); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 245| | 246| 38| return 0; 247| 38|} PQCHQC_HQC1_C_hqc_dk_pke_from_string: 19| 38|void hqc_dk_pke_from_string(uint64_t *y, const uint8_t *dk_pke) { 20| 38| shake256_xof_ctx dk_xof_ctx = {0}; 21| 38| xof_init(&dk_xof_ctx, dk_pke, SEED_BYTES); ------------------ | | 74| 38|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&dk_xof_ctx, dk_pke, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 22| 38| vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 16| 38|#define vect_sample_fixed_weight1 PQCHQC_NAMESPACE(vect_sample_fixed_weight1) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 19| 38|#define PARAM_OMEGA 66 ///< Define the parameter omega of the scheme ------------------ 23| 38| xof_ctx_release(&dk_xof_ctx); ------------------ | | 76| 38|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 24| | 25| | // Zeroize sensitive data 26| 38| memset_zero(&dk_xof_ctx, sizeof dk_xof_ctx); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 27| 38|} PQCHQC_HQC1_C_hqc_ek_pke_from_string: 36| 76|void hqc_ek_pke_from_string(uint64_t *h, uint64_t *s, const uint8_t *ek_pke) { 37| 76| shake256_xof_ctx ek_xof_ctx = {0}; 38| | 39| 76| xof_init(&ek_xof_ctx, ek_pke, SEED_BYTES); ------------------ | | 74| 76|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&ek_xof_ctx, ek_pke, SEED_BYTES); ------------------ | | 52| 76|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 40| 76| vect_set_random(&ek_xof_ctx, h); ------------------ | | 18| 76|#define vect_set_random PQCHQC_NAMESPACE(vect_set_random) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 41| 76| xof_ctx_release(&ek_xof_ctx); ------------------ | | 76| 76|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 76|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 76|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 76|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 42| | 43| 76| memcpy(s, ek_pke + SEED_BYTES, VEC_N_SIZE_BYTES); ------------------ | | 52| 76|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(s, ek_pke + SEED_BYTES, VEC_N_SIZE_BYTES); ------------------ | | 31| 76|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 76|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 76] | | | | ------------------ | | ------------------ ------------------ 44| 76|} PQCHQC_HQC1_C_hqc_c_kem_to_string: 52| 38|void hqc_c_kem_to_string(uint8_t *ct, const ciphertext_kem_t *c_kem) { 53| 38| memcpy(ct, c_kem->c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 31| 38|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 38] | | | | ------------------ | | ------------------ ------------------ 54| 38| memcpy(ct + VEC_N_SIZE_BYTES, c_kem->c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 31| 38|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 38] | | | | ------------------ | | ------------------ ------------------ memcpy(ct + VEC_N_SIZE_BYTES, c_kem->c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 38|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 38, Folded] | | | | ------------------ | | ------------------ ------------------ 55| 38| memcpy(ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, c_kem->salt, SALT_BYTES); ------------------ | | 31| 38|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 38] | | | | ------------------ | | ------------------ ------------------ memcpy(ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, c_kem->salt, SALT_BYTES); ------------------ | | 34| 38|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 38, Folded] | | | | ------------------ | | ------------------ ------------------ memcpy(ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, c_kem->salt, SALT_BYTES); ------------------ | | 53| 38|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 56| 38|} PQCHQC_HQC1_C_hqc_c_kem_from_string: 65| 38|void hqc_c_kem_from_string(ciphertext_pke_t *c_pke, uint8_t *salt, const uint8_t *ct) { 66| 38| memcpy(c_pke->u, ct, VEC_N_SIZE_BYTES); ------------------ | | 31| 38|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 38] | | | | ------------------ | | ------------------ ------------------ 67| 38| memcpy(c_pke->v, ct + VEC_N_SIZE_BYTES, VEC_N1N2_SIZE_BYTES); ------------------ | | 31| 38|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 38] | | | | ------------------ | | ------------------ ------------------ memcpy(c_pke->v, ct + VEC_N_SIZE_BYTES, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 38|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 38, Folded] | | | | ------------------ | | ------------------ ------------------ 68| 38| memcpy(salt, ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, SALT_BYTES); ------------------ | | 31| 38|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 38] | | | | ------------------ | | ------------------ ------------------ memcpy(salt, ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, SALT_BYTES); ------------------ | | 34| 38|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 38, Folded] | | | | ------------------ | | ------------------ ------------------ memcpy(salt, ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, SALT_BYTES); ------------------ | | 53| 38|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 69| 38|} PQCHQC_HQC1_C_reed_muller_encode: 174| 76|void reed_muller_encode(uint64_t *cdw, const uint64_t *msg) { 175| 76| uint8_t *message_array = (uint8_t *)msg; 176| 76| rm_codeword_t *codeArray = (rm_codeword_t *)cdw; 177| 3.57k| for (size_t i = 0; i < VEC_N1_SIZE_BYTES; i++) { ------------------ | | 33| 3.57k|#define VEC_N1_SIZE_BYTES PARAM_N1 ///< Size of array to store PARAM_N1 bits in bytes | | ------------------ | | | | 16| 3.57k|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) | | ------------------ ------------------ | Branch (177:24): [True: 3.49k, False: 76] ------------------ 178| | // fill entries i * MULTIPLICITY to (i+1) * MULTIPLICITY 179| 3.49k| int32_t pos = i * MULTIPLICITY; ------------------ | | 18| 3.49k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 3.49k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 3.49k, Folded] | | | | ------------------ | | ------------------ ------------------ 180| | // encode first word 181| 3.49k| encode(&codeArray[pos], message_array[i]); 182| | // copy to other identical codewords 183| 10.4k| for (size_t copy = 1; copy < MULTIPLICITY; copy++) { ------------------ | | 18| 10.4k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 10.4k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 10.4k, Folded] | | | | ------------------ | | ------------------ ------------------ | Branch (183:31): [True: 6.99k, False: 3.49k] ------------------ 184| 6.99k| memcpy(&codeArray[pos + copy], &codeArray[pos], sizeof(rm_codeword_t)); 185| 6.99k| } 186| 3.49k| } 187| 76|} PQCHQC_HQC1_C_reed_muller_decode: 198| 38|void reed_muller_decode(uint64_t *msg, const uint64_t *cdw) { 199| 38| uint8_t *message_array = (uint8_t *)msg; 200| 38| rm_codeword_t *codeArray = (rm_codeword_t *)cdw; 201| 38| rm_expanded_cdw expanded; 202| 1.78k| for (size_t i = 0; i < VEC_N1_SIZE_BYTES; i++) { ------------------ | | 33| 1.78k|#define VEC_N1_SIZE_BYTES PARAM_N1 ///< Size of array to store PARAM_N1 bits in bytes | | ------------------ | | | | 16| 1.78k|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) | | ------------------ ------------------ | Branch (202:24): [True: 1.74k, False: 38] ------------------ 203| | // collect the codewords 204| 1.74k| expand_and_sum(&expanded, &codeArray[i * MULTIPLICITY]); ------------------ | | 18| 1.74k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 1.74k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 1.74k, Folded] | | | | ------------------ | | ------------------ ------------------ 205| | // apply hadamard transform 206| 1.74k| rm_expanded_cdw transform; 207| 1.74k| hadamard(&expanded, &transform); 208| | // fix the first entry to get the half Hadamard transform 209| 1.74k| transform[0] -= 64 * MULTIPLICITY; ------------------ | | 18| 1.74k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 1.74k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 1.74k, Folded] | | | | ------------------ | | ------------------ ------------------ 210| | // finish the decoding 211| 1.74k| message_array[i] = find_peaks(&transform); 212| 1.74k| } 213| 38|} reed_muller.c:encode: 59| 15.7k|static void encode(rm_codeword_t *word, int32_t message) { 60| 15.7k| int32_t first_word; 61| | 62| 15.7k| first_word = BIT0MASK(message >> 7); ------------------ | | 34| 15.7k|#define BIT0MASK(x) (int32_t)(-((x) & 1)) ------------------ 63| | 64| 15.7k| first_word ^= BIT0MASK(message >> 0) & 0xaaaaaaaa; ------------------ | | 34| 15.7k|#define BIT0MASK(x) (int32_t)(-((x) & 1)) ------------------ 65| 15.7k| first_word ^= BIT0MASK(message >> 1) & 0xcccccccc; ------------------ | | 34| 15.7k|#define BIT0MASK(x) (int32_t)(-((x) & 1)) ------------------ 66| 15.7k| first_word ^= BIT0MASK(message >> 2) & 0xf0f0f0f0; ------------------ | | 34| 15.7k|#define BIT0MASK(x) (int32_t)(-((x) & 1)) ------------------ 67| 15.7k| first_word ^= BIT0MASK(message >> 3) & 0xff00ff00; ------------------ | | 34| 15.7k|#define BIT0MASK(x) (int32_t)(-((x) & 1)) ------------------ 68| 15.7k| first_word ^= BIT0MASK(message >> 4) & 0xffff0000; ------------------ | | 34| 15.7k|#define BIT0MASK(x) (int32_t)(-((x) & 1)) ------------------ 69| | 70| 15.7k| word->u32[0] = first_word; 71| | 72| 15.7k| first_word ^= BIT0MASK(message >> 5); ------------------ | | 34| 15.7k|#define BIT0MASK(x) (int32_t)(-((x) & 1)) ------------------ 73| 15.7k| word->u32[1] = first_word; 74| 15.7k| first_word ^= BIT0MASK(message >> 6); ------------------ | | 34| 15.7k|#define BIT0MASK(x) (int32_t)(-((x) & 1)) ------------------ 75| 15.7k| word->u32[3] = first_word; 76| 15.7k| first_word ^= BIT0MASK(message >> 5); ------------------ | | 34| 15.7k|#define BIT0MASK(x) (int32_t)(-((x) & 1)) ------------------ 77| 15.7k| word->u32[2] = first_word; 78| 15.7k| return; 79| 15.7k|} reed_muller.c:expand_and_sum: 121| 7.88k|static void expand_and_sum(rm_expanded_cdw *dest, rm_codeword_t src[]) { 122| | // start with the first copy 123| 39.4k| for (int32_t part = 0; part < 4; part++) { ------------------ | Branch (123:28): [True: 31.5k, False: 7.88k] ------------------ 124| 1.04M| for (int32_t bit = 0; bit < 32; bit++) { ------------------ | Branch (124:31): [True: 1.00M, False: 31.5k] ------------------ 125| 1.00M| (*dest)[part * 32 + bit] = src[0].u32[part] >> bit & 1; 126| 1.00M| } 127| 31.5k| } 128| | // sum the rest of the copies 129| 35.9k| for (int32_t copy = 1; copy < MULTIPLICITY; copy++) { ------------------ | | 18| 35.9k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 35.9k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 35.9k, Folded] | | | | ------------------ | | ------------------ ------------------ | Branch (129:28): [True: 28.0k, False: 7.88k] ------------------ 130| 140k| for (int32_t part = 0; part < 4; part++) { ------------------ | Branch (130:32): [True: 112k, False: 28.0k] ------------------ 131| 3.69M| for (int32_t bit = 0; bit < 32; bit++) { ------------------ | Branch (131:35): [True: 3.58M, False: 112k] ------------------ 132| 3.58M| (*dest)[part * 32 + bit] += src[copy].u32[part] >> bit & 1; 133| 3.58M| } 134| 112k| } 135| 28.0k| } 136| 7.88k|} reed_muller.c:hadamard: 90| 7.88k|static void hadamard(rm_expanded_cdw *src, rm_expanded_cdw *dst) { 91| | // the passes move data: 92| | // src -> dst -> src -> dst -> src -> dst -> src -> dst 93| | // using p1 and p2 alternately 94| 7.88k| rm_expanded_cdw *p1 = src; 95| 7.88k| rm_expanded_cdw *p2 = dst; 96| 63.0k| for (int32_t pass = 0; pass < 7; pass++) { ------------------ | Branch (96:28): [True: 55.1k, False: 7.88k] ------------------ 97| 3.58M| for (int32_t i = 0; i < 64; i++) { ------------------ | Branch (97:29): [True: 3.53M, False: 55.1k] ------------------ 98| 3.53M| (*p2)[i] = (*p1)[2 * i] + (*p1)[2 * i + 1]; 99| 3.53M| (*p2)[i + 64] = (*p1)[2 * i] - (*p1)[2 * i + 1]; 100| 3.53M| } 101| | // swap p1, p2 for next round 102| 55.1k| rm_expanded_cdw *p3 = p1; 103| 55.1k| p1 = p2; 104| 55.1k| p2 = p3; 105| 55.1k| } 106| 7.88k|} reed_muller.c:find_peaks: 147| 7.88k|static int32_t find_peaks(rm_expanded_cdw *transform) { 148| 7.88k| int32_t peak_abs_value = 0; 149| 7.88k| int32_t peak_value = 0; 150| 7.88k| int32_t peak_pos = 0; 151| 1.01M| for (int32_t i = 0; i < 128; i++) { ------------------ | Branch (151:25): [True: 1.00M, False: 7.88k] ------------------ 152| | // get absolute value 153| 1.00M| int32_t t = (*transform)[i]; 154| 1.00M| int32_t pos_mask = -(t > 0); 155| 1.00M| int32_t absolute = (pos_mask & t) | (~pos_mask & -t); 156| 1.00M| peak_value = absolute > peak_abs_value ? t : peak_value; ------------------ | Branch (156:22): [True: 38.6k, False: 970k] ------------------ 157| 1.00M| peak_pos = absolute > peak_abs_value ? i : peak_pos; ------------------ | Branch (157:20): [True: 38.6k, False: 970k] ------------------ 158| 1.00M| peak_abs_value = absolute > peak_abs_value ? absolute : peak_abs_value; ------------------ | Branch (158:26): [True: 38.6k, False: 970k] ------------------ 159| 1.00M| } 160| | // set bit 7 161| 7.88k| peak_pos |= 128 * (peak_value > 0); 162| 7.88k| return peak_pos; 163| 7.88k|} PQCHQC_HQC1_C_reed_solomon_encode: 84| 76|void reed_solomon_encode(uint64_t *cdw, const uint64_t *msg) { 85| 76| size_t i, j, k; 86| 76| uint8_t gate_value = 0; 87| | 88| 76| uint16_t tmp[PARAM_G] = {0}; 89| 76| uint16_t PARAM_RS_POLY[] = {RS_POLY_COEFS}; ------------------ | | 49| 76| 89, 69, 153, 116, 176, 117, 111, 75, 73, 233, 242, 233, 65, 210, 21, 139, 103, 173, 67, 118, \ | | 50| 76| 105, 210, 174, 110, 74, 69, 228, 82, 255, 181, 1 ///< Coefficients of the Reed–Solomon generator polynomial ------------------ 90| | 91| 76| uint8_t msg_bytes[PARAM_K] = {0}; 92| 76| uint8_t cdw_bytes[PARAM_N1] = {0}; 93| | 94| 76| memcpy(msg_bytes, msg, PARAM_K); ------------------ | | 44| 76|#define PARAM_K 16 ///< Define the size of the information bits of the Reed–Solomon code ------------------ 95| | 96| 1.29k| for (i = 0; i < PARAM_K; ++i) { ------------------ | | 44| 1.29k|#define PARAM_K 16 ///< Define the size of the information bits of the Reed–Solomon code ------------------ | Branch (96:17): [True: 1.21k, False: 76] ------------------ 97| 1.21k| gate_value = msg_bytes[PARAM_K - 1 - i] ^ cdw_bytes[PARAM_N1 - PARAM_K - 1]; ------------------ | | 44| 1.21k|#define PARAM_K 16 ///< Define the size of the information bits of the Reed–Solomon code ------------------ gate_value = msg_bytes[PARAM_K - 1 - i] ^ cdw_bytes[PARAM_N1 - PARAM_K - 1]; ------------------ | | 16| 1.21k|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) ------------------ gate_value = msg_bytes[PARAM_K - 1 - i] ^ cdw_bytes[PARAM_N1 - PARAM_K - 1]; ------------------ | | 44| 1.21k|#define PARAM_K 16 ///< Define the size of the information bits of the Reed–Solomon code ------------------ 98| | 99| 38.9k| for (j = 0; j < PARAM_G; ++j) { ------------------ | | 45| 38.9k|#define PARAM_G 31 ///< Define the size of the generator polynomial of the Reed–Solomon code ------------------ | Branch (99:21): [True: 37.6k, False: 1.21k] ------------------ 100| 37.6k| tmp[j] = gf_mul(gate_value, PARAM_RS_POLY[j]); ------------------ | | 51| 37.6k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 37.6k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 37.6k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 37.6k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 101| 37.6k| } 102| | 103| 36.4k| for (k = PARAM_N1 - PARAM_K - 1; k; --k) { ------------------ | | 16| 1.21k|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) ------------------ for (k = PARAM_N1 - PARAM_K - 1; k; --k) { ------------------ | | 44| 1.21k|#define PARAM_K 16 ///< Define the size of the information bits of the Reed–Solomon code ------------------ | Branch (103:42): [True: 35.2k, False: 1.21k] ------------------ 104| 35.2k| cdw_bytes[k] = cdw_bytes[k - 1] ^ tmp[k]; 105| 35.2k| } 106| | 107| 1.21k| cdw_bytes[0] = tmp[0]; 108| 1.21k| } 109| | 110| 76| memcpy(cdw_bytes + PARAM_N1 - PARAM_K, msg_bytes, PARAM_K); ------------------ | | 16| 76|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) ------------------ memcpy(cdw_bytes + PARAM_N1 - PARAM_K, msg_bytes, PARAM_K); ------------------ | | 44| 76|#define PARAM_K 16 ///< Define the size of the information bits of the Reed–Solomon code ------------------ memcpy(cdw_bytes + PARAM_N1 - PARAM_K, msg_bytes, PARAM_K); ------------------ | | 44| 76|#define PARAM_K 16 ///< Define the size of the information bits of the Reed–Solomon code ------------------ 111| 76| memcpy(cdw, cdw_bytes, PARAM_N1); ------------------ | | 16| 76|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) ------------------ 112| 76|} PQCHQC_HQC1_C_reed_solomon_decode: 353| 38|void reed_solomon_decode(uint64_t *msg, uint64_t *cdw) { 354| 38| uint8_t cdw_bytes[PARAM_N1] = {0}; 355| 38| uint16_t syndromes[2 * PARAM_DELTA] = {0}; 356| 38| uint16_t sigma[1 << PARAM_FFT] = {0}; 357| 38| uint8_t error[1 << PARAM_M] = {0}; 358| 38| uint16_t z[PARAM_N1] = {0}; 359| 38| uint16_t error_values[PARAM_N1] = {0}; 360| 38| uint16_t deg; 361| | 362| | // Copy the vector in an array of bytes 363| 38| memcpy(cdw_bytes, cdw, PARAM_N1); ------------------ | | 16| 38|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) ------------------ 364| | 365| | // Calculate the 2*PARAM_DELTA syndromes 366| 38| compute_syndromes(syndromes, cdw_bytes); 367| | 368| | // Compute the error locator polynomial sigma 369| | // Sigma's degree is at most PARAM_DELTA but the FFT requires the extra room 370| 38| deg = compute_elp(sigma, syndromes); 371| | 372| | // Compute the error polynomial error 373| 38| compute_roots(error, sigma); 374| | 375| | // Compute the polynomial z(x) 376| 38| compute_z_poly(z, sigma, deg, syndromes); 377| | 378| | // Compute the error values 379| 38| compute_error_values(error_values, z, error); 380| | 381| | // Correct the errors 382| 38| correct_errors(cdw_bytes, error_values); 383| | 384| | // Retrieve the message from the decoded codeword 385| 38| memcpy(msg, cdw_bytes + (PARAM_G - 1), PARAM_K); ------------------ | | 45| 38|#define PARAM_G 31 ///< Define the size of the generator polynomial of the Reed–Solomon code ------------------ memcpy(msg, cdw_bytes + (PARAM_G - 1), PARAM_K); ------------------ | | 44| 38|#define PARAM_K 16 ///< Define the size of the information bits of the Reed–Solomon code ------------------ 386| | 387| |#ifdef VERBOSE 388| | printf("\n\nThe syndromes: "); 389| | for (size_t i = 0; i < 2 * PARAM_DELTA; ++i) { 390| | printf("%u ", syndromes[i]); 391| | } 392| | printf("\n\nThe error locator polynomial: sigma(x) = "); 393| | bool first_coeff = true; 394| | if (sigma[0]) { 395| | printf("%u", sigma[0]); 396| | first_coeff = false; 397| | } 398| | for (size_t i = 1; i < (1 << PARAM_FFT); ++i) { 399| | if (sigma[i] == 0) 400| | continue; 401| | if (!first_coeff) 402| | printf(" + "); 403| | first_coeff = false; 404| | if (sigma[i] != 1) 405| | printf("%u ", sigma[i]); 406| | if (i == 1) 407| | printf("x"); 408| | else 409| | printf("x^%zu", i); 410| | } 411| | if (first_coeff) 412| | printf("0"); 413| | 414| | printf("\n\nThe polynomial: z(x) = "); 415| | bool first_coeff_1 = true; 416| | if (z[0]) { 417| | printf("%u", z[0]); 418| | first_coeff_1 = false; 419| | } 420| | for (size_t i = 1; i < (PARAM_DELTA + 1); ++i) { 421| | if (z[i] == 0) 422| | continue; 423| | if (!first_coeff_1) 424| | printf(" + "); 425| | first_coeff_1 = false; 426| | if (z[i] != 1) 427| | printf("%u ", z[i]); 428| | if (i == 1) 429| | printf("x"); 430| | else 431| | printf("x^%zu", i); 432| | } 433| | if (first_coeff_1) 434| | printf("0"); 435| | 436| | printf("\n\nThe pairs of (error locator numbers, error values): "); 437| | size_t j = 0; 438| | for (size_t i = 0; i < PARAM_N1; ++i) { 439| | if (error[i]) { 440| | printf("(%zu, %d) ", i, error_values[j]); 441| | j++; 442| | } 443| | } 444| | printf("\n"); 445| |#endif 446| | 447| | // Zeroize sensitive data 448| 38| memset_zero(cdw_bytes, sizeof cdw_bytes); ------------------ | | 22| 38|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 38|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 38|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 38|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 38|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 449| 38|} reed_solomon.c:compute_syndromes: 120| 122|void compute_syndromes(uint16_t *syndromes, uint8_t *cdw) { 121| 5.04k| for (size_t i = 0; i < 2 * PARAM_DELTA; ++i) { ------------------ | | 40| 5.04k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (121:24): [True: 4.92k, False: 122] ------------------ 122| 346k| for (size_t j = 1; j < PARAM_N1; ++j) { ------------------ | | 16| 346k|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) ------------------ | Branch (122:28): [True: 342k, False: 4.92k] ------------------ 123| 342k| syndromes[i] ^= gf_mul(cdw[j], alpha_ij_pow[i][j - 1]); ------------------ | | 51| 342k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 342k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 342k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 342k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 124| 342k| } 125| 4.92k| syndromes[i] ^= cdw[0]; 126| 4.92k| } 127| 122|} reed_solomon.c:compute_elp: 143| 122|static uint16_t compute_elp(uint16_t *sigma, const uint16_t *syndromes) { 144| 122| uint16_t deg_sigma = 0; 145| 122| uint16_t deg_sigma_p = 0; 146| 122| uint16_t deg_sigma_copy = 0; 147| 122| uint16_t sigma_copy[PARAM_DELTA + 1] = {0}; 148| 122| uint16_t X_sigma_p[PARAM_DELTA + 1] = {0, 1}; 149| 122| uint16_t pp = (uint16_t)-1; // 2*rho 150| 122| uint16_t d_p = 1; 151| 122| uint16_t d = syndromes[0]; 152| | 153| 122| uint16_t mask1, mask2, mask12; 154| 122| uint16_t deg_X, deg_X_sigma_p; 155| 122| uint16_t dd; 156| 122| uint16_t mu; 157| | 158| 122| uint16_t i; 159| | 160| 122| sigma[0] = 1; 161| 4.92k| for (mu = 0; (mu < (2 * PARAM_DELTA)); ++mu) { ------------------ | | 40| 4.92k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (161:18): [True: 4.92k, False: 0] ------------------ 162| | // Save sigma in case we need it to update X_sigma_p 163| 4.92k| memcpy(sigma_copy, sigma, 2 * (PARAM_DELTA)); ------------------ | | 40| 4.92k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ 164| 4.92k| deg_sigma_copy = deg_sigma; 165| | 166| 4.92k| dd = gf_mul(d, gf_inverse(d_p)); ------------------ | | 51| 4.92k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 4.92k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 4.92k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 4.92k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ dd = gf_mul(d, gf_inverse(d_p)); ------------------ | | 53| 4.92k|#define gf_inverse PQCHQC_NAMESPACE(gf_inverse) | | ------------------ | | | | 17| 4.92k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 4.92k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 4.92k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 167| | 168| 88.0k| for (i = 1; (i <= mu + 1) && (i <= PARAM_DELTA); ++i) { ------------------ | | 40| 85.6k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (168:21): [True: 85.6k, False: 2.46k] | Branch (168:38): [True: 83.1k, False: 2.46k] ------------------ 169| 83.1k| sigma[i] ^= gf_mul(dd, X_sigma_p[i]); ------------------ | | 51| 83.1k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 83.1k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 83.1k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 83.1k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 170| 83.1k| } 171| | 172| 4.92k| deg_X = mu - pp; 173| 4.92k| deg_X_sigma_p = deg_X + deg_sigma_p; 174| | 175| | // mask1 = 0xffff if(d != 0) and 0 otherwise 176| 4.92k| mask1 = -((uint16_t)-d >> 15); 177| | 178| | // mask2 = 0xffff if(deg_X_sigma_p > deg_sigma) and 0 otherwise 179| 4.92k| mask2 = -((uint16_t)(deg_sigma - deg_X_sigma_p) >> 15); 180| | 181| | // mask12 = 0xffff if the deg_sigma increased and 0 otherwise 182| 4.92k| volatile uint16_t mask12__ = mask1 & mask2; 183| 4.92k| mask12 = mask12__; 184| 4.92k| deg_sigma ^= mask12 & (deg_X_sigma_p ^ deg_sigma); 185| | 186| 4.92k| if (mu == (2 * PARAM_DELTA - 1)) { ------------------ | | 40| 4.92k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (186:13): [True: 122, False: 4.79k] ------------------ 187| 122| break; 188| 122| } 189| | 190| 4.79k| pp ^= mask12 & (mu ^ pp); 191| 4.79k| d_p ^= mask12 & (d ^ d_p); 192| 111k| for (i = PARAM_DELTA; i; --i) { ------------------ | | 40| 4.79k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (192:31): [True: 106k, False: 4.79k] ------------------ 193| 106k| X_sigma_p[i] = (mask12 & sigma_copy[i - 1]) ^ (~mask12 & X_sigma_p[i - 1]); 194| 106k| } 195| | 196| 4.79k| deg_sigma_p ^= mask12 & (deg_sigma_copy ^ deg_sigma_p); 197| 4.79k| d = syndromes[mu + 1]; 198| | 199| 85.5k| for (i = 1; (i <= mu + 1) && (i <= PARAM_DELTA); ++i) { ------------------ | | 40| 83.0k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (199:21): [True: 83.0k, False: 2.46k] | Branch (199:38): [True: 80.7k, False: 2.33k] ------------------ 200| 80.7k| d ^= gf_mul(sigma[i], syndromes[mu + 1 - i]); ------------------ | | 51| 80.7k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 80.7k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 80.7k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 80.7k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 201| 80.7k| } 202| 4.79k| } 203| | 204| 122| return deg_sigma; 205| 122|} reed_solomon.c:compute_roots: 215| 122|static void compute_roots(uint8_t *error, uint16_t *sigma) { 216| 122| uint16_t w[1 << PARAM_M] = {0}; 217| | 218| 122| fft(w, sigma, PARAM_DELTA + 1); ------------------ | | 13| 122|#define fft PQCHQC_NAMESPACE(fft) | | ------------------ | | | | 17| 122|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 122|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 122|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ fft(w, sigma, PARAM_DELTA + 1); ------------------ | | 40| 122|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ 219| 122| fft_retrieve_error_poly(error, w); ------------------ | | 14| 122|#define fft_retrieve_error_poly PQCHQC_NAMESPACE(fft_retrieve_error_poly) | | ------------------ | | | | 17| 122|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 122|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 122|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 220| 122|} reed_solomon.c:compute_z_poly: 232| 122|static void compute_z_poly(uint16_t *z, const uint16_t *sigma, const uint16_t degree, const uint16_t *syndromes) { 233| 122| size_t i, j; 234| 122| uint16_t mask; 235| | 236| 122| z[0] = 1; 237| | 238| 2.58k| for (i = 1; i < PARAM_DELTA + 1; ++i) { ------------------ | | 40| 2.58k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (238:17): [True: 2.46k, False: 122] ------------------ 239| 2.46k| mask = -((uint16_t)(i - degree - 1) >> 15); 240| 2.46k| z[i] = mask & sigma[i]; 241| 2.46k| } 242| | 243| 122| z[1] ^= syndromes[0]; 244| | 245| 2.46k| for (i = 2; i <= PARAM_DELTA; ++i) { ------------------ | | 40| 2.46k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (245:17): [True: 2.33k, False: 122] ------------------ 246| 2.33k| mask = -((uint16_t)(i - degree - 1) >> 15); 247| 2.33k| z[i] ^= mask & syndromes[i - 1]; 248| | 249| 28.4k| for (j = 1; j < i; ++j) { ------------------ | Branch (249:21): [True: 26.0k, False: 2.33k] ------------------ 250| 26.0k| z[i] ^= mask & gf_mul(sigma[j], syndromes[i - j - 1]); ------------------ | | 51| 26.0k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 26.0k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 26.0k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 26.0k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 251| 26.0k| } 252| 2.33k| } 253| 122|} reed_solomon.c:compute_error_values: 264| 122|static void compute_error_values(uint16_t *error_values, const uint16_t *z, const uint8_t *error) { 265| 122| uint16_t beta_j[PARAM_DELTA] = {0}; 266| 122| uint16_t e_j[PARAM_DELTA] = {0}; 267| | 268| 122| uint16_t delta_counter; 269| 122| uint16_t delta_real_value; 270| 122| uint16_t found; 271| 122| uint16_t mask1; 272| 122| uint16_t mask2; 273| 122| uint16_t tmp1; 274| 122| uint16_t tmp2; 275| 122| uint16_t inverse; 276| 122| uint16_t inverse_power_j; 277| | 278| | // Compute the beta_{j_i} page 31 of the documentation 279| 122| delta_counter = 0; 280| 8.00k| for (size_t i = 0; i < PARAM_N1; i++) { ------------------ | | 16| 8.00k|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) ------------------ | Branch (280:24): [True: 7.88k, False: 122] ------------------ 281| 7.88k| found = 0; 282| 7.88k| mask1 = (uint16_t)(-((int32_t)error[i]) >> 31); // error[i] != 0 283| 181k| for (size_t j = 0; j < PARAM_DELTA; j++) { ------------------ | | 40| 181k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (283:28): [True: 173k, False: 7.88k] ------------------ 284| 173k| mask2 = ~((uint16_t)(-((int32_t)j ^ delta_counter) >> 31)); // j == delta_counter 285| 173k| beta_j[j] += mask1 & mask2 & gf_exp[i]; 286| 173k| found += mask1 & mask2 & 1; 287| 173k| } 288| 7.88k| delta_counter += found; 289| 7.88k| } 290| 122| delta_real_value = delta_counter; 291| | 292| | // Compute the e_{j_i} page 31 of the documentation 293| 2.58k| for (size_t i = 0; i < PARAM_DELTA; ++i) { ------------------ | | 40| 2.58k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (293:24): [True: 2.46k, False: 122] ------------------ 294| 2.46k| tmp1 = 1; 295| 2.46k| tmp2 = 1; 296| 2.46k| inverse = gf_inverse(beta_j[i]); ------------------ | | 53| 2.46k|#define gf_inverse PQCHQC_NAMESPACE(gf_inverse) | | ------------------ | | | | 17| 2.46k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 2.46k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 2.46k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 297| 2.46k| inverse_power_j = 1; 298| | 299| 57.0k| for (size_t j = 1; j <= PARAM_DELTA; ++j) { ------------------ | | 40| 57.0k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (299:28): [True: 54.6k, False: 2.46k] ------------------ 300| 54.6k| inverse_power_j = gf_mul(inverse_power_j, inverse); ------------------ | | 51| 54.6k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 54.6k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 54.6k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 54.6k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 301| 54.6k| tmp1 ^= gf_mul(inverse_power_j, z[j]); ------------------ | | 51| 54.6k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 54.6k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 54.6k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 54.6k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 302| 54.6k| } 303| 54.6k| for (size_t k = 1; k < PARAM_DELTA; ++k) { ------------------ | | 40| 54.6k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (303:28): [True: 52.1k, False: 2.46k] ------------------ 304| 52.1k| tmp2 = gf_mul(tmp2, (1 ^ gf_mul(inverse, beta_j[(i + k) % PARAM_DELTA]))); ------------------ | | 51| 52.1k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 52.1k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 52.1k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 52.1k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ tmp2 = gf_mul(tmp2, (1 ^ gf_mul(inverse, beta_j[(i + k) % PARAM_DELTA]))); ------------------ | | 51| 52.1k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 52.1k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 52.1k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 52.1k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ tmp2 = gf_mul(tmp2, (1 ^ gf_mul(inverse, beta_j[(i + k) % PARAM_DELTA]))); ------------------ | | 40| 52.1k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ 305| 52.1k| } 306| 2.46k| mask1 = (uint16_t)(((int16_t)i - delta_real_value) >> 15); // i < delta_real_value 307| 2.46k| e_j[i] = mask1 & gf_mul(tmp1, gf_inverse(tmp2)); ------------------ | | 51| 2.46k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 2.46k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 2.46k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 2.46k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ e_j[i] = mask1 & gf_mul(tmp1, gf_inverse(tmp2)); ------------------ | | 53| 2.46k|#define gf_inverse PQCHQC_NAMESPACE(gf_inverse) | | ------------------ | | | | 17| 2.46k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 2.46k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 2.46k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 308| 2.46k| } 309| | 310| | // Place the delta e_{j_i} values at the right coordinates of the output vector 311| 122| delta_counter = 0; 312| 8.00k| for (size_t i = 0; i < PARAM_N1; ++i) { ------------------ | | 16| 8.00k|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) ------------------ | Branch (312:24): [True: 7.88k, False: 122] ------------------ 313| 7.88k| found = 0; 314| 7.88k| mask1 = (uint16_t)(-((int32_t)error[i]) >> 31); // error[i] != 0 315| 181k| for (size_t j = 0; j < PARAM_DELTA; j++) { ------------------ | | 40| 181k|#define PARAM_DELTA 15 ///< Define the error-correcting capacity (delta) of the Reed–Solomon code ------------------ | Branch (315:28): [True: 173k, False: 7.88k] ------------------ 316| 173k| mask2 = ~((uint16_t)(-((int32_t)j ^ delta_counter) >> 31)); // j == delta_counter 317| 173k| error_values[i] += mask1 & mask2 & e_j[j]; 318| 173k| found += mask1 & mask2 & 1; 319| 173k| } 320| 7.88k| delta_counter += found; 321| 7.88k| } 322| 122|} reed_solomon.c:correct_errors: 330| 122|static void correct_errors(uint8_t *cdw, const uint16_t *error_values) { 331| 8.00k| for (size_t i = 0; i < PARAM_N1; ++i) { ------------------ | | 16| 8.00k|#define PARAM_N1 46 ///< Define the parameter n1 of the scheme (length of Reed–Solomon code) ------------------ | Branch (331:24): [True: 7.88k, False: 122] ------------------ 332| 7.88k| cdw[i] ^= error_values[i]; 333| 7.88k| } 334| 122|} PQCHQC_HQC1_C_prng_get_bytes: 20| 114|void prng_get_bytes(uint8_t *output, uint32_t outlen) { 21| 114| OQS_randombytes(output, outlen); 22| 114|} PQCHQC_HQC1_C_xof_init: 70| 304|void xof_init(shake256_xof_ctx *xof_ctx, const uint8_t *seed, uint32_t seed_size) { 71| 304| uint8_t xof_domain = HQC_XOF_DOMAIN; ------------------ | | 50| 304|#define HQC_XOF_DOMAIN 1 ------------------ 72| 304| OQS_SHA3_shake256_inc_init(xof_ctx); 73| 304| OQS_SHA3_shake256_inc_absorb(xof_ctx, seed, seed_size); 74| 304| OQS_SHA3_shake256_inc_absorb(xof_ctx, &xof_domain, 1); 75| 304| OQS_SHA3_shake256_inc_finalize(xof_ctx); 76| 304|} PQCHQC_HQC1_C_xof_get_bytes: 89| 7.99k|void xof_get_bytes(shake256_xof_ctx *xof_ctx, uint8_t *output, uint32_t output_size) { 90| 7.99k| OQS_SHA3_shake256_inc_squeeze(output, output_size, xof_ctx); 91| 7.99k|} PQCHQC_HQC1_C_xof_ctx_release: 96| 304|void xof_ctx_release(shake256_xof_ctx *xof_ctx) { 97| 304| OQS_SHA3_shake256_inc_ctx_release(xof_ctx); 98| 304|} PQCHQC_HQC1_C_hash_i: 109| 38|void hash_i(uint8_t *output, const uint8_t *seed) { 110| 38| sha3_512_ctx i_hash_ctx = {0}; 111| 38| uint8_t i_domain = HQC_I_FCT_DOMAIN; ------------------ | | 65| 38|#define HQC_I_FCT_DOMAIN 2 ------------------ 112| 38| OQS_SHA3_sha3_512_inc_init(&i_hash_ctx); 113| 38| OQS_SHA3_sha3_512_inc_absorb(&i_hash_ctx, seed, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 114| 38| OQS_SHA3_sha3_512_inc_absorb(&i_hash_ctx, &i_domain, 1); 115| 38| OQS_SHA3_sha3_512_inc_finalize(output, &i_hash_ctx); 116| 38| OQS_SHA3_sha3_512_inc_ctx_release(&i_hash_ctx); 117| 38|} PQCHQC_HQC1_C_hash_h: 125| 76|void hash_h(uint8_t *output, const uint8_t ek_kem[PUBLIC_KEY_BYTES]) { 126| 76| sha3_256_ctx h_hash_ctx = {0}; 127| 76| uint8_t h_domain = HQC_H_FCT_DOMAIN; ------------------ | | 60| 76|#define HQC_H_FCT_DOMAIN 1 ------------------ 128| 76| OQS_SHA3_sha3_256_inc_init(&h_hash_ctx); 129| 76| OQS_SHA3_sha3_256_inc_absorb(&h_hash_ctx, ek_kem, PUBLIC_KEY_BYTES); ------------------ | | 27| 76|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 76|#define CRYPTO_PUBLICKEYBYTES 2241 | | ------------------ ------------------ 130| 76| OQS_SHA3_sha3_256_inc_absorb(&h_hash_ctx, &h_domain, 1); 131| 76| OQS_SHA3_sha3_256_inc_finalize(output, &h_hash_ctx); 132| 76| OQS_SHA3_sha3_256_inc_ctx_release(&h_hash_ctx); 133| 76|} PQCHQC_HQC1_C_hash_g: 144| 76| const uint8_t salt[SALT_BYTES]) { 145| 76| sha3_512_ctx g_hash_ctx = {0}; 146| 76| uint8_t i_domain = HQC_G_FCT_DOMAIN; ------------------ | | 55| 76|#define HQC_G_FCT_DOMAIN 0 ------------------ 147| 76| OQS_SHA3_sha3_512_inc_init(&g_hash_ctx); 148| 76| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, hash_ek_kem, SEED_BYTES); ------------------ | | 52| 76|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 149| 76| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, m, PARAM_SECURITY_BYTES); ------------------ | | 23| 76|#define PARAM_SECURITY_BYTES 16 ///< Define the security level in bytes ------------------ 150| 76| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, salt, SALT_BYTES); ------------------ | | 53| 76|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 151| 76| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, &i_domain, 1); 152| 76| OQS_SHA3_sha3_512_inc_finalize(output, &g_hash_ctx); 153| 76| OQS_SHA3_sha3_512_inc_ctx_release(&g_hash_ctx); 154| 76|} PQCHQC_HQC1_C_hash_j: 165| 38| const ciphertext_kem_t *c_kem) { 166| 38| sha3_256_ctx k_hash_ctx = {0}; 167| 38| uint8_t k_domain = HQC_J_FCT_DOMAIN; ------------------ | | 70| 38|#define HQC_J_FCT_DOMAIN 3 ------------------ 168| 38| OQS_SHA3_sha3_256_inc_init(&k_hash_ctx); 169| 38| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, hash_ek_kem, SEED_BYTES); ------------------ | | 52| 38|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 170| 38| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, sigma, PARAM_SECURITY_BYTES); ------------------ | | 23| 38|#define PARAM_SECURITY_BYTES 16 ///< Define the security level in bytes ------------------ 171| 38| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, (uint8_t *)c_kem->c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 31| 38|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 38] | | | | ------------------ | | ------------------ ------------------ 172| 38| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, (uint8_t *)c_kem->c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 38|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 38|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 38, Folded] | | | | ------------------ | | ------------------ ------------------ 173| 38| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, c_kem->salt, SALT_BYTES); ------------------ | | 53| 38|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 174| 38| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, &k_domain, 1); 175| 38| OQS_SHA3_sha3_256_inc_finalize(output, &k_hash_ctx); 176| 38| OQS_SHA3_sha3_256_inc_ctx_release(&k_hash_ctx); 177| 38|} PQCHQC_HQC1_C_vect_generate_random_support1: 62| 114|void vect_generate_random_support1(shake256_xof_ctx *ctx, uint32_t *support, uint16_t weight) { 63| 114| uint8_t rand_bytes[3] = {0}; 64| 114| uint32_t candidate = 0; 65| | 66| 7.69k| for (size_t i = 0; i < weight;) { ------------------ | Branch (66:24): [True: 7.57k, False: 114] ------------------ 67| 7.57k| xof_get_bytes(ctx, rand_bytes, 3); ------------------ | | 75| 7.57k|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 7.57k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.57k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.57k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 68| 7.57k| candidate = rand_bytes[0] | (rand_bytes[1] << 8) | (rand_bytes[2] << 16); 69| | 70| 7.57k| if (candidate >= UTILS_REJECTION_THRESHOLD) { ------------------ | | 56| 7.57k|#define UTILS_REJECTION_THRESHOLD 16767881 ///< Rejection threshold for uniform sampling in [0, PARAM_N) ------------------ | Branch (70:13): [True: 12, False: 7.56k] ------------------ 71| 12| continue; 72| 12| } 73| 7.56k| candidate = barrett_reduce(candidate); 74| | 75| 7.56k| int is_position_available = 1; 76| 253k| for (size_t j = 0; j < i; j++) { ------------------ | Branch (76:28): [True: 245k, False: 7.52k] ------------------ 77| 245k| if (candidate == support[j]) { ------------------ | Branch (77:17): [True: 43, False: 245k] ------------------ 78| 43| is_position_available = 0; 79| 43| break; 80| 43| } 81| 245k| } 82| | 83| 7.56k| if (is_position_available == 1) { ------------------ | Branch (83:13): [True: 7.52k, False: 43] ------------------ 84| 7.52k| support[i] = candidate; 85| 7.52k| i++; 86| 7.52k| } 87| 7.56k| } 88| 114|} PQCHQC_HQC1_C_vect_generate_random_support2: 99| 228|void vect_generate_random_support2(shake256_xof_ctx *ctx, uint32_t *support, uint16_t weight) { 100| 228| uint32_t rand_u32[PARAM_OMEGA_R] = {0}; 101| | 102| 228| xof_get_bytes(ctx, (uint8_t *)&rand_u32, 4 * weight); ------------------ | | 75| 228|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 228|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 228|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 228|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 103| | 104| 17.3k| for (size_t i = 0; i < weight; ++i) { ------------------ | Branch (104:24): [True: 17.1k, False: 228] ------------------ 105| 17.1k| uint64_t buff = rand_u32[i]; 106| 17.1k| support[i] = i + ((buff * (PARAM_N - i)) >> 32); ------------------ | | 15| 17.1k|#define PARAM_N 17669 ///< Define the parameter n of the scheme ------------------ 107| 17.1k| } 108| | 109| 17.1k| for (int32_t i = (weight - 1); i-- > 0;) { ------------------ | Branch (109:36): [True: 16.8k, False: 228] ------------------ 110| 16.8k| uint32_t found = 0; 111| | 112| 649k| for (size_t j = i + 1; j < weight; ++j) { ------------------ | Branch (112:32): [True: 632k, False: 16.8k] ------------------ 113| 632k| found |= compare_u32(support[j], support[i]); 114| 632k| } 115| | 116| 16.8k| uint32_t mask = -found; 117| 16.8k| support[i] = (mask & i) ^ (~mask & support[i]); 118| 16.8k| } 119| 228|} PQCHQC_HQC1_C_vect_write_support_to_vector: 131| 342|void vect_write_support_to_vector(uint64_t *v, uint32_t *support, uint16_t weight) { 132| 342| uint32_t index_tab[PARAM_OMEGA_R] = {0}; 133| 342| uint64_t bit_tab[PARAM_OMEGA_R] = {0}; 134| | 135| 24.9k| for (size_t i = 0; i < weight; i++) { ------------------ | Branch (135:24): [True: 24.6k, False: 342] ------------------ 136| 24.6k| index_tab[i] = support[i] >> 6; 137| 24.6k| int32_t pos = support[i] & 0x3f; 138| 24.6k| bit_tab[i] = ((uint64_t)1) << pos; 139| 24.6k| } 140| | 141| 342| uint64_t val = 0; 142| 95.0k| for (uint32_t i = 0; i < VEC_N_SIZE_64; i++) { ------------------ | | 36| 95.0k|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 95.0k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 95.0k] | | | | ------------------ | | ------------------ ------------------ | Branch (142:26): [True: 94.7k, False: 342] ------------------ 143| 94.7k| val = 0; 144| 6.91M| for (uint32_t j = 0; j < weight; j++) { ------------------ | Branch (144:30): [True: 6.82M, False: 94.7k] ------------------ 145| 6.82M| uint32_t tmp = i - index_tab[j]; 146| 6.82M| int val1 = 1 ^ ((tmp | -tmp) >> 31); 147| 6.82M| uint64_t mask = -val1; 148| 6.82M| val |= (bit_tab[j] & mask); 149| 6.82M| } 150| 94.7k| v[i] |= val; 151| 94.7k| } 152| 342|} PQCHQC_HQC1_C_vect_sample_fixed_weight1: 169| 114|void vect_sample_fixed_weight1(shake256_xof_ctx *ctx, uint64_t *v, uint16_t weight) { 170| 114| uint32_t support[PARAM_OMEGA_R] = {0}; 171| 114| vect_generate_random_support1(ctx, support, weight); ------------------ | | 13| 114|#define vect_generate_random_support1 PQCHQC_NAMESPACE(vect_generate_random_support1) | | ------------------ | | | | 17| 114|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 114|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 114|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 172| 114| vect_write_support_to_vector(v, support, weight); ------------------ | | 15| 114|#define vect_write_support_to_vector PQCHQC_NAMESPACE(vect_write_support_to_vector) | | ------------------ | | | | 17| 114|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 114|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 114|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 173| 114|} PQCHQC_HQC1_C_vect_sample_fixed_weight2: 188| 228|void vect_sample_fixed_weight2(shake256_xof_ctx *ctx, uint64_t *v, uint16_t weight) { 189| 228| uint32_t support[PARAM_OMEGA_R] = {0}; 190| 228| vect_generate_random_support2(ctx, support, weight); ------------------ | | 14| 228|#define vect_generate_random_support2 PQCHQC_NAMESPACE(vect_generate_random_support2) | | ------------------ | | | | 17| 228|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 228|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 228|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 191| 228| vect_write_support_to_vector(v, support, weight); ------------------ | | 15| 228|#define vect_write_support_to_vector PQCHQC_NAMESPACE(vect_write_support_to_vector) | | ------------------ | | | | 17| 228|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 228|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 228|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 192| 228|} PQCHQC_HQC1_C_vect_set_random: 203| 114|void vect_set_random(shake256_xof_ctx *ctx, uint64_t *v) { 204| 114| xof_get_bytes(ctx, (uint8_t *)v, VEC_N_SIZE_BYTES); ------------------ | | 75| 114|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 114|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 114|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 114|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_get_bytes(ctx, (uint8_t *)v, VEC_N_SIZE_BYTES); ------------------ | | 31| 114|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 114|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 114] | | | | ------------------ | | ------------------ ------------------ 205| 114| v[VEC_N_SIZE_64 - 1] &= BITMASK(PARAM_N, 64); ------------------ | | 36| 114|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 114|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 114] | | | | ------------------ | | ------------------ ------------------ v[VEC_N_SIZE_64 - 1] &= BITMASK(PARAM_N, 64); ------------------ | | 13| 114|#define BITMASK(a, size) ((((uint64_t) 1UL) << (a % size)) - 1) /*!< Create a mask*/ ------------------ 206| 114|} PQCHQC_HQC1_C_vect_add: 216| 304|void vect_add(uint64_t *o, const uint64_t *v1, const uint64_t *v2, uint32_t size) { 217| 84.3k| for (uint32_t i = 0; i < size; ++i) { ------------------ | Branch (217:26): [True: 84.0k, False: 304] ------------------ 218| 84.0k| o[i] = v1[i] ^ v2[i]; 219| 84.0k| } 220| 304|} PQCHQC_HQC1_C_vect_compare: 233| 114|uint8_t vect_compare(const uint8_t *v1, const uint8_t *v2, uint32_t size) { 234| 114| uint16_t r = 0x0100; 235| | 236| 168k| for (size_t i = 0; i < size; i++) { ------------------ | Branch (236:24): [True: 168k, False: 114] ------------------ 237| 168k| r |= v1[i] ^ v2[i]; 238| 168k| } 239| | 240| 114| return (r - 1) >> 8; 241| 114|} PQCHQC_HQC1_C_vect_truncate: 249| 114|void vect_truncate(uint64_t *v) { 250| 114| size_t orig_words = (PARAM_N + 63) / 64; ------------------ | | 15| 114|#define PARAM_N 17669 ///< Define the parameter n of the scheme ------------------ 251| 114| size_t new_full_words = PARAM_N1N2 / 64; ------------------ | | 18| 114|#define PARAM_N1N2 17664 ///< Define the length in bits of the concatenated code ------------------ 252| 114| size_t remaining_bits = PARAM_N1N2 % 64; ------------------ | | 18| 114|#define PARAM_N1N2 17664 ///< Define the length in bits of the concatenated code ------------------ 253| | 254| | // Mask the last word if there's a partial word 255| 114| if (remaining_bits > 0) { ------------------ | Branch (255:9): [True: 0, False: 114] ------------------ 256| 0| uint64_t mask = (UINT64_C(1) << remaining_bits) - 1; 257| 0| v[new_full_words] &= mask; 258| 0| new_full_words++; // keep that partial word 259| 0| } 260| | 261| | // Zero out all subsequent words up to the original length 262| 228| for (size_t i = new_full_words; i < orig_words; i++) { ------------------ | Branch (262:37): [True: 114, False: 114] ------------------ 263| 114| v[i] = 0; 264| 114| } 265| 114|} vector.c:barrett_reduce: 35| 36.7k|static inline uint32_t barrett_reduce(uint32_t x) { 36| 36.7k| uint64_t q = ((uint64_t)x * PARAM_N_MU) >> 32; ------------------ | | 55| 36.7k|#define PARAM_N_MU 243079ULL ///< Define a precomputed multiplier for Barrett reduction mu = floor(2^32 / PARAM_N) ------------------ 37| 36.7k| uint32_t r = x - (uint32_t)(q * PARAM_N); ------------------ | | 15| 36.7k|#define PARAM_N 17669 ///< Define the parameter n of the scheme ------------------ 38| | 39| 36.7k| uint32_t reduce_flag = (((r - PARAM_N) >> 31) ^ 1); ------------------ | | 15| 36.7k|#define PARAM_N 17669 ///< Define the parameter n of the scheme ------------------ 40| 36.7k| uint32_t mask = -reduce_flag; 41| 36.7k| r -= mask & PARAM_N; ------------------ | | 15| 36.7k|#define PARAM_N 17669 ///< Define the parameter n of the scheme ------------------ 42| 36.7k| return r; 43| 36.7k|} vector.c:compare_u32: 23| 5.03M|static inline uint32_t compare_u32(const uint32_t v1, const uint32_t v2) { 24| 5.03M| return 1 ^ (((v1 - v2) | (v2 - v1)) >> 31); 25| 5.03M|} PQCHQC_HQC3_C_code_encode: 27| 84|void code_encode(uint64_t *em, const uint64_t *m) { 28| 84| uint64_t tmp[VEC_N1_SIZE_64] = {0}; 29| | 30| 84| reed_solomon_encode(tmp, m); ------------------ | | 119| 84|#define reed_solomon_encode PQCHQC_NAMESPACE(reed_solomon_encode) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 31| 84| reed_muller_encode(em, tmp); ------------------ | | 14| 84|#define reed_muller_encode PQCHQC_NAMESPACE(reed_muller_encode) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 32| | 33| |#ifdef VERBOSE 34| | printf("\n\nReed-Solomon code word: "); 35| | vect_print(tmp, VEC_N1_SIZE_BYTES); 36| | printf("\n\nConcatenated code word: "); 37| | vect_print(em, VEC_N1N2_SIZE_BYTES); 38| |#endif 39| | // Zeroize sensitive data 40| 84| memset_zero(tmp, sizeof tmp); ------------------ | | 22| 84|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 84|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 41| 84|} PQCHQC_HQC3_C_code_decode: 49| 42|void code_decode(uint64_t *m, const uint64_t *em) { 50| 42| uint64_t tmp[VEC_N1_SIZE_64] = {0}; 51| | 52| 42| reed_muller_decode(tmp, em); ------------------ | | 15| 42|#define reed_muller_decode PQCHQC_NAMESPACE(reed_muller_decode) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 53| 42| reed_solomon_decode(m, tmp); ------------------ | | 120| 42|#define reed_solomon_decode PQCHQC_NAMESPACE(reed_solomon_decode) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| | 55| |#ifdef VERBOSE 56| | printf("\n\nReed-Muller decoding result (the input for the Reed-Solomon decoding algorithm): "); 57| | vect_print(tmp, VEC_N1_SIZE_BYTES); 58| |#endif 59| | 60| | // Zeroize sensitive data 61| 42| memset_zero(tmp, sizeof tmp); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 62| 42|} PQCHQC_HQC3_C_fft: 274| 42|void fft(uint16_t *w, const uint16_t *f, size_t f_coeffs) { 275| 42| uint16_t betas[PARAM_M - 1] = {0}; 276| 42| uint16_t betas_sums[1 << (PARAM_M - 1)] = {0}; 277| 42| uint16_t f0[1 << (PARAM_FFT - 1)] = {0}; 278| 42| uint16_t f1[1 << (PARAM_FFT - 1)] = {0}; 279| 42| uint16_t deltas[PARAM_M - 1] = {0}; 280| 42| uint16_t u[1 << (PARAM_M - 1)] = {0}; 281| 42| uint16_t v[1 << (PARAM_M - 1)] = {0}; 282| | 283| 42| size_t i, k; 284| | 285| | // Follows Gao and Mateer algorithm 286| 42| compute_fft_betas(betas); 287| | 288| | // Step 1: PARAM_FFT > 1, nothing to do 289| | 290| | // Compute gammas sums 291| 42| compute_subset_sums(betas_sums, betas, PARAM_M - 1); ------------------ | | 41| 42|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 292| | 293| | // Step 2: beta_m = 1, nothing to do 294| | 295| | // Step 3 296| 42| radix(f0, f1, f, PARAM_FFT); ------------------ | | 46| 42|#define PARAM_FFT 5 ///< Exponent for additive FFT (2^PARAM_FFT points) ------------------ 297| | 298| | // Step 4: Compute deltas 299| 336| for (i = 0; i < PARAM_M - 1; ++i) { ------------------ | | 41| 336|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ | Branch (299:17): [True: 294, False: 42] ------------------ 300| 294| deltas[i] = gf_square(betas[i]) ^ betas[i]; ------------------ | | 52| 294|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 294|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 294|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 294|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 301| 294| } 302| | 303| | // Step 5 304| 42| fft_rec(u, f0, (f_coeffs + 1) / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 41| 42|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ fft_rec(u, f0, (f_coeffs + 1) / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 46| 42|#define PARAM_FFT 5 ///< Exponent for additive FFT (2^PARAM_FFT points) ------------------ 305| 42| fft_rec(v, f1, f_coeffs / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 41| 42|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ fft_rec(v, f1, f_coeffs / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 46| 42|#define PARAM_FFT 5 ///< Exponent for additive FFT (2^PARAM_FFT points) ------------------ 306| | 307| 42| k = 1 << (PARAM_M - 1); ------------------ | | 41| 42|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 308| | // Step 6, 7 and error polynomial computation 309| 42| memcpy(w + k, v, 2 * k); 310| | 311| | // Check if 0 is root 312| 42| w[0] = u[0]; 313| | 314| | // Check if 1 is root 315| 42| w[k] ^= u[0]; 316| | 317| | // Find other roots 318| 5.37k| for (i = 1; i < k; ++i) { ------------------ | Branch (318:17): [True: 5.33k, False: 42] ------------------ 319| 5.33k| w[i] = u[i] ^ gf_mul(betas_sums[i], v[i]); ------------------ | | 51| 5.33k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 5.33k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.33k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.33k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 320| 5.33k| w[k + i] ^= w[i]; 321| 5.33k| } 322| 42|} PQCHQC_HQC3_C_fft_retrieve_error_poly: 331| 42|void fft_retrieve_error_poly(uint8_t *error, const uint16_t *w) { 332| 42| uint16_t gammas[PARAM_M - 1] = {0}; 333| 42| uint16_t gammas_sums[1 << (PARAM_M - 1)] = {0}; 334| 42| uint16_t k; 335| 42| size_t i, index; 336| | 337| 42| compute_fft_betas(gammas); 338| 42| compute_subset_sums(gammas_sums, gammas, PARAM_M - 1); ------------------ | | 41| 42|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 339| | 340| 42| k = 1 << (PARAM_M - 1); ------------------ | | 41| 42|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 341| 42| error[0] ^= 1 ^ ((uint16_t)-w[0] >> 15); 342| 42| error[0] ^= 1 ^ ((uint16_t)-w[k] >> 15); 343| | 344| 5.37k| for (i = 1; i < k; ++i) { ------------------ | Branch (344:17): [True: 5.33k, False: 42] ------------------ 345| 5.33k| index = PARAM_GF_MUL_ORDER - gf_log[gammas_sums[i]]; ------------------ | | 43| 5.33k|#define PARAM_GF_MUL_ORDER 255 ///< Size of the multiplicative group of GF(2^PARAM_M) (i.e., 2^PARAM_M−1) ------------------ 346| 5.33k| error[index] ^= 1 ^ ((uint16_t)-w[i] >> 15); 347| | 348| 5.33k| index = PARAM_GF_MUL_ORDER - gf_log[gammas_sums[i] ^ 1]; ------------------ | | 43| 5.33k|#define PARAM_GF_MUL_ORDER 255 ///< Size of the multiplicative group of GF(2^PARAM_M) (i.e., 2^PARAM_M−1) ------------------ 349| 5.33k| error[index] ^= 1 ^ ((uint16_t)-w[k + i] >> 15); 350| 5.33k| } 351| 42|} PQCHQC_HQC3_C_gf_mul: 153| 280k|uint16_t gf_mul(uint16_t a, uint16_t b) { 154| 280k| uint8_t c[2] = {0}; 155| 280k| gf_carryless_mul(c, (uint8_t)a, (uint8_t)b); 156| 280k| uint16_t tmp = (uint16_t)(c[0] ^ (c[1] << 8)); 157| 280k| return gf_reduce(tmp); 158| 280k|} PQCHQC_HQC3_C_gf_square: 165| 35.2k|uint16_t gf_square(uint16_t a) { 166| 35.2k| uint32_t b = a; 167| 35.2k| uint32_t s = b & 1; 168| 281k| for (size_t i = 1; i < PARAM_M; ++i) { ------------------ | | 41| 281k|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ | Branch (168:24): [True: 246k, False: 35.2k] ------------------ 169| 246k| b <<= 1; 170| 246k| s ^= b & (1 << 2 * i); 171| 246k| } 172| | 173| 35.2k| return gf_reduce(s); 174| 35.2k|} PQCHQC_HQC3_C_gf_inverse: 182| 5.37k|uint16_t gf_inverse(uint16_t a) { 183| 5.37k| uint16_t inv = a; 184| 5.37k| uint16_t tmp1, tmp2; 185| | 186| 5.37k| inv = gf_square(a); /* a^2 */ ------------------ | | 52| 5.37k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 5.37k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.37k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.37k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 187| 5.37k| tmp1 = gf_mul(inv, a); /* a^3 */ ------------------ | | 51| 5.37k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 5.37k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.37k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.37k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 188| 5.37k| inv = gf_square(inv); /* a^4 */ ------------------ | | 52| 5.37k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 5.37k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.37k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.37k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 189| 5.37k| tmp2 = gf_mul(inv, tmp1); /* a^7 */ ------------------ | | 51| 5.37k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 5.37k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.37k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.37k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 190| 5.37k| tmp1 = gf_mul(inv, tmp2); /* a^11 */ ------------------ | | 51| 5.37k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 5.37k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.37k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.37k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 191| 5.37k| inv = gf_mul(tmp1, inv); /* a^15 */ ------------------ | | 51| 5.37k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 5.37k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.37k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.37k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 192| 5.37k| inv = gf_square(inv); /* a^30 */ ------------------ | | 52| 5.37k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 5.37k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.37k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.37k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 193| 5.37k| inv = gf_square(inv); /* a^60 */ ------------------ | | 52| 5.37k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 5.37k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.37k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.37k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 194| 5.37k| inv = gf_square(inv); /* a^120 */ ------------------ | | 52| 5.37k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 5.37k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.37k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.37k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 195| 5.37k| inv = gf_mul(inv, tmp2); /* a^127 */ ------------------ | | 51| 5.37k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 5.37k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.37k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.37k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 196| 5.37k| inv = gf_square(inv); /* a^254 */ ------------------ | | 52| 5.37k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 5.37k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.37k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.37k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 197| 5.37k| return inv; 198| 5.37k|} PQCHQC_HQC3_C_vect_mul: 151| 252|void vect_mul(uint64_t *o, const uint64_t *a1, const uint64_t *a2) { 152| 252| uint64_t unreduced[2 * VEC_N_SIZE_64]; 153| 252| uint64_t tmp_buffer[TMP_BUFFER_WORDS]; 154| | 155| | /* multiply via Karatsuba into unreduced */ 156| 252| karatsuba_mul(unreduced, a1, a2, VEC_N_SIZE_64, tmp_buffer); ------------------ | | 36| 252|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 252|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 252] | | | | ------------------ | | ------------------ ------------------ 157| | 158| | /* reduce modulo X^n - 1 */ 159| 252| reduce(o, unreduced); 160| 252|} PQCHQC_HQC3_C_hqc_pke_keygen: 30| 42|void hqc_pke_keygen(uint8_t *ek_pke, uint8_t *dk_pke, uint8_t *seed) { 31| 42| uint8_t keypair_seed[2 * SEED_BYTES] = {0}; 32| 42| uint8_t *seed_dk = keypair_seed; 33| 42| uint8_t *seed_ek = keypair_seed + SEED_BYTES; ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 34| 42| shake256_xof_ctx dk_xof_ctx = {0}; 35| 42| shake256_xof_ctx ek_xof_ctx = {0}; 36| | 37| 42| uint64_t x[VEC_N_SIZE_64] = {0}; 38| 42| uint64_t y[VEC_N_SIZE_64] = {0}; 39| 42| uint64_t h[VEC_N_SIZE_64] = {0}; 40| 42| uint64_t s[VEC_N_SIZE_64] = {0}; 41| | 42| | // Derive keypair seeds 43| 42| hash_i(keypair_seed, seed); ------------------ | | 79| 42|#define hash_i PQCHQC_NAMESPACE(hash_i) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 44| | 45| | // Compute decryption key 46| 42| xof_init(&dk_xof_ctx, seed_dk, SEED_BYTES); ------------------ | | 74| 42|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&dk_xof_ctx, seed_dk, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 47| 42| vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 16| 42|#define vect_sample_fixed_weight1 PQCHQC_NAMESPACE(vect_sample_fixed_weight1) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 19| 42|#define PARAM_OMEGA 100 ///< Define the parameter omega of the scheme ------------------ 48| 42| vect_sample_fixed_weight1(&dk_xof_ctx, x, PARAM_OMEGA); ------------------ | | 16| 42|#define vect_sample_fixed_weight1 PQCHQC_NAMESPACE(vect_sample_fixed_weight1) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight1(&dk_xof_ctx, x, PARAM_OMEGA); ------------------ | | 19| 42|#define PARAM_OMEGA 100 ///< Define the parameter omega of the scheme ------------------ 49| 42| xof_ctx_release(&dk_xof_ctx); ------------------ | | 76| 42|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 50| | 51| | // Compute encryption key 52| 42| xof_init(&ek_xof_ctx, seed_ek, SEED_BYTES); ------------------ | | 74| 42|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&ek_xof_ctx, seed_ek, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 53| 42| vect_set_random(&ek_xof_ctx, h); ------------------ | | 18| 42|#define vect_set_random PQCHQC_NAMESPACE(vect_set_random) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 42| xof_ctx_release(&ek_xof_ctx); ------------------ | | 76| 42|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 55| 42| vect_mul(s, y, h); ------------------ | | 12| 42|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 56| 42| vect_add(s, x, s, VEC_N_SIZE_64); ------------------ | | 19| 42|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(s, x, s, VEC_N_SIZE_64); ------------------ | | 36| 42|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 42] | | | | ------------------ | | ------------------ ------------------ 57| | 58| | // Parse encryption key to string 59| 42| memcpy(ek_pke, seed_ek, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 60| 42| memcpy(ek_pke + SEED_BYTES, s, VEC_N_SIZE_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(ek_pke + SEED_BYTES, s, VEC_N_SIZE_BYTES); ------------------ | | 31| 42|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 42] | | | | ------------------ | | ------------------ ------------------ 61| | 62| | // Parse decryption key to string 63| 42| memcpy(dk_pke, seed_dk, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 64| | 65| |#ifdef VERBOSE 66| | printf("\n\nseed_dk: "); 67| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_dk[i]); 68| | printf("\n\nseed_ek: "); 69| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_ek[i]); 70| | printf("\n\ny: "); 71| | vect_print(y, VEC_N_SIZE_BYTES); 72| | printf("\n\nx: "); 73| | vect_print(x, VEC_N_SIZE_BYTES); 74| | printf("\n\nh: "); 75| | vect_print(h, VEC_N_SIZE_BYTES); 76| | printf("\n\ns: "); 77| | vect_print(s, VEC_N_SIZE_BYTES); 78| |#endif 79| | 80| | // Zeroize sensitive data 81| 42| memset_zero(keypair_seed, sizeof keypair_seed); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 82| 42| memset_zero(x, sizeof x); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 83| 42| memset_zero(y, sizeof y); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 84| 42| memset_zero(&dk_xof_ctx, sizeof dk_xof_ctx); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 85| 42|} PQCHQC_HQC3_C_hqc_pke_encrypt: 99| 84|void hqc_pke_encrypt(ciphertext_pke_t *c_pke, const uint8_t *ek_pke, const uint64_t *m, const uint8_t *theta) { 100| 84| shake256_xof_ctx theta_xof_ctx = {0}; 101| 84| uint64_t h[VEC_N_SIZE_64] = {0}; 102| 84| uint64_t s[VEC_N_SIZE_64] = {0}; 103| 84| uint64_t r1[VEC_N_SIZE_64] = {0}; 104| 84| uint64_t r2[VEC_N_SIZE_64] = {0}; 105| 84| uint64_t e[VEC_N_SIZE_64] = {0}; 106| 84| uint64_t tmp[VEC_N_SIZE_64] = {0}; 107| | 108| | // Initialize Xof using theta 109| 84| xof_init(&theta_xof_ctx, theta, SEED_BYTES); ------------------ | | 74| 84|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&theta_xof_ctx, theta, SEED_BYTES); ------------------ | | 52| 84|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 110| | 111| | // Retrieve h and s from public key 112| 84| hqc_ek_pke_from_string(h, s, ek_pke); ------------------ | | 15| 84|#define hqc_ek_pke_from_string PQCHQC_NAMESPACE(hqc_ek_pke_from_string) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 113| | 114| | // Generate re, e and r1 115| 84| vect_sample_fixed_weight2(&theta_xof_ctx, r2, PARAM_OMEGA_R); ------------------ | | 17| 84|#define vect_sample_fixed_weight2 PQCHQC_NAMESPACE(vect_sample_fixed_weight2) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight2(&theta_xof_ctx, r2, PARAM_OMEGA_R); ------------------ | | 21| 84|#define PARAM_OMEGA_R 114 ///< Define the parameter omega_r of the scheme ------------------ 116| 84| vect_sample_fixed_weight2(&theta_xof_ctx, e, PARAM_OMEGA_E); ------------------ | | 17| 84|#define vect_sample_fixed_weight2 PQCHQC_NAMESPACE(vect_sample_fixed_weight2) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight2(&theta_xof_ctx, e, PARAM_OMEGA_E); ------------------ | | 20| 84|#define PARAM_OMEGA_E 114 ///< Define the parameter omega_e of the scheme ------------------ 117| 84| vect_sample_fixed_weight2(&theta_xof_ctx, r1, PARAM_OMEGA_R); ------------------ | | 17| 84|#define vect_sample_fixed_weight2 PQCHQC_NAMESPACE(vect_sample_fixed_weight2) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight2(&theta_xof_ctx, r1, PARAM_OMEGA_R); ------------------ | | 21| 84|#define PARAM_OMEGA_R 114 ///< Define the parameter omega_r of the scheme ------------------ 118| 84| xof_ctx_release(&theta_xof_ctx); ------------------ | | 76| 84|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 119| | 120| | // Compute u = r1 + r2.h 121| 84| vect_mul(c_pke->u, r2, h); ------------------ | | 12| 84|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 122| 84| vect_add(c_pke->u, r1, c_pke->u, VEC_N_SIZE_64); ------------------ | | 19| 84|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(c_pke->u, r1, c_pke->u, VEC_N_SIZE_64); ------------------ | | 36| 84|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 84|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 84] | | | | ------------------ | | ------------------ ------------------ 123| | 124| | // Compute v = C.encode(m) 125| 84| code_encode(c_pke->v, m); ------------------ | | 14| 84|#define code_encode PQCHQC_NAMESPACE(code_encode) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 126| | 127| | // Compute v = C.encode(m) + Truncate(s.r2 + e) 128| 84| vect_mul(tmp, r2, s); ------------------ | | 12| 84|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 129| 84| vect_add(tmp, e, tmp, VEC_N_SIZE_64); ------------------ | | 19| 84|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(tmp, e, tmp, VEC_N_SIZE_64); ------------------ | | 36| 84|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 84|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 84] | | | | ------------------ | | ------------------ ------------------ 130| 84| vect_truncate(tmp); ------------------ | | 21| 84|#define vect_truncate PQCHQC_NAMESPACE(vect_truncate) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 131| 84| vect_add(c_pke->v, c_pke->v, tmp, VEC_N1N2_SIZE_64); ------------------ | | 19| 84|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(c_pke->v, c_pke->v, tmp, VEC_N1N2_SIZE_64); ------------------ | | 38| 84|#define VEC_N1N2_SIZE_64 CEIL_DIVIDE(PARAM_N1N2, 64) ///< Size of array to store PARAM_N1N2 bits in 64-bit words | | ------------------ | | | | 12| 84|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 84, Folded] | | | | ------------------ | | ------------------ ------------------ 132| | 133| |#ifdef VERBOSE 134| | printf("\n\nh: "); 135| | vect_print(h, VEC_N_SIZE_BYTES); 136| | printf("\n\ns: "); 137| | vect_print(s, VEC_N_SIZE_BYTES); 138| | printf("\n\nr1: "); 139| | vect_print(r1, VEC_N_SIZE_BYTES); 140| | printf("\n\nr2: "); 141| | vect_print(r2, VEC_N_SIZE_BYTES); 142| | printf("\n\ne: "); 143| | vect_print(e, VEC_N_SIZE_BYTES); 144| | printf("\n\nTruncate(s.r2 + e): "); 145| | vect_print(tmp, VEC_N1N2_SIZE_BYTES); 146| | printf("\n\nc_pke->u: "); 147| | vect_print(c_pke->u, VEC_N_SIZE_BYTES); 148| | printf("\n\nc_pke->v: "); 149| | vect_print(c_pke->v, VEC_N1N2_SIZE_BYTES); 150| |#endif 151| | 152| | // Zeroize sensitive data 153| 84| memset_zero(r1, sizeof r1); ------------------ | | 22| 84|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 84|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 154| 84| memset_zero(r2, sizeof r2); ------------------ | | 22| 84|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 84|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 155| 84| memset_zero(e, sizeof e); ------------------ | | 22| 84|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 84|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 156| 84| memset_zero(tmp, sizeof tmp); ------------------ | | 22| 84|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 84|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 157| 84| memset_zero(&theta_xof_ctx, sizeof theta_xof_ctx); ------------------ | | 22| 84|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 84|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 84|} PQCHQC_HQC3_C_hqc_pke_decrypt: 173| 42|uint8_t hqc_pke_decrypt(uint64_t *m, const uint8_t *dk_pke, const ciphertext_pke_t *c_pke) { 174| 42| uint64_t y[VEC_N_SIZE_64] = {0}; 175| 42| uint64_t tmp1[VEC_N_SIZE_64] = {0}; 176| 42| uint64_t tmp2[VEC_N_SIZE_64] = {0}; 177| | 178| | // Parse decryption key dk_pke 179| 42| hqc_dk_pke_from_string(y, dk_pke); ------------------ | | 14| 42|#define hqc_dk_pke_from_string PQCHQC_NAMESPACE(hqc_dk_pke_from_string) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 180| | 181| | // Compute u.y 182| 42| vect_mul(tmp1, y, c_pke->u); ------------------ | | 12| 42|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 183| | // Truncate(u.y) 184| 42| vect_truncate(tmp1); ------------------ | | 21| 42|#define vect_truncate PQCHQC_NAMESPACE(vect_truncate) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 185| | // Compute v - Truncate(u.y) 186| 42| vect_add(tmp2, c_pke->v, tmp1, VEC_N1N2_SIZE_64); ------------------ | | 19| 42|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(tmp2, c_pke->v, tmp1, VEC_N1N2_SIZE_64); ------------------ | | 38| 42|#define VEC_N1N2_SIZE_64 CEIL_DIVIDE(PARAM_N1N2, 64) ///< Size of array to store PARAM_N1N2 bits in 64-bit words | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 42, Folded] | | | | ------------------ | | ------------------ ------------------ 187| | 188| |#ifdef VERBOSE 189| | printf("\n\nc_pke.u: "); 190| | vect_print(c_pke->u, VEC_N_SIZE_BYTES); 191| | printf("\n\nc_pke.v: "); 192| | vect_print(c_pke->v, VEC_N1N2_SIZE_BYTES); 193| | printf("\n\ny: "); 194| | vect_print(y, VEC_N_SIZE_BYTES); 195| | printf("\n\nTruncate(u.y): "); 196| | vect_print(tmp1, VEC_N1N2_SIZE_BYTES); 197| | printf("\n\nv - Truncate(u.y): "); 198| | vect_print(tmp2, VEC_N1N2_SIZE_BYTES); 199| |#endif 200| | 201| | // Compute plaintext m 202| 42| code_decode(m, tmp2); ------------------ | | 15| 42|#define code_decode PQCHQC_NAMESPACE(code_decode) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 203| | 204| | // Zeroize sensitive data 205| 42| memset_zero(y, sizeof y); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 206| 42| memset_zero(tmp1, sizeof tmp1); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 207| 42| memset_zero(tmp2, sizeof tmp2); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 208| | 209| 42| return 0; 210| 42|} PQCHQC_HQC3_C_crypto_kem_keypair: 39| 42|int crypto_kem_keypair(uint8_t *ek_kem, uint8_t *dk_kem) { 40| |#ifdef VERBOSE 41| | printf("\n\n\n### KEYGEN ###"); 42| |#endif 43| 42| uint8_t seed_kem[SEED_BYTES] = {0}; 44| 42| uint8_t sigma[PARAM_SECURITY_BYTES] = {0}; 45| 42| uint8_t seed_pke[SEED_BYTES] = {0}; 46| 42| shake256_xof_ctx ctx_kem; 47| | 48| 42| uint8_t ek_pke[PUBLIC_KEY_BYTES] = {0}; 49| 42| uint8_t dk_pke[SEED_BYTES] = {0}; 50| | 51| 42| prng_get_bytes(seed_kem, SEED_BYTES); ------------------ | | 73| 42|#define prng_get_bytes PQCHQC_NAMESPACE(prng_get_bytes) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ prng_get_bytes(seed_kem, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 52| | 53| | // Compute seed_pke and randomness sigma 54| 42| xof_init(&ctx_kem, seed_kem, SEED_BYTES); ------------------ | | 74| 42|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&ctx_kem, seed_kem, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 55| 42| xof_get_bytes(&ctx_kem, seed_pke, SEED_BYTES); ------------------ | | 75| 42|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_get_bytes(&ctx_kem, seed_pke, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 56| 42| xof_get_bytes(&ctx_kem, sigma, PARAM_SECURITY_BYTES); ------------------ | | 75| 42|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_get_bytes(&ctx_kem, sigma, PARAM_SECURITY_BYTES); ------------------ | | 23| 42|#define PARAM_SECURITY_BYTES 24 ///< Define the security level in bytes ------------------ 57| 42| xof_ctx_release(&ctx_kem); ------------------ | | 76| 42|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 58| | 59| | // Compute HQC-PKE keypair 60| 42| hqc_pke_keygen(ek_pke, dk_pke, seed_pke); ------------------ | | 14| 42|#define hqc_pke_keygen PQCHQC_NAMESPACE(hqc_pke_keygen) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 61| | 62| | // Compute HQC-KEM keypair 63| 42| memcpy(ek_kem, ek_pke, PUBLIC_KEY_BYTES); ------------------ | | 27| 42|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 42|#define CRYPTO_PUBLICKEYBYTES 4514 | | ------------------ ------------------ 64| 42| memcpy(dk_kem, ek_kem, PUBLIC_KEY_BYTES); ------------------ | | 27| 42|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 42|#define CRYPTO_PUBLICKEYBYTES 4514 | | ------------------ ------------------ 65| 42| memcpy(dk_kem + PUBLIC_KEY_BYTES, dk_pke, SEED_BYTES); ------------------ | | 27| 42|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 42|#define CRYPTO_PUBLICKEYBYTES 4514 | | ------------------ ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES, dk_pke, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 66| 42| memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, sigma, PARAM_SECURITY_BYTES); ------------------ | | 27| 42|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 42|#define CRYPTO_PUBLICKEYBYTES 4514 | | ------------------ ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, sigma, PARAM_SECURITY_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, sigma, PARAM_SECURITY_BYTES); ------------------ | | 23| 42|#define PARAM_SECURITY_BYTES 24 ///< Define the security level in bytes ------------------ 67| 42| memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 27| 42|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 42|#define CRYPTO_PUBLICKEYBYTES 4514 | | ------------------ ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 23| 42|#define PARAM_SECURITY_BYTES 24 ///< Define the security level in bytes ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 68| | 69| |#ifdef VERBOSE 70| | printf("\n\nseed_kem: "); 71| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_kem[i]); 72| | printf("\n\nseed_pke: "); 73| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_pke[i]); 74| | printf("\n\nsigma: "); 75| | for (int i = 0; i < PARAM_SECURITY_BYTES; ++i) printf("%02x", sigma[i]); 76| |#endif 77| | 78| | // Zeroize sensitive data 79| 42| memset_zero(seed_kem, sizeof seed_kem); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 80| 42| memset_zero(sigma, sizeof sigma); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 81| 42| memset_zero(seed_pke, sizeof seed_pke); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 82| 42| memset_zero(dk_pke, sizeof dk_pke); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 83| | 84| 42| return 0; 85| 42|} PQCHQC_HQC3_C_crypto_kem_enc: 105| 42|int crypto_kem_enc(uint8_t *c_kem, uint8_t *K, const uint8_t *ek_kem) { 106| |#ifdef VERBOSE 107| | printf("\n\n\n\n### ENCAPS ###"); 108| |#endif 109| | 110| 42| uint8_t m[PARAM_SECURITY_BYTES] = {0}; 111| 42| uint8_t K_theta[SHARED_SECRET_BYTES + SEED_BYTES] = {0}; 112| 42| uint8_t theta[SEED_BYTES] = {0}; 113| 42| uint8_t hash_ek_kem[SEED_BYTES] = {0}; 114| 42| ciphertext_kem_t c_kem_t = {0}; 115| | 116| | // Sample message m and salt 117| 42| prng_get_bytes(m, PARAM_SECURITY_BYTES); ------------------ | | 73| 42|#define prng_get_bytes PQCHQC_NAMESPACE(prng_get_bytes) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ prng_get_bytes(m, PARAM_SECURITY_BYTES); ------------------ | | 23| 42|#define PARAM_SECURITY_BYTES 24 ///< Define the security level in bytes ------------------ 118| 42| prng_get_bytes(c_kem_t.salt, SALT_BYTES); ------------------ | | 73| 42|#define prng_get_bytes PQCHQC_NAMESPACE(prng_get_bytes) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ prng_get_bytes(c_kem_t.salt, SALT_BYTES); ------------------ | | 53| 42|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 119| | 120| | // Compute shared key K and ciphertext c_kem 121| 42| hash_h(hash_ek_kem, ek_kem); ------------------ | | 78| 42|#define hash_h PQCHQC_NAMESPACE(hash_h) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 122| 42| hash_g(K_theta, hash_ek_kem, m, c_kem_t.salt); ------------------ | | 77| 42|#define hash_g PQCHQC_NAMESPACE(hash_g) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 123| 42| memcpy(theta, K_theta + SEED_BYTES, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(theta, K_theta + SEED_BYTES, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 124| 42| hqc_pke_encrypt(&c_kem_t.c_pke, ek_kem, (uint64_t *)m, theta); ------------------ | | 15| 42|#define hqc_pke_encrypt PQCHQC_NAMESPACE(hqc_pke_encrypt) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 125| | 126| 42| hqc_c_kem_to_string(c_kem, &c_kem_t); ------------------ | | 16| 42|#define hqc_c_kem_to_string PQCHQC_NAMESPACE(hqc_c_kem_to_string) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 127| 42| memcpy(K, K_theta, SHARED_SECRET_BYTES); ------------------ | | 28| 42|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 42|#define CRYPTO_BYTES 32 | | ------------------ ------------------ 128| | 129| |#ifdef VERBOSE 130| | printf("\n\nek_kem: "); 131| | for (int i = 0; i < PUBLIC_KEY_BYTES; ++i) printf("%02x", ek_kem[i]); 132| | printf("\n\nm: "); 133| | vect_print((uint64_t *)m, PARAM_SECURITY_BYTES); 134| | printf("\n\nsalt: "); 135| | for (int i = 0; i < SALT_BYTES; ++i) printf("%02x", c_kem_t.salt[i]); 136| | printf("\n\nH(ek_kem): "); 137| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", hash_ek_kem[i]); 138| | printf("\n\ntheta: "); 139| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", theta[i]); 140| | printf("\n\nc_kem: "); 141| | for (int i = 0; i < CIPHERTEXT_BYTES; ++i) printf("%02x", c_kem[i]); 142| | printf("\n\nK: "); 143| | for (int i = 0; i < SHARED_SECRET_BYTES; ++i) printf("%02x", K[i]); 144| |#endif 145| | 146| | // Zeroize sensitive data 147| 42| memset_zero(m, sizeof m); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 148| 42| memset_zero(K_theta, sizeof K_theta); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 42| memset_zero(theta, sizeof theta); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 150| | 151| 42| return 0; 152| 42|} PQCHQC_HQC3_C_crypto_kem_dec: 166| 42|int crypto_kem_dec(uint8_t *K_prime, const uint8_t *c_kem, const uint8_t *dk_kem) { 167| |#ifdef VERBOSE 168| | printf("\n\n\n\n### DECAPS ###"); 169| |#endif 170| | 171| 42| uint8_t ek_pke[PUBLIC_KEY_BYTES] = {0}; 172| 42| uint8_t dk_pke[SEED_BYTES] = {0}; 173| 42| uint8_t sigma[PARAM_SECURITY_BYTES] = {0}; 174| 42| uint8_t m_prime[PARAM_SECURITY_BYTES] = {0}; 175| 42| uint8_t hash_ek_kem[SEED_BYTES] = {0}; 176| 42| uint8_t K_theta_prime[SHARED_SECRET_BYTES + SEED_BYTES] = {0}; 177| 42| uint8_t K_bar[SHARED_SECRET_BYTES] = {0}; 178| 42| uint8_t theta_prime[SEED_BYTES] = {0}; 179| 42| ciphertext_kem_t c_kem_t = {0}; 180| 42| ciphertext_kem_t c_kem_prime_t = {0}; 181| 42| uint8_t result; 182| | 183| | // Parse decapsulation key dk_kem 184| 42| memcpy(ek_pke, dk_kem, PUBLIC_KEY_BYTES); ------------------ | | 27| 42|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 42|#define CRYPTO_PUBLICKEYBYTES 4514 | | ------------------ ------------------ 185| 42| memcpy(dk_pke, dk_kem + PUBLIC_KEY_BYTES, SEED_BYTES); ------------------ | | 27| 42|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 42|#define CRYPTO_PUBLICKEYBYTES 4514 | | ------------------ ------------------ memcpy(dk_pke, dk_kem + PUBLIC_KEY_BYTES, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 186| 42| memcpy(sigma, dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, PARAM_SECURITY_BYTES); ------------------ | | 27| 42|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 42|#define CRYPTO_PUBLICKEYBYTES 4514 | | ------------------ ------------------ memcpy(sigma, dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, PARAM_SECURITY_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(sigma, dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, PARAM_SECURITY_BYTES); ------------------ | | 23| 42|#define PARAM_SECURITY_BYTES 24 ///< Define the security level in bytes ------------------ 187| | 188| | // Parse ciphertext c_kem 189| 42| hqc_c_kem_from_string(&c_kem_t.c_pke, c_kem_t.salt, c_kem); ------------------ | | 17| 42|#define hqc_c_kem_from_string PQCHQC_NAMESPACE(hqc_c_kem_from_string) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 190| | 191| | // Compute message m_prime 192| 42| result = hqc_pke_decrypt((uint64_t *)m_prime, dk_pke, &c_kem_t.c_pke); ------------------ | | 16| 42|#define hqc_pke_decrypt PQCHQC_NAMESPACE(hqc_pke_decrypt) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 193| | 194| | // Compute shared key K_prime and ciphertext c_kem_prime 195| 42| hash_h(hash_ek_kem, ek_pke); ------------------ | | 78| 42|#define hash_h PQCHQC_NAMESPACE(hash_h) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 196| 42| hash_g(K_theta_prime, hash_ek_kem, m_prime, c_kem_t.salt); ------------------ | | 77| 42|#define hash_g PQCHQC_NAMESPACE(hash_g) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 197| 42| memcpy(K_prime, K_theta_prime, SHARED_SECRET_BYTES); ------------------ | | 28| 42|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 42|#define CRYPTO_BYTES 32 | | ------------------ ------------------ 198| 42| memcpy(theta_prime, K_theta_prime + SHARED_SECRET_BYTES, SEED_BYTES); ------------------ | | 28| 42|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 42|#define CRYPTO_BYTES 32 | | ------------------ ------------------ memcpy(theta_prime, K_theta_prime + SHARED_SECRET_BYTES, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 199| | 200| 42| hqc_pke_encrypt(&c_kem_prime_t.c_pke, ek_pke, (uint64_t *)m_prime, theta_prime); ------------------ | | 15| 42|#define hqc_pke_encrypt PQCHQC_NAMESPACE(hqc_pke_encrypt) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 201| 42| memcpy(c_kem_prime_t.salt, c_kem_t.salt, SALT_BYTES); ------------------ | | 53| 42|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 202| | 203| | // Compute rejection key K_bar 204| 42| hash_j(K_bar, hash_ek_kem, sigma, &c_kem_t); ------------------ | | 80| 42|#define hash_j PQCHQC_NAMESPACE(hash_j) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 205| 42| result |= vect_compare((uint8_t *)c_kem_t.c_pke.u, (uint8_t *)c_kem_prime_t.c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 20| 42|#define vect_compare PQCHQC_NAMESPACE(vect_compare) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ result |= vect_compare((uint8_t *)c_kem_t.c_pke.u, (uint8_t *)c_kem_prime_t.c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 31| 42|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 42] | | | | ------------------ | | ------------------ ------------------ 206| 42| result |= vect_compare((uint8_t *)c_kem_t.c_pke.v, (uint8_t *)c_kem_prime_t.c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 20| 42|#define vect_compare PQCHQC_NAMESPACE(vect_compare) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ result |= vect_compare((uint8_t *)c_kem_t.c_pke.v, (uint8_t *)c_kem_prime_t.c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 42|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 42, Folded] | | | | ------------------ | | ------------------ ------------------ 207| 42| result |= vect_compare(c_kem_t.salt, c_kem_prime_t.salt, SALT_BYTES); ------------------ | | 20| 42|#define vect_compare PQCHQC_NAMESPACE(vect_compare) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ result |= vect_compare(c_kem_t.salt, c_kem_prime_t.salt, SALT_BYTES); ------------------ | | 53| 42|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 208| 42| result -= 1; 209| 1.38k| for (size_t i = 0; i < SHARED_SECRET_BYTES; ++i) { ------------------ | | 28| 1.38k|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 1.38k|#define CRYPTO_BYTES 32 | | ------------------ ------------------ | Branch (209:24): [True: 1.34k, False: 42] ------------------ 210| 1.34k| K_prime[i] = (K_prime[i] & result) ^ (K_bar[i] & ~result); 211| 1.34k| } 212| | 213| |#ifdef VERBOSE 214| | printf("\n\nek_pke: "); 215| | for (int i = 0; i < PUBLIC_KEY_BYTES; ++i) printf("%02x", ek_pke[i]); 216| | printf("\n\ndk_pke: "); 217| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", dk_pke[i]); 218| | printf("\n\nc_kem: "); 219| | for (int i = 0; i < CIPHERTEXT_BYTES; ++i) printf("%02x", c_kem[i]); 220| | printf("\n\nm_prime: "); 221| | vect_print((uint64_t *)m_prime, PARAM_SECURITY_BYTES); 222| | printf("\n\nH(ek_kem): "); 223| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", hash_ek_kem[i]); 224| | printf("\n\ntheta_prime: "); 225| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", theta_prime[i]); 226| | printf("\n\n\n# Checking Ciphertext - Begin #"); 227| | printf("\n\nc_kem_prime_t.c_pke.u: "); 228| | vect_print(c_kem_prime_t.c_pke.u, VEC_N_SIZE_BYTES); 229| | printf("\n\nc_kem_prime_t.c_pke.v: "); 230| | vect_print(c_kem_prime_t.c_pke.v, VEC_N1N2_SIZE_BYTES); 231| | printf("\n\nsalt: "); 232| | for (int i = 0; i < SALT_BYTES; ++i) printf("%02x", c_kem_prime_t.salt[i]); 233| | printf("\n\n# Checking Ciphertext - End #\n"); 234| | printf("\n\nK_prime: "); 235| | for (int i = 0; i < SHARED_SECRET_BYTES; ++i) printf("%02x", K_prime[i]); 236| |#endif 237| | 238| | // Zeroize sensitive data 239| 42| memset_zero(dk_pke, sizeof dk_pke); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 240| 42| memset_zero(sigma, sizeof sigma); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 241| 42| memset_zero(m_prime, sizeof m_prime); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 242| 42| memset_zero(K_theta_prime, sizeof K_theta_prime); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 243| 42| memset_zero(K_bar, sizeof K_bar); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 244| 42| memset_zero(theta_prime, sizeof theta_prime); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 245| | 246| 42| return 0; 247| 42|} PQCHQC_HQC3_C_hqc_dk_pke_from_string: 19| 42|void hqc_dk_pke_from_string(uint64_t *y, const uint8_t *dk_pke) { 20| 42| shake256_xof_ctx dk_xof_ctx = {0}; 21| 42| xof_init(&dk_xof_ctx, dk_pke, SEED_BYTES); ------------------ | | 74| 42|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&dk_xof_ctx, dk_pke, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 22| 42| vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 16| 42|#define vect_sample_fixed_weight1 PQCHQC_NAMESPACE(vect_sample_fixed_weight1) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 19| 42|#define PARAM_OMEGA 100 ///< Define the parameter omega of the scheme ------------------ 23| 42| xof_ctx_release(&dk_xof_ctx); ------------------ | | 76| 42|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 24| | 25| | // Zeroize sensitive data 26| 42| memset_zero(&dk_xof_ctx, sizeof dk_xof_ctx); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 27| 42|} PQCHQC_HQC3_C_hqc_ek_pke_from_string: 36| 84|void hqc_ek_pke_from_string(uint64_t *h, uint64_t *s, const uint8_t *ek_pke) { 37| 84| shake256_xof_ctx ek_xof_ctx = {0}; 38| | 39| 84| xof_init(&ek_xof_ctx, ek_pke, SEED_BYTES); ------------------ | | 74| 84|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&ek_xof_ctx, ek_pke, SEED_BYTES); ------------------ | | 52| 84|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 40| 84| vect_set_random(&ek_xof_ctx, h); ------------------ | | 18| 84|#define vect_set_random PQCHQC_NAMESPACE(vect_set_random) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 41| 84| xof_ctx_release(&ek_xof_ctx); ------------------ | | 76| 84|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 42| | 43| 84| memcpy(s, ek_pke + SEED_BYTES, VEC_N_SIZE_BYTES); ------------------ | | 52| 84|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(s, ek_pke + SEED_BYTES, VEC_N_SIZE_BYTES); ------------------ | | 31| 84|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 84|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 84] | | | | ------------------ | | ------------------ ------------------ 44| 84|} PQCHQC_HQC3_C_hqc_c_kem_to_string: 52| 42|void hqc_c_kem_to_string(uint8_t *ct, const ciphertext_kem_t *c_kem) { 53| 42| memcpy(ct, c_kem->c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 31| 42|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 42] | | | | ------------------ | | ------------------ ------------------ 54| 42| memcpy(ct + VEC_N_SIZE_BYTES, c_kem->c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 31| 42|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 42] | | | | ------------------ | | ------------------ ------------------ memcpy(ct + VEC_N_SIZE_BYTES, c_kem->c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 42|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 42, Folded] | | | | ------------------ | | ------------------ ------------------ 55| 42| memcpy(ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, c_kem->salt, SALT_BYTES); ------------------ | | 31| 42|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 42] | | | | ------------------ | | ------------------ ------------------ memcpy(ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, c_kem->salt, SALT_BYTES); ------------------ | | 34| 42|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 42, Folded] | | | | ------------------ | | ------------------ ------------------ memcpy(ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, c_kem->salt, SALT_BYTES); ------------------ | | 53| 42|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 56| 42|} PQCHQC_HQC3_C_hqc_c_kem_from_string: 65| 42|void hqc_c_kem_from_string(ciphertext_pke_t *c_pke, uint8_t *salt, const uint8_t *ct) { 66| 42| memcpy(c_pke->u, ct, VEC_N_SIZE_BYTES); ------------------ | | 31| 42|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 42] | | | | ------------------ | | ------------------ ------------------ 67| 42| memcpy(c_pke->v, ct + VEC_N_SIZE_BYTES, VEC_N1N2_SIZE_BYTES); ------------------ | | 31| 42|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 42] | | | | ------------------ | | ------------------ ------------------ memcpy(c_pke->v, ct + VEC_N_SIZE_BYTES, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 42|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 42, Folded] | | | | ------------------ | | ------------------ ------------------ 68| 42| memcpy(salt, ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, SALT_BYTES); ------------------ | | 31| 42|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 42] | | | | ------------------ | | ------------------ ------------------ memcpy(salt, ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, SALT_BYTES); ------------------ | | 34| 42|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 42, Folded] | | | | ------------------ | | ------------------ ------------------ memcpy(salt, ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, SALT_BYTES); ------------------ | | 53| 42|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 69| 42|} PQCHQC_HQC3_C_reed_muller_encode: 174| 84|void reed_muller_encode(uint64_t *cdw, const uint64_t *msg) { 175| 84| uint8_t *message_array = (uint8_t *)msg; 176| 84| rm_codeword_t *codeArray = (rm_codeword_t *)cdw; 177| 4.78k| for (size_t i = 0; i < VEC_N1_SIZE_BYTES; i++) { ------------------ | | 33| 4.78k|#define VEC_N1_SIZE_BYTES PARAM_N1 ///< Size of array to store PARAM_N1 bits in bytes | | ------------------ | | | | 16| 4.78k|#define PARAM_N1 56 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) | | ------------------ ------------------ | Branch (177:24): [True: 4.70k, False: 84] ------------------ 178| | // fill entries i * MULTIPLICITY to (i+1) * MULTIPLICITY 179| 4.70k| int32_t pos = i * MULTIPLICITY; ------------------ | | 18| 4.70k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 4.70k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 4.70k, Folded] | | | | ------------------ | | ------------------ ------------------ 180| | // encode first word 181| 4.70k| encode(&codeArray[pos], message_array[i]); 182| | // copy to other identical codewords 183| 23.5k| for (size_t copy = 1; copy < MULTIPLICITY; copy++) { ------------------ | | 18| 23.5k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 23.5k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 23.5k, Folded] | | | | ------------------ | | ------------------ ------------------ | Branch (183:31): [True: 18.8k, False: 4.70k] ------------------ 184| 18.8k| memcpy(&codeArray[pos + copy], &codeArray[pos], sizeof(rm_codeword_t)); 185| 18.8k| } 186| 4.70k| } 187| 84|} PQCHQC_HQC3_C_reed_muller_decode: 198| 42|void reed_muller_decode(uint64_t *msg, const uint64_t *cdw) { 199| 42| uint8_t *message_array = (uint8_t *)msg; 200| 42| rm_codeword_t *codeArray = (rm_codeword_t *)cdw; 201| 42| rm_expanded_cdw expanded; 202| 2.39k| for (size_t i = 0; i < VEC_N1_SIZE_BYTES; i++) { ------------------ | | 33| 2.39k|#define VEC_N1_SIZE_BYTES PARAM_N1 ///< Size of array to store PARAM_N1 bits in bytes | | ------------------ | | | | 16| 2.39k|#define PARAM_N1 56 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) | | ------------------ ------------------ | Branch (202:24): [True: 2.35k, False: 42] ------------------ 203| | // collect the codewords 204| 2.35k| expand_and_sum(&expanded, &codeArray[i * MULTIPLICITY]); ------------------ | | 18| 2.35k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 2.35k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 2.35k, Folded] | | | | ------------------ | | ------------------ ------------------ 205| | // apply hadamard transform 206| 2.35k| rm_expanded_cdw transform; 207| 2.35k| hadamard(&expanded, &transform); 208| | // fix the first entry to get the half Hadamard transform 209| 2.35k| transform[0] -= 64 * MULTIPLICITY; ------------------ | | 18| 2.35k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 2.35k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 2.35k, Folded] | | | | ------------------ | | ------------------ ------------------ 210| | // finish the decoding 211| 2.35k| message_array[i] = find_peaks(&transform); 212| 2.35k| } 213| 42|} PQCHQC_HQC3_C_reed_solomon_encode: 84| 84|void reed_solomon_encode(uint64_t *cdw, const uint64_t *msg) { 85| 84| size_t i, j, k; 86| 84| uint8_t gate_value = 0; 87| | 88| 84| uint16_t tmp[PARAM_G] = {0}; 89| 84| uint16_t PARAM_RS_POLY[] = {RS_POLY_COEFS}; ------------------ | | 49| 84| 45, 216, 239, 24, 253, 104, 27, 40, 107, 50, 163, 210, 227, 134, 224, 158, 119, 13, 158, 1, 238, 164, 82, 43, 15, \ | | 50| 84| 232, 246, 142, 50, 189, 29, 232, 1 ///< Coefficients of the Reed-Solomon generator polynomial ------------------ 90| | 91| 84| uint8_t msg_bytes[PARAM_K] = {0}; 92| 84| uint8_t cdw_bytes[PARAM_N1] = {0}; 93| | 94| 84| memcpy(msg_bytes, msg, PARAM_K); ------------------ | | 44| 84|#define PARAM_K 24 ///< Define the size of the information bits of the Reed-Solomon code ------------------ 95| | 96| 2.10k| for (i = 0; i < PARAM_K; ++i) { ------------------ | | 44| 2.10k|#define PARAM_K 24 ///< Define the size of the information bits of the Reed-Solomon code ------------------ | Branch (96:17): [True: 2.01k, False: 84] ------------------ 97| 2.01k| gate_value = msg_bytes[PARAM_K - 1 - i] ^ cdw_bytes[PARAM_N1 - PARAM_K - 1]; ------------------ | | 44| 2.01k|#define PARAM_K 24 ///< Define the size of the information bits of the Reed-Solomon code ------------------ gate_value = msg_bytes[PARAM_K - 1 - i] ^ cdw_bytes[PARAM_N1 - PARAM_K - 1]; ------------------ | | 16| 2.01k|#define PARAM_N1 56 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) ------------------ gate_value = msg_bytes[PARAM_K - 1 - i] ^ cdw_bytes[PARAM_N1 - PARAM_K - 1]; ------------------ | | 44| 2.01k|#define PARAM_K 24 ///< Define the size of the information bits of the Reed-Solomon code ------------------ 98| | 99| 68.5k| for (j = 0; j < PARAM_G; ++j) { ------------------ | | 45| 68.5k|#define PARAM_G 33 ///< Define the size of the generator polynomial of the Reed-Solomon code ------------------ | Branch (99:21): [True: 66.5k, False: 2.01k] ------------------ 100| 66.5k| tmp[j] = gf_mul(gate_value, PARAM_RS_POLY[j]); ------------------ | | 51| 66.5k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 66.5k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 66.5k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 66.5k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 101| 66.5k| } 102| | 103| 64.5k| for (k = PARAM_N1 - PARAM_K - 1; k; --k) { ------------------ | | 16| 2.01k|#define PARAM_N1 56 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) ------------------ for (k = PARAM_N1 - PARAM_K - 1; k; --k) { ------------------ | | 44| 2.01k|#define PARAM_K 24 ///< Define the size of the information bits of the Reed-Solomon code ------------------ | Branch (103:42): [True: 62.4k, False: 2.01k] ------------------ 104| 62.4k| cdw_bytes[k] = cdw_bytes[k - 1] ^ tmp[k]; 105| 62.4k| } 106| | 107| 2.01k| cdw_bytes[0] = tmp[0]; 108| 2.01k| } 109| | 110| 84| memcpy(cdw_bytes + PARAM_N1 - PARAM_K, msg_bytes, PARAM_K); ------------------ | | 16| 84|#define PARAM_N1 56 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) ------------------ memcpy(cdw_bytes + PARAM_N1 - PARAM_K, msg_bytes, PARAM_K); ------------------ | | 44| 84|#define PARAM_K 24 ///< Define the size of the information bits of the Reed-Solomon code ------------------ memcpy(cdw_bytes + PARAM_N1 - PARAM_K, msg_bytes, PARAM_K); ------------------ | | 44| 84|#define PARAM_K 24 ///< Define the size of the information bits of the Reed-Solomon code ------------------ 111| 84| memcpy(cdw, cdw_bytes, PARAM_N1); ------------------ | | 16| 84|#define PARAM_N1 56 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) ------------------ 112| 84|} PQCHQC_HQC3_C_reed_solomon_decode: 353| 42|void reed_solomon_decode(uint64_t *msg, uint64_t *cdw) { 354| 42| uint8_t cdw_bytes[PARAM_N1] = {0}; 355| 42| uint16_t syndromes[2 * PARAM_DELTA] = {0}; 356| 42| uint16_t sigma[1 << PARAM_FFT] = {0}; 357| 42| uint8_t error[1 << PARAM_M] = {0}; 358| 42| uint16_t z[PARAM_N1] = {0}; 359| 42| uint16_t error_values[PARAM_N1] = {0}; 360| 42| uint16_t deg; 361| | 362| | // Copy the vector in an array of bytes 363| 42| memcpy(cdw_bytes, cdw, PARAM_N1); ------------------ | | 16| 42|#define PARAM_N1 56 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) ------------------ 364| | 365| | // Calculate the 2*PARAM_DELTA syndromes 366| 42| compute_syndromes(syndromes, cdw_bytes); 367| | 368| | // Compute the error locator polynomial sigma 369| | // Sigma's degree is at most PARAM_DELTA but the FFT requires the extra room 370| 42| deg = compute_elp(sigma, syndromes); 371| | 372| | // Compute the error polynomial error 373| 42| compute_roots(error, sigma); 374| | 375| | // Compute the polynomial z(x) 376| 42| compute_z_poly(z, sigma, deg, syndromes); 377| | 378| | // Compute the error values 379| 42| compute_error_values(error_values, z, error); 380| | 381| | // Correct the errors 382| 42| correct_errors(cdw_bytes, error_values); 383| | 384| | // Retrieve the message from the decoded codeword 385| 42| memcpy(msg, cdw_bytes + (PARAM_G - 1), PARAM_K); ------------------ | | 45| 42|#define PARAM_G 33 ///< Define the size of the generator polynomial of the Reed-Solomon code ------------------ memcpy(msg, cdw_bytes + (PARAM_G - 1), PARAM_K); ------------------ | | 44| 42|#define PARAM_K 24 ///< Define the size of the information bits of the Reed-Solomon code ------------------ 386| | 387| |#ifdef VERBOSE 388| | printf("\n\nThe syndromes: "); 389| | for (size_t i = 0; i < 2 * PARAM_DELTA; ++i) { 390| | printf("%u ", syndromes[i]); 391| | } 392| | printf("\n\nThe error locator polynomial: sigma(x) = "); 393| | bool first_coeff = true; 394| | if (sigma[0]) { 395| | printf("%u", sigma[0]); 396| | first_coeff = false; 397| | } 398| | for (size_t i = 1; i < (1 << PARAM_FFT); ++i) { 399| | if (sigma[i] == 0) 400| | continue; 401| | if (!first_coeff) 402| | printf(" + "); 403| | first_coeff = false; 404| | if (sigma[i] != 1) 405| | printf("%u ", sigma[i]); 406| | if (i == 1) 407| | printf("x"); 408| | else 409| | printf("x^%zu", i); 410| | } 411| | if (first_coeff) 412| | printf("0"); 413| | 414| | printf("\n\nThe polynomial: z(x) = "); 415| | bool first_coeff_1 = true; 416| | if (z[0]) { 417| | printf("%u", z[0]); 418| | first_coeff_1 = false; 419| | } 420| | for (size_t i = 1; i < (PARAM_DELTA + 1); ++i) { 421| | if (z[i] == 0) 422| | continue; 423| | if (!first_coeff_1) 424| | printf(" + "); 425| | first_coeff_1 = false; 426| | if (z[i] != 1) 427| | printf("%u ", z[i]); 428| | if (i == 1) 429| | printf("x"); 430| | else 431| | printf("x^%zu", i); 432| | } 433| | if (first_coeff_1) 434| | printf("0"); 435| | 436| | printf("\n\nThe pairs of (error locator numbers, error values): "); 437| | size_t j = 0; 438| | for (size_t i = 0; i < PARAM_N1; ++i) { 439| | if (error[i]) { 440| | printf("(%zu, %d) ", i, error_values[j]); 441| | j++; 442| | } 443| | } 444| | printf("\n"); 445| |#endif 446| | 447| | // Zeroize sensitive data 448| 42| memset_zero(cdw_bytes, sizeof cdw_bytes); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 449| 42|} PQCHQC_HQC3_C_prng_get_bytes: 20| 126|void prng_get_bytes(uint8_t *output, uint32_t outlen) { 21| 126| OQS_randombytes(output, outlen); 22| 126|} PQCHQC_HQC3_C_xof_init: 70| 336|void xof_init(shake256_xof_ctx *xof_ctx, const uint8_t *seed, uint32_t seed_size) { 71| 336| uint8_t xof_domain = HQC_XOF_DOMAIN; ------------------ | | 50| 336|#define HQC_XOF_DOMAIN 1 ------------------ 72| 336| OQS_SHA3_shake256_inc_init(xof_ctx); 73| 336| OQS_SHA3_shake256_inc_absorb(xof_ctx, seed, seed_size); 74| 336| OQS_SHA3_shake256_inc_absorb(xof_ctx, &xof_domain, 1); 75| 336| OQS_SHA3_shake256_inc_finalize(xof_ctx); 76| 336|} PQCHQC_HQC3_C_xof_get_bytes: 89| 13.1k|void xof_get_bytes(shake256_xof_ctx *xof_ctx, uint8_t *output, uint32_t output_size) { 90| 13.1k| OQS_SHA3_shake256_inc_squeeze(output, output_size, xof_ctx); 91| 13.1k|} PQCHQC_HQC3_C_xof_ctx_release: 96| 336|void xof_ctx_release(shake256_xof_ctx *xof_ctx) { 97| 336| OQS_SHA3_shake256_inc_ctx_release(xof_ctx); 98| 336|} PQCHQC_HQC3_C_hash_i: 109| 42|void hash_i(uint8_t *output, const uint8_t *seed) { 110| 42| sha3_512_ctx i_hash_ctx = {0}; 111| 42| uint8_t i_domain = HQC_I_FCT_DOMAIN; ------------------ | | 65| 42|#define HQC_I_FCT_DOMAIN 2 ------------------ 112| 42| OQS_SHA3_sha3_512_inc_init(&i_hash_ctx); 113| 42| OQS_SHA3_sha3_512_inc_absorb(&i_hash_ctx, seed, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 114| 42| OQS_SHA3_sha3_512_inc_absorb(&i_hash_ctx, &i_domain, 1); 115| 42| OQS_SHA3_sha3_512_inc_finalize(output, &i_hash_ctx); 116| 42| OQS_SHA3_sha3_512_inc_ctx_release(&i_hash_ctx); 117| 42|} PQCHQC_HQC3_C_hash_h: 125| 84|void hash_h(uint8_t *output, const uint8_t ek_kem[PUBLIC_KEY_BYTES]) { 126| 84| sha3_256_ctx h_hash_ctx = {0}; 127| 84| uint8_t h_domain = HQC_H_FCT_DOMAIN; ------------------ | | 60| 84|#define HQC_H_FCT_DOMAIN 1 ------------------ 128| 84| OQS_SHA3_sha3_256_inc_init(&h_hash_ctx); 129| 84| OQS_SHA3_sha3_256_inc_absorb(&h_hash_ctx, ek_kem, PUBLIC_KEY_BYTES); ------------------ | | 27| 84|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 84|#define CRYPTO_PUBLICKEYBYTES 4514 | | ------------------ ------------------ 130| 84| OQS_SHA3_sha3_256_inc_absorb(&h_hash_ctx, &h_domain, 1); 131| 84| OQS_SHA3_sha3_256_inc_finalize(output, &h_hash_ctx); 132| 84| OQS_SHA3_sha3_256_inc_ctx_release(&h_hash_ctx); 133| 84|} PQCHQC_HQC3_C_hash_g: 144| 84| const uint8_t salt[SALT_BYTES]) { 145| 84| sha3_512_ctx g_hash_ctx = {0}; 146| 84| uint8_t i_domain = HQC_G_FCT_DOMAIN; ------------------ | | 55| 84|#define HQC_G_FCT_DOMAIN 0 ------------------ 147| 84| OQS_SHA3_sha3_512_inc_init(&g_hash_ctx); 148| 84| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, hash_ek_kem, SEED_BYTES); ------------------ | | 52| 84|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 149| 84| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, m, PARAM_SECURITY_BYTES); ------------------ | | 23| 84|#define PARAM_SECURITY_BYTES 24 ///< Define the security level in bytes ------------------ 150| 84| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, salt, SALT_BYTES); ------------------ | | 53| 84|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 151| 84| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, &i_domain, 1); 152| 84| OQS_SHA3_sha3_512_inc_finalize(output, &g_hash_ctx); 153| 84| OQS_SHA3_sha3_512_inc_ctx_release(&g_hash_ctx); 154| 84|} PQCHQC_HQC3_C_hash_j: 165| 42| const ciphertext_kem_t *c_kem) { 166| 42| sha3_256_ctx k_hash_ctx = {0}; 167| 42| uint8_t k_domain = HQC_J_FCT_DOMAIN; ------------------ | | 70| 42|#define HQC_J_FCT_DOMAIN 3 ------------------ 168| 42| OQS_SHA3_sha3_256_inc_init(&k_hash_ctx); 169| 42| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, hash_ek_kem, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 170| 42| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, sigma, PARAM_SECURITY_BYTES); ------------------ | | 23| 42|#define PARAM_SECURITY_BYTES 24 ///< Define the security level in bytes ------------------ 171| 42| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, (uint8_t *)c_kem->c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 31| 42|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 42] | | | | ------------------ | | ------------------ ------------------ 172| 42| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, (uint8_t *)c_kem->c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 42|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 42, Folded] | | | | ------------------ | | ------------------ ------------------ 173| 42| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, c_kem->salt, SALT_BYTES); ------------------ | | 53| 42|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 174| 42| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, &k_domain, 1); 175| 42| OQS_SHA3_sha3_256_inc_finalize(output, &k_hash_ctx); 176| 42| OQS_SHA3_sha3_256_inc_ctx_release(&k_hash_ctx); 177| 42|} PQCHQC_HQC3_C_vect_generate_random_support1: 62| 126|void vect_generate_random_support1(shake256_xof_ctx *ctx, uint32_t *support, uint16_t weight) { 63| 126| uint8_t rand_bytes[3] = {0}; 64| 126| uint32_t candidate = 0; 65| | 66| 12.8k| for (size_t i = 0; i < weight;) { ------------------ | Branch (66:24): [True: 12.6k, False: 126] ------------------ 67| 12.6k| xof_get_bytes(ctx, rand_bytes, 3); ------------------ | | 75| 12.6k|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 12.6k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 12.6k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 12.6k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 68| 12.6k| candidate = rand_bytes[0] | (rand_bytes[1] << 8) | (rand_bytes[2] << 16); 69| | 70| 12.6k| if (candidate >= UTILS_REJECTION_THRESHOLD) { ------------------ | | 56| 12.6k|#define UTILS_REJECTION_THRESHOLD 16742417 ///< Rejection threshold for uniform sampling in [0, PARAM_N) ------------------ | Branch (70:13): [True: 42, False: 12.6k] ------------------ 71| 42| continue; 72| 42| } 73| 12.6k| candidate = barrett_reduce(candidate); 74| | 75| 12.6k| int is_position_available = 1; 76| 637k| for (size_t j = 0; j < i; j++) { ------------------ | Branch (76:28): [True: 624k, False: 12.6k] ------------------ 77| 624k| if (candidate == support[j]) { ------------------ | Branch (77:17): [True: 43, False: 624k] ------------------ 78| 43| is_position_available = 0; 79| 43| break; 80| 43| } 81| 624k| } 82| | 83| 12.6k| if (is_position_available == 1) { ------------------ | Branch (83:13): [True: 12.6k, False: 43] ------------------ 84| 12.6k| support[i] = candidate; 85| 12.6k| i++; 86| 12.6k| } 87| 12.6k| } 88| 126|} PQCHQC_HQC3_C_vect_generate_random_support2: 99| 252|void vect_generate_random_support2(shake256_xof_ctx *ctx, uint32_t *support, uint16_t weight) { 100| 252| uint32_t rand_u32[PARAM_OMEGA_R] = {0}; 101| | 102| 252| xof_get_bytes(ctx, (uint8_t *)&rand_u32, 4 * weight); ------------------ | | 75| 252|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 252|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 252|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 252|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 103| | 104| 28.9k| for (size_t i = 0; i < weight; ++i) { ------------------ | Branch (104:24): [True: 28.7k, False: 252] ------------------ 105| 28.7k| uint64_t buff = rand_u32[i]; 106| 28.7k| support[i] = i + ((buff * (PARAM_N - i)) >> 32); ------------------ | | 15| 28.7k|#define PARAM_N 35851 ///< Define the parameter n of the scheme ------------------ 107| 28.7k| } 108| | 109| 28.7k| for (int32_t i = (weight - 1); i-- > 0;) { ------------------ | Branch (109:36): [True: 28.4k, False: 252] ------------------ 110| 28.4k| uint32_t found = 0; 111| | 112| 1.65M| for (size_t j = i + 1; j < weight; ++j) { ------------------ | Branch (112:32): [True: 1.62M, False: 28.4k] ------------------ 113| 1.62M| found |= compare_u32(support[j], support[i]); 114| 1.62M| } 115| | 116| 28.4k| uint32_t mask = -found; 117| 28.4k| support[i] = (mask & i) ^ (~mask & support[i]); 118| 28.4k| } 119| 252|} PQCHQC_HQC3_C_vect_write_support_to_vector: 131| 378|void vect_write_support_to_vector(uint64_t *v, uint32_t *support, uint16_t weight) { 132| 378| uint32_t index_tab[PARAM_OMEGA_R] = {0}; 133| 378| uint64_t bit_tab[PARAM_OMEGA_R] = {0}; 134| | 135| 41.7k| for (size_t i = 0; i < weight; i++) { ------------------ | Branch (135:24): [True: 41.3k, False: 378] ------------------ 136| 41.3k| index_tab[i] = support[i] >> 6; 137| 41.3k| int32_t pos = support[i] & 0x3f; 138| 41.3k| bit_tab[i] = ((uint64_t)1) << pos; 139| 41.3k| } 140| | 141| 378| uint64_t val = 0; 142| 212k| for (uint32_t i = 0; i < VEC_N_SIZE_64; i++) { ------------------ | | 36| 212k|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 212k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 212k] | | | | ------------------ | | ------------------ ------------------ | Branch (142:26): [True: 212k, False: 378] ------------------ 143| 212k| val = 0; 144| 23.3M| for (uint32_t j = 0; j < weight; j++) { ------------------ | Branch (144:30): [True: 23.1M, False: 212k] ------------------ 145| 23.1M| uint32_t tmp = i - index_tab[j]; 146| 23.1M| int val1 = 1 ^ ((tmp | -tmp) >> 31); 147| 23.1M| uint64_t mask = -val1; 148| 23.1M| val |= (bit_tab[j] & mask); 149| 23.1M| } 150| 212k| v[i] |= val; 151| 212k| } 152| 378|} PQCHQC_HQC3_C_vect_sample_fixed_weight1: 169| 126|void vect_sample_fixed_weight1(shake256_xof_ctx *ctx, uint64_t *v, uint16_t weight) { 170| 126| uint32_t support[PARAM_OMEGA_R] = {0}; 171| 126| vect_generate_random_support1(ctx, support, weight); ------------------ | | 13| 126|#define vect_generate_random_support1 PQCHQC_NAMESPACE(vect_generate_random_support1) | | ------------------ | | | | 17| 126|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 126|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 126|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 172| 126| vect_write_support_to_vector(v, support, weight); ------------------ | | 15| 126|#define vect_write_support_to_vector PQCHQC_NAMESPACE(vect_write_support_to_vector) | | ------------------ | | | | 17| 126|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 126|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 126|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 173| 126|} PQCHQC_HQC3_C_vect_sample_fixed_weight2: 188| 252|void vect_sample_fixed_weight2(shake256_xof_ctx *ctx, uint64_t *v, uint16_t weight) { 189| 252| uint32_t support[PARAM_OMEGA_R] = {0}; 190| 252| vect_generate_random_support2(ctx, support, weight); ------------------ | | 14| 252|#define vect_generate_random_support2 PQCHQC_NAMESPACE(vect_generate_random_support2) | | ------------------ | | | | 17| 252|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 252|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 252|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 191| 252| vect_write_support_to_vector(v, support, weight); ------------------ | | 15| 252|#define vect_write_support_to_vector PQCHQC_NAMESPACE(vect_write_support_to_vector) | | ------------------ | | | | 17| 252|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 252|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 252|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 192| 252|} PQCHQC_HQC3_C_vect_set_random: 203| 126|void vect_set_random(shake256_xof_ctx *ctx, uint64_t *v) { 204| 126| xof_get_bytes(ctx, (uint8_t *)v, VEC_N_SIZE_BYTES); ------------------ | | 75| 126|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 126|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 126|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 126|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_get_bytes(ctx, (uint8_t *)v, VEC_N_SIZE_BYTES); ------------------ | | 31| 126|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 126|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 126] | | | | ------------------ | | ------------------ ------------------ 205| 126| v[VEC_N_SIZE_64 - 1] &= BITMASK(PARAM_N, 64); ------------------ | | 36| 126|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 126|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 126] | | | | ------------------ | | ------------------ ------------------ v[VEC_N_SIZE_64 - 1] &= BITMASK(PARAM_N, 64); ------------------ | | 13| 126|#define BITMASK(a, size) ((((uint64_t) 1UL) << (a % size)) - 1) /*!< Create a mask*/ ------------------ 206| 126|} PQCHQC_HQC3_C_vect_add: 216| 336|void vect_add(uint64_t *o, const uint64_t *v1, const uint64_t *v2, uint32_t size) { 217| 188k| for (uint32_t i = 0; i < size; ++i) { ------------------ | Branch (217:26): [True: 188k, False: 336] ------------------ 218| 188k| o[i] = v1[i] ^ v2[i]; 219| 188k| } 220| 336|} PQCHQC_HQC3_C_vect_compare: 233| 126|uint8_t vect_compare(const uint8_t *v1, const uint8_t *v2, uint32_t size) { 234| 126| uint16_t r = 0x0100; 235| | 236| 377k| for (size_t i = 0; i < size; i++) { ------------------ | Branch (236:24): [True: 377k, False: 126] ------------------ 237| 377k| r |= v1[i] ^ v2[i]; 238| 377k| } 239| | 240| 126| return (r - 1) >> 8; 241| 126|} PQCHQC_HQC3_C_vect_truncate: 249| 126|void vect_truncate(uint64_t *v) { 250| 126| size_t orig_words = (PARAM_N + 63) / 64; ------------------ | | 15| 126|#define PARAM_N 35851 ///< Define the parameter n of the scheme ------------------ 251| 126| size_t new_full_words = PARAM_N1N2 / 64; ------------------ | | 18| 126|#define PARAM_N1N2 35840 ///< Define the length in bits of the concatenated code ------------------ 252| 126| size_t remaining_bits = PARAM_N1N2 % 64; ------------------ | | 18| 126|#define PARAM_N1N2 35840 ///< Define the length in bits of the concatenated code ------------------ 253| | 254| | // Mask the last word if there's a partial word 255| 126| if (remaining_bits > 0) { ------------------ | Branch (255:9): [True: 0, False: 126] ------------------ 256| 0| uint64_t mask = (UINT64_C(1) << remaining_bits) - 1; 257| 0| v[new_full_words] &= mask; 258| 0| new_full_words++; // keep that partial word 259| 0| } 260| | 261| | // Zero out all subsequent words up to the original length 262| 252| for (size_t i = new_full_words; i < orig_words; i++) { ------------------ | Branch (262:37): [True: 126, False: 126] ------------------ 263| 126| v[i] = 0; 264| 126| } 265| 126|} PQCHQC_HQC5_C_code_encode: 27| 84|void code_encode(uint64_t *em, const uint64_t *m) { 28| 84| uint64_t tmp[VEC_N1_SIZE_64] = {0}; 29| | 30| 84| reed_solomon_encode(tmp, m); ------------------ | | 255| 84|#define reed_solomon_encode PQCHQC_NAMESPACE(reed_solomon_encode) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 31| 84| reed_muller_encode(em, tmp); ------------------ | | 14| 84|#define reed_muller_encode PQCHQC_NAMESPACE(reed_muller_encode) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 32| | 33| |#ifdef VERBOSE 34| | printf("\n\nReed-Solomon code word: "); 35| | vect_print(tmp, VEC_N1_SIZE_BYTES); 36| | printf("\n\nConcatenated code word: "); 37| | vect_print(em, VEC_N1N2_SIZE_BYTES); 38| |#endif 39| | // Zeroize sensitive data 40| 84| memset_zero(tmp, sizeof tmp); ------------------ | | 22| 84|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 84|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 41| 84|} PQCHQC_HQC5_C_code_decode: 49| 42|void code_decode(uint64_t *m, const uint64_t *em) { 50| 42| uint64_t tmp[VEC_N1_SIZE_64] = {0}; 51| | 52| 42| reed_muller_decode(tmp, em); ------------------ | | 15| 42|#define reed_muller_decode PQCHQC_NAMESPACE(reed_muller_decode) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 53| 42| reed_solomon_decode(m, tmp); ------------------ | | 256| 42|#define reed_solomon_decode PQCHQC_NAMESPACE(reed_solomon_decode) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| | 55| |#ifdef VERBOSE 56| | printf("\n\nReed-Muller decoding result (the input for the Reed-Solomon decoding algorithm): "); 57| | vect_print(tmp, VEC_N1_SIZE_BYTES); 58| |#endif 59| | 60| | // Zeroize sensitive data 61| 42| memset_zero(tmp, sizeof tmp); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 62| 42|} PQCHQC_HQC5_C_fft: 274| 42|void fft(uint16_t *w, const uint16_t *f, size_t f_coeffs) { 275| 42| uint16_t betas[PARAM_M - 1] = {0}; 276| 42| uint16_t betas_sums[1 << (PARAM_M - 1)] = {0}; 277| 42| uint16_t f0[1 << (PARAM_FFT - 1)] = {0}; 278| 42| uint16_t f1[1 << (PARAM_FFT - 1)] = {0}; 279| 42| uint16_t deltas[PARAM_M - 1] = {0}; 280| 42| uint16_t u[1 << (PARAM_M - 1)] = {0}; 281| 42| uint16_t v[1 << (PARAM_M - 1)] = {0}; 282| | 283| 42| size_t i, k; 284| | 285| | // Follows Gao and Mateer algorithm 286| 42| compute_fft_betas(betas); 287| | 288| | // Step 1: PARAM_FFT > 1, nothing to do 289| | 290| | // Compute gammas sums 291| 42| compute_subset_sums(betas_sums, betas, PARAM_M - 1); ------------------ | | 41| 42|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 292| | 293| | // Step 2: beta_m = 1, nothing to do 294| | 295| | // Step 3 296| 42| radix(f0, f1, f, PARAM_FFT); ------------------ | | 46| 42|#define PARAM_FFT 5 ///< Exponent for additive FFT (2^PARAM_FFT points) ------------------ 297| | 298| | // Step 4: Compute deltas 299| 336| for (i = 0; i < PARAM_M - 1; ++i) { ------------------ | | 41| 336|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ | Branch (299:17): [True: 294, False: 42] ------------------ 300| 294| deltas[i] = gf_square(betas[i]) ^ betas[i]; ------------------ | | 52| 294|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 294|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 294|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 294|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 301| 294| } 302| | 303| | // Step 5 304| 42| fft_rec(u, f0, (f_coeffs + 1) / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 41| 42|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ fft_rec(u, f0, (f_coeffs + 1) / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 46| 42|#define PARAM_FFT 5 ///< Exponent for additive FFT (2^PARAM_FFT points) ------------------ 305| 42| fft_rec(v, f1, f_coeffs / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 41| 42|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ fft_rec(v, f1, f_coeffs / 2, PARAM_M - 1, PARAM_FFT - 1, deltas); ------------------ | | 46| 42|#define PARAM_FFT 5 ///< Exponent for additive FFT (2^PARAM_FFT points) ------------------ 306| | 307| 42| k = 1 << (PARAM_M - 1); ------------------ | | 41| 42|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 308| | // Step 6, 7 and error polynomial computation 309| 42| memcpy(w + k, v, 2 * k); 310| | 311| | // Check if 0 is root 312| 42| w[0] = u[0]; 313| | 314| | // Check if 1 is root 315| 42| w[k] ^= u[0]; 316| | 317| | // Find other roots 318| 5.37k| for (i = 1; i < k; ++i) { ------------------ | Branch (318:17): [True: 5.33k, False: 42] ------------------ 319| 5.33k| w[i] = u[i] ^ gf_mul(betas_sums[i], v[i]); ------------------ | | 51| 5.33k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 5.33k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 5.33k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 5.33k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 320| 5.33k| w[k + i] ^= w[i]; 321| 5.33k| } 322| 42|} PQCHQC_HQC5_C_fft_retrieve_error_poly: 331| 42|void fft_retrieve_error_poly(uint8_t *error, const uint16_t *w) { 332| 42| uint16_t gammas[PARAM_M - 1] = {0}; 333| 42| uint16_t gammas_sums[1 << (PARAM_M - 1)] = {0}; 334| 42| uint16_t k; 335| 42| size_t i, index; 336| | 337| 42| compute_fft_betas(gammas); 338| 42| compute_subset_sums(gammas_sums, gammas, PARAM_M - 1); ------------------ | | 41| 42|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 339| | 340| 42| k = 1 << (PARAM_M - 1); ------------------ | | 41| 42|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ 341| 42| error[0] ^= 1 ^ ((uint16_t)-w[0] >> 15); 342| 42| error[0] ^= 1 ^ ((uint16_t)-w[k] >> 15); 343| | 344| 5.37k| for (i = 1; i < k; ++i) { ------------------ | Branch (344:17): [True: 5.33k, False: 42] ------------------ 345| 5.33k| index = PARAM_GF_MUL_ORDER - gf_log[gammas_sums[i]]; ------------------ | | 43| 5.33k|#define PARAM_GF_MUL_ORDER 255 ///< Size of the multiplicative group of GF(2^PARAM_M) (2^PARAM_M−1) ------------------ 346| 5.33k| error[index] ^= 1 ^ ((uint16_t)-w[i] >> 15); 347| | 348| 5.33k| index = PARAM_GF_MUL_ORDER - gf_log[gammas_sums[i] ^ 1]; ------------------ | | 43| 5.33k|#define PARAM_GF_MUL_ORDER 255 ///< Size of the multiplicative group of GF(2^PARAM_M) (2^PARAM_M−1) ------------------ 349| 5.33k| error[index] ^= 1 ^ ((uint16_t)-w[k + i] >> 15); 350| 5.33k| } 351| 42|} PQCHQC_HQC5_C_gf_mul: 153| 711k|uint16_t gf_mul(uint16_t a, uint16_t b) { 154| 711k| uint8_t c[2] = {0}; 155| 711k| gf_carryless_mul(c, (uint8_t)a, (uint8_t)b); 156| 711k| uint16_t tmp = (uint16_t)(c[0] ^ (c[1] << 8)); 157| 711k| return gf_reduce(tmp); 158| 711k|} PQCHQC_HQC5_C_gf_square: 165| 48.3k|uint16_t gf_square(uint16_t a) { 166| 48.3k| uint32_t b = a; 167| 48.3k| uint32_t s = b & 1; 168| 386k| for (size_t i = 1; i < PARAM_M; ++i) { ------------------ | | 41| 386k|#define PARAM_M 8 ///< Define the degree m of the Galois field GF(2^m) ------------------ | Branch (168:24): [True: 338k, False: 48.3k] ------------------ 169| 338k| b <<= 1; 170| 338k| s ^= b & (1 << 2 * i); 171| 338k| } 172| | 173| 48.3k| return gf_reduce(s); 174| 48.3k|} PQCHQC_HQC5_C_gf_inverse: 182| 7.56k|uint16_t gf_inverse(uint16_t a) { 183| 7.56k| uint16_t inv = a; 184| 7.56k| uint16_t tmp1, tmp2; 185| | 186| 7.56k| inv = gf_square(a); /* a^2 */ ------------------ | | 52| 7.56k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 7.56k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.56k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.56k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 187| 7.56k| tmp1 = gf_mul(inv, a); /* a^3 */ ------------------ | | 51| 7.56k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 7.56k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.56k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.56k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 188| 7.56k| inv = gf_square(inv); /* a^4 */ ------------------ | | 52| 7.56k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 7.56k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.56k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.56k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 189| 7.56k| tmp2 = gf_mul(inv, tmp1); /* a^7 */ ------------------ | | 51| 7.56k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 7.56k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.56k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.56k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 190| 7.56k| tmp1 = gf_mul(inv, tmp2); /* a^11 */ ------------------ | | 51| 7.56k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 7.56k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.56k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.56k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 191| 7.56k| inv = gf_mul(tmp1, inv); /* a^15 */ ------------------ | | 51| 7.56k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 7.56k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.56k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.56k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 192| 7.56k| inv = gf_square(inv); /* a^30 */ ------------------ | | 52| 7.56k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 7.56k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.56k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.56k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 193| 7.56k| inv = gf_square(inv); /* a^60 */ ------------------ | | 52| 7.56k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 7.56k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.56k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.56k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 194| 7.56k| inv = gf_square(inv); /* a^120 */ ------------------ | | 52| 7.56k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 7.56k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.56k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.56k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 195| 7.56k| inv = gf_mul(inv, tmp2); /* a^127 */ ------------------ | | 51| 7.56k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 7.56k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.56k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.56k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 196| 7.56k| inv = gf_square(inv); /* a^254 */ ------------------ | | 52| 7.56k|#define gf_square PQCHQC_NAMESPACE(gf_square) | | ------------------ | | | | 17| 7.56k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 7.56k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 7.56k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 197| 7.56k| return inv; 198| 7.56k|} PQCHQC_HQC5_C_vect_mul: 151| 252|void vect_mul(uint64_t *o, const uint64_t *a1, const uint64_t *a2) { 152| 252| uint64_t unreduced[2 * VEC_N_SIZE_64]; 153| 252| uint64_t tmp_buffer[TMP_BUFFER_WORDS]; 154| | 155| | /* multiply via Karatsuba into unreduced */ 156| 252| karatsuba_mul(unreduced, a1, a2, VEC_N_SIZE_64, tmp_buffer); ------------------ | | 36| 252|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 252|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 252] | | | | ------------------ | | ------------------ ------------------ 157| | 158| | /* reduce modulo X^n - 1 */ 159| 252| reduce(o, unreduced); 160| 252|} PQCHQC_HQC5_C_hqc_pke_keygen: 30| 42|void hqc_pke_keygen(uint8_t *ek_pke, uint8_t *dk_pke, uint8_t *seed) { 31| 42| uint8_t keypair_seed[2 * SEED_BYTES] = {0}; 32| 42| uint8_t *seed_dk = keypair_seed; 33| 42| uint8_t *seed_ek = keypair_seed + SEED_BYTES; ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 34| 42| shake256_xof_ctx dk_xof_ctx = {0}; 35| 42| shake256_xof_ctx ek_xof_ctx = {0}; 36| | 37| 42| uint64_t x[VEC_N_SIZE_64] = {0}; 38| 42| uint64_t y[VEC_N_SIZE_64] = {0}; 39| 42| uint64_t h[VEC_N_SIZE_64] = {0}; 40| 42| uint64_t s[VEC_N_SIZE_64] = {0}; 41| | 42| | // Derive keypair seeds 43| 42| hash_i(keypair_seed, seed); ------------------ | | 79| 42|#define hash_i PQCHQC_NAMESPACE(hash_i) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 44| | 45| | // Compute decryption key 46| 42| xof_init(&dk_xof_ctx, seed_dk, SEED_BYTES); ------------------ | | 74| 42|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&dk_xof_ctx, seed_dk, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 47| 42| vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 16| 42|#define vect_sample_fixed_weight1 PQCHQC_NAMESPACE(vect_sample_fixed_weight1) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 19| 42|#define PARAM_OMEGA 131 ///< Define the parameter omega of the scheme ------------------ 48| 42| vect_sample_fixed_weight1(&dk_xof_ctx, x, PARAM_OMEGA); ------------------ | | 16| 42|#define vect_sample_fixed_weight1 PQCHQC_NAMESPACE(vect_sample_fixed_weight1) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight1(&dk_xof_ctx, x, PARAM_OMEGA); ------------------ | | 19| 42|#define PARAM_OMEGA 131 ///< Define the parameter omega of the scheme ------------------ 49| 42| xof_ctx_release(&dk_xof_ctx); ------------------ | | 76| 42|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 50| | 51| | // Compute encryption key 52| 42| xof_init(&ek_xof_ctx, seed_ek, SEED_BYTES); ------------------ | | 74| 42|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&ek_xof_ctx, seed_ek, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 53| 42| vect_set_random(&ek_xof_ctx, h); ------------------ | | 18| 42|#define vect_set_random PQCHQC_NAMESPACE(vect_set_random) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 42| xof_ctx_release(&ek_xof_ctx); ------------------ | | 76| 42|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 55| 42| vect_mul(s, y, h); ------------------ | | 12| 42|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 56| 42| vect_add(s, x, s, VEC_N_SIZE_64); ------------------ | | 19| 42|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(s, x, s, VEC_N_SIZE_64); ------------------ | | 36| 42|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 42] | | | | ------------------ | | ------------------ ------------------ 57| | 58| | // Parse encryption key to string 59| 42| memcpy(ek_pke, seed_ek, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 60| 42| memcpy(ek_pke + SEED_BYTES, s, VEC_N_SIZE_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(ek_pke + SEED_BYTES, s, VEC_N_SIZE_BYTES); ------------------ | | 31| 42|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 42] | | | | ------------------ | | ------------------ ------------------ 61| | 62| | // Parse decryption key to string 63| 42| memcpy(dk_pke, seed_dk, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 64| | 65| |#ifdef VERBOSE 66| | printf("\n\nseed_dk: "); 67| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_dk[i]); 68| | printf("\n\nseed_ek: "); 69| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_ek[i]); 70| | printf("\n\ny: "); 71| | vect_print(y, VEC_N_SIZE_BYTES); 72| | printf("\n\nx: "); 73| | vect_print(x, VEC_N_SIZE_BYTES); 74| | printf("\n\nh: "); 75| | vect_print(h, VEC_N_SIZE_BYTES); 76| | printf("\n\ns: "); 77| | vect_print(s, VEC_N_SIZE_BYTES); 78| |#endif 79| | 80| | // Zeroize sensitive data 81| 42| memset_zero(keypair_seed, sizeof keypair_seed); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 82| 42| memset_zero(x, sizeof x); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 83| 42| memset_zero(y, sizeof y); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 84| 42| memset_zero(&dk_xof_ctx, sizeof dk_xof_ctx); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 85| 42|} PQCHQC_HQC5_C_hqc_pke_encrypt: 99| 84|void hqc_pke_encrypt(ciphertext_pke_t *c_pke, const uint8_t *ek_pke, const uint64_t *m, const uint8_t *theta) { 100| 84| shake256_xof_ctx theta_xof_ctx = {0}; 101| 84| uint64_t h[VEC_N_SIZE_64] = {0}; 102| 84| uint64_t s[VEC_N_SIZE_64] = {0}; 103| 84| uint64_t r1[VEC_N_SIZE_64] = {0}; 104| 84| uint64_t r2[VEC_N_SIZE_64] = {0}; 105| 84| uint64_t e[VEC_N_SIZE_64] = {0}; 106| 84| uint64_t tmp[VEC_N_SIZE_64] = {0}; 107| | 108| | // Initialize Xof using theta 109| 84| xof_init(&theta_xof_ctx, theta, SEED_BYTES); ------------------ | | 74| 84|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&theta_xof_ctx, theta, SEED_BYTES); ------------------ | | 52| 84|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 110| | 111| | // Retrieve h and s from public key 112| 84| hqc_ek_pke_from_string(h, s, ek_pke); ------------------ | | 15| 84|#define hqc_ek_pke_from_string PQCHQC_NAMESPACE(hqc_ek_pke_from_string) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 113| | 114| | // Generate re, e and r1 115| 84| vect_sample_fixed_weight2(&theta_xof_ctx, r2, PARAM_OMEGA_R); ------------------ | | 17| 84|#define vect_sample_fixed_weight2 PQCHQC_NAMESPACE(vect_sample_fixed_weight2) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight2(&theta_xof_ctx, r2, PARAM_OMEGA_R); ------------------ | | 21| 84|#define PARAM_OMEGA_R 149 ///< Define the parameter omega_r of the scheme ------------------ 116| 84| vect_sample_fixed_weight2(&theta_xof_ctx, e, PARAM_OMEGA_E); ------------------ | | 17| 84|#define vect_sample_fixed_weight2 PQCHQC_NAMESPACE(vect_sample_fixed_weight2) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight2(&theta_xof_ctx, e, PARAM_OMEGA_E); ------------------ | | 20| 84|#define PARAM_OMEGA_E 149 ///< Define the parameter omega_e of the scheme ------------------ 117| 84| vect_sample_fixed_weight2(&theta_xof_ctx, r1, PARAM_OMEGA_R); ------------------ | | 17| 84|#define vect_sample_fixed_weight2 PQCHQC_NAMESPACE(vect_sample_fixed_weight2) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight2(&theta_xof_ctx, r1, PARAM_OMEGA_R); ------------------ | | 21| 84|#define PARAM_OMEGA_R 149 ///< Define the parameter omega_r of the scheme ------------------ 118| 84| xof_ctx_release(&theta_xof_ctx); ------------------ | | 76| 84|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 119| | 120| | // Compute u = r1 + r2.h 121| 84| vect_mul(c_pke->u, r2, h); ------------------ | | 12| 84|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 122| 84| vect_add(c_pke->u, r1, c_pke->u, VEC_N_SIZE_64); ------------------ | | 19| 84|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(c_pke->u, r1, c_pke->u, VEC_N_SIZE_64); ------------------ | | 36| 84|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 84|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 84] | | | | ------------------ | | ------------------ ------------------ 123| | 124| | // Compute v = C.encode(m) 125| 84| code_encode(c_pke->v, m); ------------------ | | 14| 84|#define code_encode PQCHQC_NAMESPACE(code_encode) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 126| | 127| | // Compute v = C.encode(m) + Truncate(s.r2 + e) 128| 84| vect_mul(tmp, r2, s); ------------------ | | 12| 84|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 129| 84| vect_add(tmp, e, tmp, VEC_N_SIZE_64); ------------------ | | 19| 84|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(tmp, e, tmp, VEC_N_SIZE_64); ------------------ | | 36| 84|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 84|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 84] | | | | ------------------ | | ------------------ ------------------ 130| 84| vect_truncate(tmp); ------------------ | | 21| 84|#define vect_truncate PQCHQC_NAMESPACE(vect_truncate) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 131| 84| vect_add(c_pke->v, c_pke->v, tmp, VEC_N1N2_SIZE_64); ------------------ | | 19| 84|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(c_pke->v, c_pke->v, tmp, VEC_N1N2_SIZE_64); ------------------ | | 38| 84|#define VEC_N1N2_SIZE_64 CEIL_DIVIDE(PARAM_N1N2, 64) ///< Size of array to store PARAM_N1N2 bits in 64-bit words | | ------------------ | | | | 12| 84|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 84, Folded] | | | | ------------------ | | ------------------ ------------------ 132| | 133| |#ifdef VERBOSE 134| | printf("\n\nh: "); 135| | vect_print(h, VEC_N_SIZE_BYTES); 136| | printf("\n\ns: "); 137| | vect_print(s, VEC_N_SIZE_BYTES); 138| | printf("\n\nr1: "); 139| | vect_print(r1, VEC_N_SIZE_BYTES); 140| | printf("\n\nr2: "); 141| | vect_print(r2, VEC_N_SIZE_BYTES); 142| | printf("\n\ne: "); 143| | vect_print(e, VEC_N_SIZE_BYTES); 144| | printf("\n\nTruncate(s.r2 + e): "); 145| | vect_print(tmp, VEC_N1N2_SIZE_BYTES); 146| | printf("\n\nc_pke->u: "); 147| | vect_print(c_pke->u, VEC_N_SIZE_BYTES); 148| | printf("\n\nc_pke->v: "); 149| | vect_print(c_pke->v, VEC_N1N2_SIZE_BYTES); 150| |#endif 151| | 152| | // Zeroize sensitive data 153| 84| memset_zero(r1, sizeof r1); ------------------ | | 22| 84|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 84|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 154| 84| memset_zero(r2, sizeof r2); ------------------ | | 22| 84|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 84|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 155| 84| memset_zero(e, sizeof e); ------------------ | | 22| 84|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 84|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 156| 84| memset_zero(tmp, sizeof tmp); ------------------ | | 22| 84|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 84|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 157| 84| memset_zero(&theta_xof_ctx, sizeof theta_xof_ctx); ------------------ | | 22| 84|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 84|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 158| 84|} PQCHQC_HQC5_C_hqc_pke_decrypt: 173| 42|uint8_t hqc_pke_decrypt(uint64_t *m, const uint8_t *dk_pke, const ciphertext_pke_t *c_pke) { 174| 42| uint64_t y[VEC_N_SIZE_64] = {0}; 175| 42| uint64_t tmp1[VEC_N_SIZE_64] = {0}; 176| 42| uint64_t tmp2[VEC_N_SIZE_64] = {0}; 177| | 178| | // Parse decryption key dk_pke 179| 42| hqc_dk_pke_from_string(y, dk_pke); ------------------ | | 14| 42|#define hqc_dk_pke_from_string PQCHQC_NAMESPACE(hqc_dk_pke_from_string) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 180| | 181| | // Compute u.y 182| 42| vect_mul(tmp1, y, c_pke->u); ------------------ | | 12| 42|#define vect_mul PQCHQC_NAMESPACE(vect_mul) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 183| | // Truncate(u.y) 184| 42| vect_truncate(tmp1); ------------------ | | 21| 42|#define vect_truncate PQCHQC_NAMESPACE(vect_truncate) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 185| | // Compute v - Truncate(u.y) 186| 42| vect_add(tmp2, c_pke->v, tmp1, VEC_N1N2_SIZE_64); ------------------ | | 19| 42|#define vect_add PQCHQC_NAMESPACE(vect_add) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_add(tmp2, c_pke->v, tmp1, VEC_N1N2_SIZE_64); ------------------ | | 38| 42|#define VEC_N1N2_SIZE_64 CEIL_DIVIDE(PARAM_N1N2, 64) ///< Size of array to store PARAM_N1N2 bits in 64-bit words | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 42, Folded] | | | | ------------------ | | ------------------ ------------------ 187| | 188| |#ifdef VERBOSE 189| | printf("\n\nc_pke.u: "); 190| | vect_print(c_pke->u, VEC_N_SIZE_BYTES); 191| | printf("\n\nc_pke.v: "); 192| | vect_print(c_pke->v, VEC_N1N2_SIZE_BYTES); 193| | printf("\n\ny: "); 194| | vect_print(y, VEC_N_SIZE_BYTES); 195| | printf("\n\nTruncate(u.y): "); 196| | vect_print(tmp1, VEC_N1N2_SIZE_BYTES); 197| | printf("\n\nv - Truncate(u.y): "); 198| | vect_print(tmp2, VEC_N1N2_SIZE_BYTES); 199| |#endif 200| | 201| | // Compute plaintext m 202| 42| code_decode(m, tmp2); ------------------ | | 15| 42|#define code_decode PQCHQC_NAMESPACE(code_decode) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 203| | 204| | // Zeroize sensitive data 205| 42| memset_zero(y, sizeof y); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 206| 42| memset_zero(tmp1, sizeof tmp1); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 207| 42| memset_zero(tmp2, sizeof tmp2); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 208| | 209| 42| return 0; 210| 42|} PQCHQC_HQC5_C_crypto_kem_keypair: 39| 42|int crypto_kem_keypair(uint8_t *ek_kem, uint8_t *dk_kem) { 40| |#ifdef VERBOSE 41| | printf("\n\n\n### KEYGEN ###"); 42| |#endif 43| 42| uint8_t seed_kem[SEED_BYTES] = {0}; 44| 42| uint8_t sigma[PARAM_SECURITY_BYTES] = {0}; 45| 42| uint8_t seed_pke[SEED_BYTES] = {0}; 46| 42| shake256_xof_ctx ctx_kem; 47| | 48| 42| uint8_t ek_pke[PUBLIC_KEY_BYTES] = {0}; 49| 42| uint8_t dk_pke[SEED_BYTES] = {0}; 50| | 51| 42| prng_get_bytes(seed_kem, SEED_BYTES); ------------------ | | 73| 42|#define prng_get_bytes PQCHQC_NAMESPACE(prng_get_bytes) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ prng_get_bytes(seed_kem, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 52| | 53| | // Compute seed_pke and randomness sigma 54| 42| xof_init(&ctx_kem, seed_kem, SEED_BYTES); ------------------ | | 74| 42|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&ctx_kem, seed_kem, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 55| 42| xof_get_bytes(&ctx_kem, seed_pke, SEED_BYTES); ------------------ | | 75| 42|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_get_bytes(&ctx_kem, seed_pke, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 56| 42| xof_get_bytes(&ctx_kem, sigma, PARAM_SECURITY_BYTES); ------------------ | | 75| 42|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_get_bytes(&ctx_kem, sigma, PARAM_SECURITY_BYTES); ------------------ | | 23| 42|#define PARAM_SECURITY_BYTES 32 ///< Define the security level in bytes ------------------ 57| 42| xof_ctx_release(&ctx_kem); ------------------ | | 76| 42|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 58| | 59| | // Compute HQC-PKE keypair 60| 42| hqc_pke_keygen(ek_pke, dk_pke, seed_pke); ------------------ | | 14| 42|#define hqc_pke_keygen PQCHQC_NAMESPACE(hqc_pke_keygen) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 61| | 62| | // Compute HQC-KEM keypair 63| 42| memcpy(ek_kem, ek_pke, PUBLIC_KEY_BYTES); ------------------ | | 27| 42|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 42|#define CRYPTO_PUBLICKEYBYTES 7237 | | ------------------ ------------------ 64| 42| memcpy(dk_kem, ek_kem, PUBLIC_KEY_BYTES); ------------------ | | 27| 42|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 42|#define CRYPTO_PUBLICKEYBYTES 7237 | | ------------------ ------------------ 65| 42| memcpy(dk_kem + PUBLIC_KEY_BYTES, dk_pke, SEED_BYTES); ------------------ | | 27| 42|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 42|#define CRYPTO_PUBLICKEYBYTES 7237 | | ------------------ ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES, dk_pke, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 66| 42| memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, sigma, PARAM_SECURITY_BYTES); ------------------ | | 27| 42|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 42|#define CRYPTO_PUBLICKEYBYTES 7237 | | ------------------ ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, sigma, PARAM_SECURITY_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, sigma, PARAM_SECURITY_BYTES); ------------------ | | 23| 42|#define PARAM_SECURITY_BYTES 32 ///< Define the security level in bytes ------------------ 67| 42| memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 27| 42|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 42|#define CRYPTO_PUBLICKEYBYTES 7237 | | ------------------ ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 23| 42|#define PARAM_SECURITY_BYTES 32 ///< Define the security level in bytes ------------------ memcpy(dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES + PARAM_SECURITY_BYTES, seed_kem, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 68| | 69| |#ifdef VERBOSE 70| | printf("\n\nseed_kem: "); 71| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_kem[i]); 72| | printf("\n\nseed_pke: "); 73| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", seed_pke[i]); 74| | printf("\n\nsigma: "); 75| | for (int i = 0; i < PARAM_SECURITY_BYTES; ++i) printf("%02x", sigma[i]); 76| |#endif 77| | 78| | // Zeroize sensitive data 79| 42| memset_zero(seed_kem, sizeof seed_kem); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 80| 42| memset_zero(sigma, sizeof sigma); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 81| 42| memset_zero(seed_pke, sizeof seed_pke); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 82| 42| memset_zero(dk_pke, sizeof dk_pke); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 83| | 84| 42| return 0; 85| 42|} PQCHQC_HQC5_C_crypto_kem_enc: 105| 42|int crypto_kem_enc(uint8_t *c_kem, uint8_t *K, const uint8_t *ek_kem) { 106| |#ifdef VERBOSE 107| | printf("\n\n\n\n### ENCAPS ###"); 108| |#endif 109| | 110| 42| uint8_t m[PARAM_SECURITY_BYTES] = {0}; 111| 42| uint8_t K_theta[SHARED_SECRET_BYTES + SEED_BYTES] = {0}; 112| 42| uint8_t theta[SEED_BYTES] = {0}; 113| 42| uint8_t hash_ek_kem[SEED_BYTES] = {0}; 114| 42| ciphertext_kem_t c_kem_t = {0}; 115| | 116| | // Sample message m and salt 117| 42| prng_get_bytes(m, PARAM_SECURITY_BYTES); ------------------ | | 73| 42|#define prng_get_bytes PQCHQC_NAMESPACE(prng_get_bytes) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ prng_get_bytes(m, PARAM_SECURITY_BYTES); ------------------ | | 23| 42|#define PARAM_SECURITY_BYTES 32 ///< Define the security level in bytes ------------------ 118| 42| prng_get_bytes(c_kem_t.salt, SALT_BYTES); ------------------ | | 73| 42|#define prng_get_bytes PQCHQC_NAMESPACE(prng_get_bytes) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ prng_get_bytes(c_kem_t.salt, SALT_BYTES); ------------------ | | 53| 42|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 119| | 120| | // Compute shared key K and ciphertext c_kem 121| 42| hash_h(hash_ek_kem, ek_kem); ------------------ | | 78| 42|#define hash_h PQCHQC_NAMESPACE(hash_h) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 122| 42| hash_g(K_theta, hash_ek_kem, m, c_kem_t.salt); ------------------ | | 77| 42|#define hash_g PQCHQC_NAMESPACE(hash_g) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 123| 42| memcpy(theta, K_theta + SEED_BYTES, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(theta, K_theta + SEED_BYTES, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 124| 42| hqc_pke_encrypt(&c_kem_t.c_pke, ek_kem, (uint64_t *)m, theta); ------------------ | | 15| 42|#define hqc_pke_encrypt PQCHQC_NAMESPACE(hqc_pke_encrypt) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 125| | 126| 42| hqc_c_kem_to_string(c_kem, &c_kem_t); ------------------ | | 16| 42|#define hqc_c_kem_to_string PQCHQC_NAMESPACE(hqc_c_kem_to_string) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 127| 42| memcpy(K, K_theta, SHARED_SECRET_BYTES); ------------------ | | 28| 42|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 42|#define CRYPTO_BYTES 32 | | ------------------ ------------------ 128| | 129| |#ifdef VERBOSE 130| | printf("\n\nek_kem: "); 131| | for (int i = 0; i < PUBLIC_KEY_BYTES; ++i) printf("%02x", ek_kem[i]); 132| | printf("\n\nm: "); 133| | vect_print((uint64_t *)m, PARAM_SECURITY_BYTES); 134| | printf("\n\nsalt: "); 135| | for (int i = 0; i < SALT_BYTES; ++i) printf("%02x", c_kem_t.salt[i]); 136| | printf("\n\nH(ek_kem): "); 137| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", hash_ek_kem[i]); 138| | printf("\n\ntheta: "); 139| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", theta[i]); 140| | printf("\n\nc_kem: "); 141| | for (int i = 0; i < CIPHERTEXT_BYTES; ++i) printf("%02x", c_kem[i]); 142| | printf("\n\nK: "); 143| | for (int i = 0; i < SHARED_SECRET_BYTES; ++i) printf("%02x", K[i]); 144| |#endif 145| | 146| | // Zeroize sensitive data 147| 42| memset_zero(m, sizeof m); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 148| 42| memset_zero(K_theta, sizeof K_theta); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 149| 42| memset_zero(theta, sizeof theta); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 150| | 151| 42| return 0; 152| 42|} PQCHQC_HQC5_C_crypto_kem_dec: 166| 42|int crypto_kem_dec(uint8_t *K_prime, const uint8_t *c_kem, const uint8_t *dk_kem) { 167| |#ifdef VERBOSE 168| | printf("\n\n\n\n### DECAPS ###"); 169| |#endif 170| | 171| 42| uint8_t ek_pke[PUBLIC_KEY_BYTES] = {0}; 172| 42| uint8_t dk_pke[SEED_BYTES] = {0}; 173| 42| uint8_t sigma[PARAM_SECURITY_BYTES] = {0}; 174| 42| uint8_t m_prime[PARAM_SECURITY_BYTES] = {0}; 175| 42| uint8_t hash_ek_kem[SEED_BYTES] = {0}; 176| 42| uint8_t K_theta_prime[SHARED_SECRET_BYTES + SEED_BYTES] = {0}; 177| 42| uint8_t K_bar[SHARED_SECRET_BYTES] = {0}; 178| 42| uint8_t theta_prime[SEED_BYTES] = {0}; 179| 42| ciphertext_kem_t c_kem_t = {0}; 180| 42| ciphertext_kem_t c_kem_prime_t = {0}; 181| 42| uint8_t result; 182| | 183| | // Parse decapsulation key dk_kem 184| 42| memcpy(ek_pke, dk_kem, PUBLIC_KEY_BYTES); ------------------ | | 27| 42|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 42|#define CRYPTO_PUBLICKEYBYTES 7237 | | ------------------ ------------------ 185| 42| memcpy(dk_pke, dk_kem + PUBLIC_KEY_BYTES, SEED_BYTES); ------------------ | | 27| 42|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 42|#define CRYPTO_PUBLICKEYBYTES 7237 | | ------------------ ------------------ memcpy(dk_pke, dk_kem + PUBLIC_KEY_BYTES, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 186| 42| memcpy(sigma, dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, PARAM_SECURITY_BYTES); ------------------ | | 27| 42|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 42|#define CRYPTO_PUBLICKEYBYTES 7237 | | ------------------ ------------------ memcpy(sigma, dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, PARAM_SECURITY_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(sigma, dk_kem + PUBLIC_KEY_BYTES + SEED_BYTES, PARAM_SECURITY_BYTES); ------------------ | | 23| 42|#define PARAM_SECURITY_BYTES 32 ///< Define the security level in bytes ------------------ 187| | 188| | // Parse ciphertext c_kem 189| 42| hqc_c_kem_from_string(&c_kem_t.c_pke, c_kem_t.salt, c_kem); ------------------ | | 17| 42|#define hqc_c_kem_from_string PQCHQC_NAMESPACE(hqc_c_kem_from_string) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 190| | 191| | // Compute message m_prime 192| 42| result = hqc_pke_decrypt((uint64_t *)m_prime, dk_pke, &c_kem_t.c_pke); ------------------ | | 16| 42|#define hqc_pke_decrypt PQCHQC_NAMESPACE(hqc_pke_decrypt) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 193| | 194| | // Compute shared key K_prime and ciphertext c_kem_prime 195| 42| hash_h(hash_ek_kem, ek_pke); ------------------ | | 78| 42|#define hash_h PQCHQC_NAMESPACE(hash_h) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 196| 42| hash_g(K_theta_prime, hash_ek_kem, m_prime, c_kem_t.salt); ------------------ | | 77| 42|#define hash_g PQCHQC_NAMESPACE(hash_g) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 197| 42| memcpy(K_prime, K_theta_prime, SHARED_SECRET_BYTES); ------------------ | | 28| 42|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 42|#define CRYPTO_BYTES 32 | | ------------------ ------------------ 198| 42| memcpy(theta_prime, K_theta_prime + SHARED_SECRET_BYTES, SEED_BYTES); ------------------ | | 28| 42|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 42|#define CRYPTO_BYTES 32 | | ------------------ ------------------ memcpy(theta_prime, K_theta_prime + SHARED_SECRET_BYTES, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 199| | 200| 42| hqc_pke_encrypt(&c_kem_prime_t.c_pke, ek_pke, (uint64_t *)m_prime, theta_prime); ------------------ | | 15| 42|#define hqc_pke_encrypt PQCHQC_NAMESPACE(hqc_pke_encrypt) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 201| 42| memcpy(c_kem_prime_t.salt, c_kem_t.salt, SALT_BYTES); ------------------ | | 53| 42|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 202| | 203| | // Compute rejection key K_bar 204| 42| hash_j(K_bar, hash_ek_kem, sigma, &c_kem_t); ------------------ | | 80| 42|#define hash_j PQCHQC_NAMESPACE(hash_j) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 205| 42| result |= vect_compare((uint8_t *)c_kem_t.c_pke.u, (uint8_t *)c_kem_prime_t.c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 20| 42|#define vect_compare PQCHQC_NAMESPACE(vect_compare) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ result |= vect_compare((uint8_t *)c_kem_t.c_pke.u, (uint8_t *)c_kem_prime_t.c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 31| 42|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 42] | | | | ------------------ | | ------------------ ------------------ 206| 42| result |= vect_compare((uint8_t *)c_kem_t.c_pke.v, (uint8_t *)c_kem_prime_t.c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 20| 42|#define vect_compare PQCHQC_NAMESPACE(vect_compare) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ result |= vect_compare((uint8_t *)c_kem_t.c_pke.v, (uint8_t *)c_kem_prime_t.c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 42|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 42, Folded] | | | | ------------------ | | ------------------ ------------------ 207| 42| result |= vect_compare(c_kem_t.salt, c_kem_prime_t.salt, SALT_BYTES); ------------------ | | 20| 42|#define vect_compare PQCHQC_NAMESPACE(vect_compare) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ result |= vect_compare(c_kem_t.salt, c_kem_prime_t.salt, SALT_BYTES); ------------------ | | 53| 42|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 208| 42| result -= 1; 209| 1.38k| for (size_t i = 0; i < SHARED_SECRET_BYTES; ++i) { ------------------ | | 28| 1.38k|#define SHARED_SECRET_BYTES CRYPTO_BYTES ///< Define the size of the shared secret in bytes | | ------------------ | | | | 13| 1.38k|#define CRYPTO_BYTES 32 | | ------------------ ------------------ | Branch (209:24): [True: 1.34k, False: 42] ------------------ 210| 1.34k| K_prime[i] = (K_prime[i] & result) ^ (K_bar[i] & ~result); 211| 1.34k| } 212| | 213| |#ifdef VERBOSE 214| | printf("\n\nek_pke: "); 215| | for (int i = 0; i < PUBLIC_KEY_BYTES; ++i) printf("%02x", ek_pke[i]); 216| | printf("\n\ndk_pke: "); 217| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", dk_pke[i]); 218| | printf("\n\nc_kem: "); 219| | for (int i = 0; i < CIPHERTEXT_BYTES; ++i) printf("%02x", c_kem[i]); 220| | printf("\n\nm_prime: "); 221| | vect_print((uint64_t *)m_prime, PARAM_SECURITY_BYTES); 222| | printf("\n\nH(ek_kem): "); 223| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", hash_ek_kem[i]); 224| | printf("\n\ntheta_prime: "); 225| | for (int i = 0; i < SEED_BYTES; ++i) printf("%02x", theta_prime[i]); 226| | printf("\n\n\n# Checking Ciphertext - Begin #"); 227| | printf("\n\nc_kem_prime_t.c_pke.u: "); 228| | vect_print(c_kem_prime_t.c_pke.u, VEC_N_SIZE_BYTES); 229| | printf("\n\nc_kem_prime_t.c_pke.v: "); 230| | vect_print(c_kem_prime_t.c_pke.v, VEC_N1N2_SIZE_BYTES); 231| | printf("\n\nsalt: "); 232| | for (int i = 0; i < SALT_BYTES; ++i) printf("%02x", c_kem_prime_t.salt[i]); 233| | printf("\n\n# Checking Ciphertext - End #\n"); 234| | printf("\n\nK_prime: "); 235| | for (int i = 0; i < SHARED_SECRET_BYTES; ++i) printf("%02x", K_prime[i]); 236| |#endif 237| | 238| | // Zeroize sensitive data 239| 42| memset_zero(dk_pke, sizeof dk_pke); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 240| 42| memset_zero(sigma, sizeof sigma); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 241| 42| memset_zero(m_prime, sizeof m_prime); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 242| 42| memset_zero(K_theta_prime, sizeof K_theta_prime); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 243| 42| memset_zero(K_bar, sizeof K_bar); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 244| 42| memset_zero(theta_prime, sizeof theta_prime); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 245| | 246| 42| return 0; 247| 42|} PQCHQC_HQC5_C_hqc_dk_pke_from_string: 19| 42|void hqc_dk_pke_from_string(uint64_t *y, const uint8_t *dk_pke) { 20| 42| shake256_xof_ctx dk_xof_ctx = {0}; 21| 42| xof_init(&dk_xof_ctx, dk_pke, SEED_BYTES); ------------------ | | 74| 42|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&dk_xof_ctx, dk_pke, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 22| 42| vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 16| 42|#define vect_sample_fixed_weight1 PQCHQC_NAMESPACE(vect_sample_fixed_weight1) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ vect_sample_fixed_weight1(&dk_xof_ctx, y, PARAM_OMEGA); ------------------ | | 19| 42|#define PARAM_OMEGA 131 ///< Define the parameter omega of the scheme ------------------ 23| 42| xof_ctx_release(&dk_xof_ctx); ------------------ | | 76| 42|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 24| | 25| | // Zeroize sensitive data 26| 42| memset_zero(&dk_xof_ctx, sizeof dk_xof_ctx); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 27| 42|} PQCHQC_HQC5_C_hqc_ek_pke_from_string: 36| 84|void hqc_ek_pke_from_string(uint64_t *h, uint64_t *s, const uint8_t *ek_pke) { 37| 84| shake256_xof_ctx ek_xof_ctx = {0}; 38| | 39| 84| xof_init(&ek_xof_ctx, ek_pke, SEED_BYTES); ------------------ | | 74| 84|#define xof_init PQCHQC_NAMESPACE(xof_init) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_init(&ek_xof_ctx, ek_pke, SEED_BYTES); ------------------ | | 52| 84|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 40| 84| vect_set_random(&ek_xof_ctx, h); ------------------ | | 18| 84|#define vect_set_random PQCHQC_NAMESPACE(vect_set_random) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 41| 84| xof_ctx_release(&ek_xof_ctx); ------------------ | | 76| 84|#define xof_ctx_release PQCHQC_NAMESPACE(xof_ctx_release) | | ------------------ | | | | 17| 84|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 84|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 84|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 42| | 43| 84| memcpy(s, ek_pke + SEED_BYTES, VEC_N_SIZE_BYTES); ------------------ | | 52| 84|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ memcpy(s, ek_pke + SEED_BYTES, VEC_N_SIZE_BYTES); ------------------ | | 31| 84|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 84|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 84] | | | | ------------------ | | ------------------ ------------------ 44| 84|} PQCHQC_HQC5_C_hqc_c_kem_to_string: 52| 42|void hqc_c_kem_to_string(uint8_t *ct, const ciphertext_kem_t *c_kem) { 53| 42| memcpy(ct, c_kem->c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 31| 42|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 42] | | | | ------------------ | | ------------------ ------------------ 54| 42| memcpy(ct + VEC_N_SIZE_BYTES, c_kem->c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 31| 42|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 42] | | | | ------------------ | | ------------------ ------------------ memcpy(ct + VEC_N_SIZE_BYTES, c_kem->c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 42|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 42, Folded] | | | | ------------------ | | ------------------ ------------------ 55| 42| memcpy(ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, c_kem->salt, SALT_BYTES); ------------------ | | 31| 42|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 42] | | | | ------------------ | | ------------------ ------------------ memcpy(ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, c_kem->salt, SALT_BYTES); ------------------ | | 34| 42|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 42, Folded] | | | | ------------------ | | ------------------ ------------------ memcpy(ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, c_kem->salt, SALT_BYTES); ------------------ | | 53| 42|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 56| 42|} PQCHQC_HQC5_C_hqc_c_kem_from_string: 65| 42|void hqc_c_kem_from_string(ciphertext_pke_t *c_pke, uint8_t *salt, const uint8_t *ct) { 66| 42| memcpy(c_pke->u, ct, VEC_N_SIZE_BYTES); ------------------ | | 31| 42|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 42] | | | | ------------------ | | ------------------ ------------------ 67| 42| memcpy(c_pke->v, ct + VEC_N_SIZE_BYTES, VEC_N1N2_SIZE_BYTES); ------------------ | | 31| 42|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 42] | | | | ------------------ | | ------------------ ------------------ memcpy(c_pke->v, ct + VEC_N_SIZE_BYTES, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 42|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 42, Folded] | | | | ------------------ | | ------------------ ------------------ 68| 42| memcpy(salt, ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, SALT_BYTES); ------------------ | | 31| 42|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 42] | | | | ------------------ | | ------------------ ------------------ memcpy(salt, ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, SALT_BYTES); ------------------ | | 34| 42|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 42, Folded] | | | | ------------------ | | ------------------ ------------------ memcpy(salt, ct + VEC_N_SIZE_BYTES + VEC_N1N2_SIZE_BYTES, SALT_BYTES); ------------------ | | 53| 42|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 69| 42|} PQCHQC_HQC5_C_reed_muller_encode: 174| 84|void reed_muller_encode(uint64_t *cdw, const uint64_t *msg) { 175| 84| uint8_t *message_array = (uint8_t *)msg; 176| 84| rm_codeword_t *codeArray = (rm_codeword_t *)cdw; 177| 7.64k| for (size_t i = 0; i < VEC_N1_SIZE_BYTES; i++) { ------------------ | | 33| 7.64k|#define VEC_N1_SIZE_BYTES PARAM_N1 ///< Size of array to store PARAM_N1 bits in bytes | | ------------------ | | | | 16| 7.64k|#define PARAM_N1 90 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) | | ------------------ ------------------ | Branch (177:24): [True: 7.56k, False: 84] ------------------ 178| | // fill entries i * MULTIPLICITY to (i+1) * MULTIPLICITY 179| 7.56k| int32_t pos = i * MULTIPLICITY; ------------------ | | 18| 7.56k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 7.56k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 7.56k, Folded] | | | | ------------------ | | ------------------ ------------------ 180| | // encode first word 181| 7.56k| encode(&codeArray[pos], message_array[i]); 182| | // copy to other identical codewords 183| 37.8k| for (size_t copy = 1; copy < MULTIPLICITY; copy++) { ------------------ | | 18| 37.8k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 37.8k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 37.8k, Folded] | | | | ------------------ | | ------------------ ------------------ | Branch (183:31): [True: 30.2k, False: 7.56k] ------------------ 184| 30.2k| memcpy(&codeArray[pos + copy], &codeArray[pos], sizeof(rm_codeword_t)); 185| 30.2k| } 186| 7.56k| } 187| 84|} PQCHQC_HQC5_C_reed_muller_decode: 198| 42|void reed_muller_decode(uint64_t *msg, const uint64_t *cdw) { 199| 42| uint8_t *message_array = (uint8_t *)msg; 200| 42| rm_codeword_t *codeArray = (rm_codeword_t *)cdw; 201| 42| rm_expanded_cdw expanded; 202| 3.82k| for (size_t i = 0; i < VEC_N1_SIZE_BYTES; i++) { ------------------ | | 33| 3.82k|#define VEC_N1_SIZE_BYTES PARAM_N1 ///< Size of array to store PARAM_N1 bits in bytes | | ------------------ | | | | 16| 3.82k|#define PARAM_N1 90 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) | | ------------------ ------------------ | Branch (202:24): [True: 3.78k, False: 42] ------------------ 203| | // collect the codewords 204| 3.78k| expand_and_sum(&expanded, &codeArray[i * MULTIPLICITY]); ------------------ | | 18| 3.78k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 3.78k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 3.78k, Folded] | | | | ------------------ | | ------------------ ------------------ 205| | // apply hadamard transform 206| 3.78k| rm_expanded_cdw transform; 207| 3.78k| hadamard(&expanded, &transform); 208| | // fix the first entry to get the half Hadamard transform 209| 3.78k| transform[0] -= 64 * MULTIPLICITY; ------------------ | | 18| 3.78k|#define MULTIPLICITY CEIL_DIVIDE(PARAM_N2, 128) | | ------------------ | | | | 12| 3.78k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 3.78k, Folded] | | | | ------------------ | | ------------------ ------------------ 210| | // finish the decoding 211| 3.78k| message_array[i] = find_peaks(&transform); 212| 3.78k| } 213| 42|} PQCHQC_HQC5_C_reed_solomon_encode: 84| 84|void reed_solomon_encode(uint64_t *cdw, const uint64_t *msg) { 85| 84| size_t i, j, k; 86| 84| uint8_t gate_value = 0; 87| | 88| 84| uint16_t tmp[PARAM_G] = {0}; 89| 84| uint16_t PARAM_RS_POLY[] = {RS_POLY_COEFS}; ------------------ | | 49| 84| 49,167,49,39,200,121,124,91,240,63,148,71,150,123,87,101,32,215,159,71,201,115,97,210,186,183,141,217,123,12,31, \ | | 50| 84| 243,180,219,152,239,99,141,4,246,191,144,8,232,47,27,141,178,130,64,124,47,39,188,216,48,199,187,1 ///< Coefficients of the Reed-Solomon generator polynomial ------------------ 90| | 91| 84| uint8_t msg_bytes[PARAM_K] = {0}; 92| 84| uint8_t cdw_bytes[PARAM_N1] = {0}; 93| | 94| 84| memcpy(msg_bytes, msg, PARAM_K); ------------------ | | 44| 84|#define PARAM_K 32 ///< Define the size of the information bits of the Reed-Solomon code ------------------ 95| | 96| 2.77k| for (i = 0; i < PARAM_K; ++i) { ------------------ | | 44| 2.77k|#define PARAM_K 32 ///< Define the size of the information bits of the Reed-Solomon code ------------------ | Branch (96:17): [True: 2.68k, False: 84] ------------------ 97| 2.68k| gate_value = msg_bytes[PARAM_K - 1 - i] ^ cdw_bytes[PARAM_N1 - PARAM_K - 1]; ------------------ | | 44| 2.68k|#define PARAM_K 32 ///< Define the size of the information bits of the Reed-Solomon code ------------------ gate_value = msg_bytes[PARAM_K - 1 - i] ^ cdw_bytes[PARAM_N1 - PARAM_K - 1]; ------------------ | | 16| 2.68k|#define PARAM_N1 90 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) ------------------ gate_value = msg_bytes[PARAM_K - 1 - i] ^ cdw_bytes[PARAM_N1 - PARAM_K - 1]; ------------------ | | 44| 2.68k|#define PARAM_K 32 ///< Define the size of the information bits of the Reed-Solomon code ------------------ 98| | 99| 161k| for (j = 0; j < PARAM_G; ++j) { ------------------ | | 45| 161k|#define PARAM_G 59 ///< Define the size of the generator polynomial of the Reed-Solomon code ------------------ | Branch (99:21): [True: 158k, False: 2.68k] ------------------ 100| 158k| tmp[j] = gf_mul(gate_value, PARAM_RS_POLY[j]); ------------------ | | 51| 158k|#define gf_mul PQCHQC_NAMESPACE(gf_mul) | | ------------------ | | | | 17| 158k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 158k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 158k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 101| 158k| } 102| | 103| 155k| for (k = PARAM_N1 - PARAM_K - 1; k; --k) { ------------------ | | 16| 2.68k|#define PARAM_N1 90 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) ------------------ for (k = PARAM_N1 - PARAM_K - 1; k; --k) { ------------------ | | 44| 2.68k|#define PARAM_K 32 ///< Define the size of the information bits of the Reed-Solomon code ------------------ | Branch (103:42): [True: 153k, False: 2.68k] ------------------ 104| 153k| cdw_bytes[k] = cdw_bytes[k - 1] ^ tmp[k]; 105| 153k| } 106| | 107| 2.68k| cdw_bytes[0] = tmp[0]; 108| 2.68k| } 109| | 110| 84| memcpy(cdw_bytes + PARAM_N1 - PARAM_K, msg_bytes, PARAM_K); ------------------ | | 16| 84|#define PARAM_N1 90 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) ------------------ memcpy(cdw_bytes + PARAM_N1 - PARAM_K, msg_bytes, PARAM_K); ------------------ | | 44| 84|#define PARAM_K 32 ///< Define the size of the information bits of the Reed-Solomon code ------------------ memcpy(cdw_bytes + PARAM_N1 - PARAM_K, msg_bytes, PARAM_K); ------------------ | | 44| 84|#define PARAM_K 32 ///< Define the size of the information bits of the Reed-Solomon code ------------------ 111| 84| memcpy(cdw, cdw_bytes, PARAM_N1); ------------------ | | 16| 84|#define PARAM_N1 90 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) ------------------ 112| 84|} PQCHQC_HQC5_C_reed_solomon_decode: 353| 42|void reed_solomon_decode(uint64_t *msg, uint64_t *cdw) { 354| 42| uint8_t cdw_bytes[PARAM_N1] = {0}; 355| 42| uint16_t syndromes[2 * PARAM_DELTA] = {0}; 356| 42| uint16_t sigma[1 << PARAM_FFT] = {0}; 357| 42| uint8_t error[1 << PARAM_M] = {0}; 358| 42| uint16_t z[PARAM_N1] = {0}; 359| 42| uint16_t error_values[PARAM_N1] = {0}; 360| 42| uint16_t deg; 361| | 362| | // Copy the vector in an array of bytes 363| 42| memcpy(cdw_bytes, cdw, PARAM_N1); ------------------ | | 16| 42|#define PARAM_N1 90 ///< Define the parameter n1 of the scheme (length of Reed-Solomon code) ------------------ 364| | 365| | // Calculate the 2*PARAM_DELTA syndromes 366| 42| compute_syndromes(syndromes, cdw_bytes); 367| | 368| | // Compute the error locator polynomial sigma 369| | // Sigma's degree is at most PARAM_DELTA but the FFT requires the extra room 370| 42| deg = compute_elp(sigma, syndromes); 371| | 372| | // Compute the error polynomial error 373| 42| compute_roots(error, sigma); 374| | 375| | // Compute the polynomial z(x) 376| 42| compute_z_poly(z, sigma, deg, syndromes); 377| | 378| | // Compute the error values 379| 42| compute_error_values(error_values, z, error); 380| | 381| | // Correct the errors 382| 42| correct_errors(cdw_bytes, error_values); 383| | 384| | // Retrieve the message from the decoded codeword 385| 42| memcpy(msg, cdw_bytes + (PARAM_G - 1), PARAM_K); ------------------ | | 45| 42|#define PARAM_G 59 ///< Define the size of the generator polynomial of the Reed-Solomon code ------------------ memcpy(msg, cdw_bytes + (PARAM_G - 1), PARAM_K); ------------------ | | 44| 42|#define PARAM_K 32 ///< Define the size of the information bits of the Reed-Solomon code ------------------ 386| | 387| |#ifdef VERBOSE 388| | printf("\n\nThe syndromes: "); 389| | for (size_t i = 0; i < 2 * PARAM_DELTA; ++i) { 390| | printf("%u ", syndromes[i]); 391| | } 392| | printf("\n\nThe error locator polynomial: sigma(x) = "); 393| | bool first_coeff = true; 394| | if (sigma[0]) { 395| | printf("%u", sigma[0]); 396| | first_coeff = false; 397| | } 398| | for (size_t i = 1; i < (1 << PARAM_FFT); ++i) { 399| | if (sigma[i] == 0) 400| | continue; 401| | if (!first_coeff) 402| | printf(" + "); 403| | first_coeff = false; 404| | if (sigma[i] != 1) 405| | printf("%u ", sigma[i]); 406| | if (i == 1) 407| | printf("x"); 408| | else 409| | printf("x^%zu", i); 410| | } 411| | if (first_coeff) 412| | printf("0"); 413| | 414| | printf("\n\nThe polynomial: z(x) = "); 415| | bool first_coeff_1 = true; 416| | if (z[0]) { 417| | printf("%u", z[0]); 418| | first_coeff_1 = false; 419| | } 420| | for (size_t i = 1; i < (PARAM_DELTA + 1); ++i) { 421| | if (z[i] == 0) 422| | continue; 423| | if (!first_coeff_1) 424| | printf(" + "); 425| | first_coeff_1 = false; 426| | if (z[i] != 1) 427| | printf("%u ", z[i]); 428| | if (i == 1) 429| | printf("x"); 430| | else 431| | printf("x^%zu", i); 432| | } 433| | if (first_coeff_1) 434| | printf("0"); 435| | 436| | printf("\n\nThe pairs of (error locator numbers, error values): "); 437| | size_t j = 0; 438| | for (size_t i = 0; i < PARAM_N1; ++i) { 439| | if (error[i]) { 440| | printf("(%zu, %d) ", i, error_values[j]); 441| | j++; 442| | } 443| | } 444| | printf("\n"); 445| |#endif 446| | 447| | // Zeroize sensitive data 448| 42| memset_zero(cdw_bytes, sizeof cdw_bytes); ------------------ | | 22| 42|#define memset_zero(ptr, len) memset_volatile((ptr), 0, (len)) | | ------------------ | | | | 12| 42|#define memset_volatile PQCHQC_NAMESPACE(memset_volatile) | | | | ------------------ | | | | | | 17| 42|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | | | ------------------ | | | | | | | | 15| 42|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | | | ------------------ | | | | | | | | | | 14| 42|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 449| 42|} PQCHQC_HQC5_C_prng_get_bytes: 20| 126|void prng_get_bytes(uint8_t *output, uint32_t outlen) { 21| 126| OQS_randombytes(output, outlen); 22| 126|} PQCHQC_HQC5_C_xof_init: 70| 336|void xof_init(shake256_xof_ctx *xof_ctx, const uint8_t *seed, uint32_t seed_size) { 71| 336| uint8_t xof_domain = HQC_XOF_DOMAIN; ------------------ | | 50| 336|#define HQC_XOF_DOMAIN 1 ------------------ 72| 336| OQS_SHA3_shake256_inc_init(xof_ctx); 73| 336| OQS_SHA3_shake256_inc_absorb(xof_ctx, seed, seed_size); 74| 336| OQS_SHA3_shake256_inc_absorb(xof_ctx, &xof_domain, 1); 75| 336| OQS_SHA3_shake256_inc_finalize(xof_ctx); 76| 336|} PQCHQC_HQC5_C_xof_get_bytes: 89| 17.0k|void xof_get_bytes(shake256_xof_ctx *xof_ctx, uint8_t *output, uint32_t output_size) { 90| 17.0k| OQS_SHA3_shake256_inc_squeeze(output, output_size, xof_ctx); 91| 17.0k|} PQCHQC_HQC5_C_xof_ctx_release: 96| 336|void xof_ctx_release(shake256_xof_ctx *xof_ctx) { 97| 336| OQS_SHA3_shake256_inc_ctx_release(xof_ctx); 98| 336|} PQCHQC_HQC5_C_hash_i: 109| 42|void hash_i(uint8_t *output, const uint8_t *seed) { 110| 42| sha3_512_ctx i_hash_ctx = {0}; 111| 42| uint8_t i_domain = HQC_I_FCT_DOMAIN; ------------------ | | 65| 42|#define HQC_I_FCT_DOMAIN 2 ------------------ 112| 42| OQS_SHA3_sha3_512_inc_init(&i_hash_ctx); 113| 42| OQS_SHA3_sha3_512_inc_absorb(&i_hash_ctx, seed, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 114| 42| OQS_SHA3_sha3_512_inc_absorb(&i_hash_ctx, &i_domain, 1); 115| 42| OQS_SHA3_sha3_512_inc_finalize(output, &i_hash_ctx); 116| 42| OQS_SHA3_sha3_512_inc_ctx_release(&i_hash_ctx); 117| 42|} PQCHQC_HQC5_C_hash_h: 125| 84|void hash_h(uint8_t *output, const uint8_t ek_kem[PUBLIC_KEY_BYTES]) { 126| 84| sha3_256_ctx h_hash_ctx = {0}; 127| 84| uint8_t h_domain = HQC_H_FCT_DOMAIN; ------------------ | | 60| 84|#define HQC_H_FCT_DOMAIN 1 ------------------ 128| 84| OQS_SHA3_sha3_256_inc_init(&h_hash_ctx); 129| 84| OQS_SHA3_sha3_256_inc_absorb(&h_hash_ctx, ek_kem, PUBLIC_KEY_BYTES); ------------------ | | 27| 84|#define PUBLIC_KEY_BYTES CRYPTO_PUBLICKEYBYTES ///< Define the size of the public key in bytes | | ------------------ | | | | 12| 84|#define CRYPTO_PUBLICKEYBYTES 7237 | | ------------------ ------------------ 130| 84| OQS_SHA3_sha3_256_inc_absorb(&h_hash_ctx, &h_domain, 1); 131| 84| OQS_SHA3_sha3_256_inc_finalize(output, &h_hash_ctx); 132| 84| OQS_SHA3_sha3_256_inc_ctx_release(&h_hash_ctx); 133| 84|} PQCHQC_HQC5_C_hash_g: 144| 84| const uint8_t salt[SALT_BYTES]) { 145| 84| sha3_512_ctx g_hash_ctx = {0}; 146| 84| uint8_t i_domain = HQC_G_FCT_DOMAIN; ------------------ | | 55| 84|#define HQC_G_FCT_DOMAIN 0 ------------------ 147| 84| OQS_SHA3_sha3_512_inc_init(&g_hash_ctx); 148| 84| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, hash_ek_kem, SEED_BYTES); ------------------ | | 52| 84|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 149| 84| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, m, PARAM_SECURITY_BYTES); ------------------ | | 23| 84|#define PARAM_SECURITY_BYTES 32 ///< Define the security level in bytes ------------------ 150| 84| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, salt, SALT_BYTES); ------------------ | | 53| 84|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 151| 84| OQS_SHA3_sha3_512_inc_absorb(&g_hash_ctx, &i_domain, 1); 152| 84| OQS_SHA3_sha3_512_inc_finalize(output, &g_hash_ctx); 153| 84| OQS_SHA3_sha3_512_inc_ctx_release(&g_hash_ctx); 154| 84|} PQCHQC_HQC5_C_hash_j: 165| 42| const ciphertext_kem_t *c_kem) { 166| 42| sha3_256_ctx k_hash_ctx = {0}; 167| 42| uint8_t k_domain = HQC_J_FCT_DOMAIN; ------------------ | | 70| 42|#define HQC_J_FCT_DOMAIN 3 ------------------ 168| 42| OQS_SHA3_sha3_256_inc_init(&k_hash_ctx); 169| 42| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, hash_ek_kem, SEED_BYTES); ------------------ | | 52| 42|#define SEED_BYTES 32 ///< Define the size of the seed in bytes ------------------ 170| 42| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, sigma, PARAM_SECURITY_BYTES); ------------------ | | 23| 42|#define PARAM_SECURITY_BYTES 32 ///< Define the security level in bytes ------------------ 171| 42| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, (uint8_t *)c_kem->c_pke.u, VEC_N_SIZE_BYTES); ------------------ | | 31| 42|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 42] | | | | ------------------ | | ------------------ ------------------ 172| 42| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, (uint8_t *)c_kem->c_pke.v, VEC_N1N2_SIZE_BYTES); ------------------ | | 34| 42|#define VEC_N1N2_SIZE_BYTES CEIL_DIVIDE(PARAM_N1N2, 8) ///< Size of array to store PARAM_N1N2 bits in bytes | | ------------------ | | | | 12| 42|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [True: 42, Folded] | | | | ------------------ | | ------------------ ------------------ 173| 42| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, c_kem->salt, SALT_BYTES); ------------------ | | 53| 42|#define SALT_BYTES 16 ///< Define the size of a salt in bytes ------------------ 174| 42| OQS_SHA3_sha3_256_inc_absorb(&k_hash_ctx, &k_domain, 1); 175| 42| OQS_SHA3_sha3_256_inc_finalize(output, &k_hash_ctx); 176| 42| OQS_SHA3_sha3_256_inc_ctx_release(&k_hash_ctx); 177| 42|} PQCHQC_HQC5_C_vect_generate_random_support1: 62| 126|void vect_generate_random_support1(shake256_xof_ctx *ctx, uint32_t *support, uint16_t weight) { 63| 126| uint8_t rand_bytes[3] = {0}; 64| 126| uint32_t candidate = 0; 65| | 66| 16.7k| for (size_t i = 0; i < weight;) { ------------------ | Branch (66:24): [True: 16.5k, False: 126] ------------------ 67| 16.5k| xof_get_bytes(ctx, rand_bytes, 3); ------------------ | | 75| 16.5k|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 16.5k|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 16.5k|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 16.5k|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 68| 16.5k| candidate = rand_bytes[0] | (rand_bytes[1] << 8) | (rand_bytes[2] << 16); 69| | 70| 16.5k| if (candidate >= UTILS_REJECTION_THRESHOLD) { ------------------ | | 56| 16.5k|#define UTILS_REJECTION_THRESHOLD 16772367 ///< Rejection threshold for uniform sampling in [0, PARAM_N) ------------------ | Branch (70:13): [True: 21, False: 16.5k] ------------------ 71| 21| continue; 72| 21| } 73| 16.5k| candidate = barrett_reduce(candidate); 74| | 75| 16.5k| int is_position_available = 1; 76| 1.09M| for (size_t j = 0; j < i; j++) { ------------------ | Branch (76:28): [True: 1.07M, False: 16.5k] ------------------ 77| 1.07M| if (candidate == support[j]) { ------------------ | Branch (77:17): [True: 47, False: 1.07M] ------------------ 78| 47| is_position_available = 0; 79| 47| break; 80| 47| } 81| 1.07M| } 82| | 83| 16.5k| if (is_position_available == 1) { ------------------ | Branch (83:13): [True: 16.5k, False: 47] ------------------ 84| 16.5k| support[i] = candidate; 85| 16.5k| i++; 86| 16.5k| } 87| 16.5k| } 88| 126|} PQCHQC_HQC5_C_vect_generate_random_support2: 99| 252|void vect_generate_random_support2(shake256_xof_ctx *ctx, uint32_t *support, uint16_t weight) { 100| 252| uint32_t rand_u32[PARAM_OMEGA_R] = {0}; 101| | 102| 252| xof_get_bytes(ctx, (uint8_t *)&rand_u32, 4 * weight); ------------------ | | 75| 252|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 252|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 252|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 252|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 103| | 104| 37.8k| for (size_t i = 0; i < weight; ++i) { ------------------ | Branch (104:24): [True: 37.5k, False: 252] ------------------ 105| 37.5k| uint64_t buff = rand_u32[i]; 106| 37.5k| support[i] = i + ((buff * (PARAM_N - i)) >> 32); ------------------ | | 15| 37.5k|#define PARAM_N 57637 ///< Define the parameter n of the scheme ------------------ 107| 37.5k| } 108| | 109| 37.5k| for (int32_t i = (weight - 1); i-- > 0;) { ------------------ | Branch (109:36): [True: 37.2k, False: 252] ------------------ 110| 37.2k| uint32_t found = 0; 111| | 112| 2.81M| for (size_t j = i + 1; j < weight; ++j) { ------------------ | Branch (112:32): [True: 2.77M, False: 37.2k] ------------------ 113| 2.77M| found |= compare_u32(support[j], support[i]); 114| 2.77M| } 115| | 116| 37.2k| uint32_t mask = -found; 117| 37.2k| support[i] = (mask & i) ^ (~mask & support[i]); 118| 37.2k| } 119| 252|} PQCHQC_HQC5_C_vect_write_support_to_vector: 131| 378|void vect_write_support_to_vector(uint64_t *v, uint32_t *support, uint16_t weight) { 132| 378| uint32_t index_tab[PARAM_OMEGA_R] = {0}; 133| 378| uint64_t bit_tab[PARAM_OMEGA_R] = {0}; 134| | 135| 54.4k| for (size_t i = 0; i < weight; i++) { ------------------ | Branch (135:24): [True: 54.0k, False: 378] ------------------ 136| 54.0k| index_tab[i] = support[i] >> 6; 137| 54.0k| int32_t pos = support[i] & 0x3f; 138| 54.0k| bit_tab[i] = ((uint64_t)1) << pos; 139| 54.0k| } 140| | 141| 378| uint64_t val = 0; 142| 340k| for (uint32_t i = 0; i < VEC_N_SIZE_64; i++) { ------------------ | | 36| 340k|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 340k|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 340k] | | | | ------------------ | | ------------------ ------------------ | Branch (142:26): [True: 340k, False: 378] ------------------ 143| 340k| val = 0; 144| 49.0M| for (uint32_t j = 0; j < weight; j++) { ------------------ | Branch (144:30): [True: 48.7M, False: 340k] ------------------ 145| 48.7M| uint32_t tmp = i - index_tab[j]; 146| 48.7M| int val1 = 1 ^ ((tmp | -tmp) >> 31); 147| 48.7M| uint64_t mask = -val1; 148| 48.7M| val |= (bit_tab[j] & mask); 149| 48.7M| } 150| 340k| v[i] |= val; 151| 340k| } 152| 378|} PQCHQC_HQC5_C_vect_sample_fixed_weight1: 169| 126|void vect_sample_fixed_weight1(shake256_xof_ctx *ctx, uint64_t *v, uint16_t weight) { 170| 126| uint32_t support[PARAM_OMEGA_R] = {0}; 171| 126| vect_generate_random_support1(ctx, support, weight); ------------------ | | 13| 126|#define vect_generate_random_support1 PQCHQC_NAMESPACE(vect_generate_random_support1) | | ------------------ | | | | 17| 126|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 126|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 126|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 172| 126| vect_write_support_to_vector(v, support, weight); ------------------ | | 15| 126|#define vect_write_support_to_vector PQCHQC_NAMESPACE(vect_write_support_to_vector) | | ------------------ | | | | 17| 126|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 126|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 126|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 173| 126|} PQCHQC_HQC5_C_vect_sample_fixed_weight2: 188| 252|void vect_sample_fixed_weight2(shake256_xof_ctx *ctx, uint64_t *v, uint16_t weight) { 189| 252| uint32_t support[PARAM_OMEGA_R] = {0}; 190| 252| vect_generate_random_support2(ctx, support, weight); ------------------ | | 14| 252|#define vect_generate_random_support2 PQCHQC_NAMESPACE(vect_generate_random_support2) | | ------------------ | | | | 17| 252|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 252|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 252|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 191| 252| vect_write_support_to_vector(v, support, weight); ------------------ | | 15| 252|#define vect_write_support_to_vector PQCHQC_NAMESPACE(vect_write_support_to_vector) | | ------------------ | | | | 17| 252|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 252|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 252|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 192| 252|} PQCHQC_HQC5_C_vect_set_random: 203| 126|void vect_set_random(shake256_xof_ctx *ctx, uint64_t *v) { 204| 126| xof_get_bytes(ctx, (uint8_t *)v, VEC_N_SIZE_BYTES); ------------------ | | 75| 126|#define xof_get_bytes PQCHQC_NAMESPACE(xof_get_bytes) | | ------------------ | | | | 17| 126|#define PQCHQC_NAMESPACE(name) PQCHQC_CONCAT(PQCHQC_NAMESPACE_PREFIX, name) | | | | ------------------ | | | | | | 15| 126|#define PQCHQC_CONCAT(lhs, rhs) PQCHQC_CONCAT_(lhs, rhs) | | | | | | ------------------ | | | | | | | | 14| 126|#define PQCHQC_CONCAT_(lhs, rhs) lhs##rhs | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ xof_get_bytes(ctx, (uint8_t *)v, VEC_N_SIZE_BYTES); ------------------ | | 31| 126|#define VEC_N_SIZE_BYTES CEIL_DIVIDE(PARAM_N, 8) ///< Size of array to store PARAM_N bits in bytes | | ------------------ | | | | 12| 126|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 126] | | | | ------------------ | | ------------------ ------------------ 205| 126| v[VEC_N_SIZE_64 - 1] &= BITMASK(PARAM_N, 64); ------------------ | | 36| 126|#define VEC_N_SIZE_64 CEIL_DIVIDE(PARAM_N, 64) ///< Size of array to store PARAM_N bits in 64-bit words | | ------------------ | | | | 12| 126|#define CEIL_DIVIDE(a, b) (((a) / (b)) + ((a) % (b) == 0 ? 0 : 1)) /*!< Divide a by b and ceil the result*/ | | | | ------------------ | | | | | Branch (12:43): [Folded, False: 126] | | | | ------------------ | | ------------------ ------------------ v[VEC_N_SIZE_64 - 1] &= BITMASK(PARAM_N, 64); ------------------ | | 13| 126|#define BITMASK(a, size) ((((uint64_t) 1UL) << (a % size)) - 1) /*!< Create a mask*/ ------------------ 206| 126|} PQCHQC_HQC5_C_vect_add: 216| 336|void vect_add(uint64_t *o, const uint64_t *v1, const uint64_t *v2, uint32_t size) { 217| 302k| for (uint32_t i = 0; i < size; ++i) { ------------------ | Branch (217:26): [True: 302k, False: 336] ------------------ 218| 302k| o[i] = v1[i] ^ v2[i]; 219| 302k| } 220| 336|} PQCHQC_HQC5_C_vect_compare: 233| 126|uint8_t vect_compare(const uint8_t *v1, const uint8_t *v2, uint32_t size) { 234| 126| uint16_t r = 0x0100; 235| | 236| 605k| for (size_t i = 0; i < size; i++) { ------------------ | Branch (236:24): [True: 605k, False: 126] ------------------ 237| 605k| r |= v1[i] ^ v2[i]; 238| 605k| } 239| | 240| 126| return (r - 1) >> 8; 241| 126|} PQCHQC_HQC5_C_vect_truncate: 249| 126|void vect_truncate(uint64_t *v) { 250| 126| size_t orig_words = (PARAM_N + 63) / 64; ------------------ | | 15| 126|#define PARAM_N 57637 ///< Define the parameter n of the scheme ------------------ 251| 126| size_t new_full_words = PARAM_N1N2 / 64; ------------------ | | 18| 126|#define PARAM_N1N2 57600 ///< Define the length in bits of the concatenated code ------------------ 252| 126| size_t remaining_bits = PARAM_N1N2 % 64; ------------------ | | 18| 126|#define PARAM_N1N2 57600 ///< Define the length in bits of the concatenated code ------------------ 253| | 254| | // Mask the last word if there's a partial word 255| 126| if (remaining_bits > 0) { ------------------ | Branch (255:9): [True: 0, False: 126] ------------------ 256| 0| uint64_t mask = (UINT64_C(1) << remaining_bits) - 1; 257| 0| v[new_full_words] &= mask; 258| 0| new_full_words++; // keep that partial word 259| 0| } 260| | 261| | // Zero out all subsequent words up to the original length 262| 252| for (size_t i = new_full_words; i < orig_words; i++) { ------------------ | Branch (262:37): [True: 126, False: 126] ------------------ 263| 126| v[i] = 0; 264| 126| } 265| 126|} OQS_KEM_alg_identifier: 14| 1.87k|OQS_API const char *OQS_KEM_alg_identifier(size_t i) { 15| | // EDIT-WHEN-ADDING-KEM 16| 1.87k| const char *a[OQS_KEM_algs_length] = { 17| 1.87k| OQS_KEM_alg_bike_l1, ------------------ | | 35| 1.87k|#define OQS_KEM_alg_bike_l1 "BIKE-L1" ------------------ 18| 1.87k| OQS_KEM_alg_bike_l3, ------------------ | | 37| 1.87k|#define OQS_KEM_alg_bike_l3 "BIKE-L3" ------------------ 19| 1.87k| OQS_KEM_alg_bike_l5, ------------------ | | 39| 1.87k|#define OQS_KEM_alg_bike_l5 "BIKE-L5" ------------------ 20| | ///// OQS_COPY_FROM_UPSTREAM_FRAGMENT_ALG_IDENTIFIER_START 21| 1.87k| OQS_KEM_alg_classic_mceliece_348864, ------------------ | | 42| 1.87k|#define OQS_KEM_alg_classic_mceliece_348864 "Classic-McEliece-348864" ------------------ 22| 1.87k| OQS_KEM_alg_classic_mceliece_348864f, ------------------ | | 44| 1.87k|#define OQS_KEM_alg_classic_mceliece_348864f "Classic-McEliece-348864f" ------------------ 23| 1.87k| OQS_KEM_alg_classic_mceliece_460896, ------------------ | | 46| 1.87k|#define OQS_KEM_alg_classic_mceliece_460896 "Classic-McEliece-460896" ------------------ 24| 1.87k| OQS_KEM_alg_classic_mceliece_460896f, ------------------ | | 48| 1.87k|#define OQS_KEM_alg_classic_mceliece_460896f "Classic-McEliece-460896f" ------------------ 25| 1.87k| OQS_KEM_alg_classic_mceliece_6688128, ------------------ | | 50| 1.87k|#define OQS_KEM_alg_classic_mceliece_6688128 "Classic-McEliece-6688128" ------------------ 26| 1.87k| OQS_KEM_alg_classic_mceliece_6688128f, ------------------ | | 52| 1.87k|#define OQS_KEM_alg_classic_mceliece_6688128f "Classic-McEliece-6688128f" ------------------ 27| 1.87k| OQS_KEM_alg_classic_mceliece_6960119, ------------------ | | 54| 1.87k|#define OQS_KEM_alg_classic_mceliece_6960119 "Classic-McEliece-6960119" ------------------ 28| 1.87k| OQS_KEM_alg_classic_mceliece_6960119f, ------------------ | | 56| 1.87k|#define OQS_KEM_alg_classic_mceliece_6960119f "Classic-McEliece-6960119f" ------------------ 29| 1.87k| OQS_KEM_alg_classic_mceliece_8192128, ------------------ | | 58| 1.87k|#define OQS_KEM_alg_classic_mceliece_8192128 "Classic-McEliece-8192128" ------------------ 30| 1.87k| OQS_KEM_alg_classic_mceliece_8192128f, ------------------ | | 60| 1.87k|#define OQS_KEM_alg_classic_mceliece_8192128f "Classic-McEliece-8192128f" ------------------ 31| 1.87k| OQS_KEM_alg_hqc_1, ------------------ | | 62| 1.87k|#define OQS_KEM_alg_hqc_1 "HQC-1" ------------------ 32| 1.87k| OQS_KEM_alg_hqc_3, ------------------ | | 64| 1.87k|#define OQS_KEM_alg_hqc_3 "HQC-3" ------------------ 33| 1.87k| OQS_KEM_alg_hqc_5, ------------------ | | 66| 1.87k|#define OQS_KEM_alg_hqc_5 "HQC-5" ------------------ 34| 1.87k| OQS_KEM_alg_kyber_512, ------------------ | | 68| 1.87k|#define OQS_KEM_alg_kyber_512 "Kyber512" ------------------ 35| 1.87k| OQS_KEM_alg_kyber_768, ------------------ | | 70| 1.87k|#define OQS_KEM_alg_kyber_768 "Kyber768" ------------------ 36| 1.87k| OQS_KEM_alg_kyber_1024, ------------------ | | 72| 1.87k|#define OQS_KEM_alg_kyber_1024 "Kyber1024" ------------------ 37| 1.87k| OQS_KEM_alg_ml_kem_512, ------------------ | | 74| 1.87k|#define OQS_KEM_alg_ml_kem_512 "ML-KEM-512" ------------------ 38| 1.87k| OQS_KEM_alg_ml_kem_768, ------------------ | | 76| 1.87k|#define OQS_KEM_alg_ml_kem_768 "ML-KEM-768" ------------------ 39| 1.87k| OQS_KEM_alg_ml_kem_1024, ------------------ | | 78| 1.87k|#define OQS_KEM_alg_ml_kem_1024 "ML-KEM-1024" ------------------ 40| | ///// OQS_COPY_FROM_UPSTREAM_FRAGMENT_ALG_IDENTIFIER_END 41| 1.87k| OQS_KEM_alg_ntru_hps2048509, ------------------ | | 81| 1.87k|#define OQS_KEM_alg_ntru_hps2048509 "NTRU-HPS-2048-509" ------------------ 42| 1.87k| OQS_KEM_alg_ntru_hps2048677, ------------------ | | 83| 1.87k|#define OQS_KEM_alg_ntru_hps2048677 "NTRU-HPS-2048-677" ------------------ 43| 1.87k| OQS_KEM_alg_ntru_hps4096821, ------------------ | | 85| 1.87k|#define OQS_KEM_alg_ntru_hps4096821 "NTRU-HPS-4096-821" ------------------ 44| 1.87k| OQS_KEM_alg_ntru_hps40961229, ------------------ | | 87| 1.87k|#define OQS_KEM_alg_ntru_hps40961229 "NTRU-HPS-4096-1229" ------------------ 45| 1.87k| OQS_KEM_alg_ntru_hrss701, ------------------ | | 89| 1.87k|#define OQS_KEM_alg_ntru_hrss701 "NTRU-HRSS-701" ------------------ 46| 1.87k| OQS_KEM_alg_ntru_hrss1373, ------------------ | | 91| 1.87k|#define OQS_KEM_alg_ntru_hrss1373 "NTRU-HRSS-1373" ------------------ 47| 1.87k| OQS_KEM_alg_ntruprime_sntrup761, ------------------ | | 93| 1.87k|#define OQS_KEM_alg_ntruprime_sntrup761 "sntrup761" ------------------ 48| 1.87k| OQS_KEM_alg_frodokem_640_aes, ------------------ | | 95| 1.87k|#define OQS_KEM_alg_frodokem_640_aes "FrodoKEM-640-AES" ------------------ 49| 1.87k| OQS_KEM_alg_frodokem_640_shake, ------------------ | | 97| 1.87k|#define OQS_KEM_alg_frodokem_640_shake "FrodoKEM-640-SHAKE" ------------------ 50| 1.87k| OQS_KEM_alg_frodokem_976_aes, ------------------ | | 99| 1.87k|#define OQS_KEM_alg_frodokem_976_aes "FrodoKEM-976-AES" ------------------ 51| 1.87k| OQS_KEM_alg_frodokem_976_shake, ------------------ | | 101| 1.87k|#define OQS_KEM_alg_frodokem_976_shake "FrodoKEM-976-SHAKE" ------------------ 52| 1.87k| OQS_KEM_alg_frodokem_1344_aes, ------------------ | | 103| 1.87k|#define OQS_KEM_alg_frodokem_1344_aes "FrodoKEM-1344-AES" ------------------ 53| 1.87k| OQS_KEM_alg_frodokem_1344_shake, ------------------ | | 105| 1.87k|#define OQS_KEM_alg_frodokem_1344_shake "FrodoKEM-1344-SHAKE" ------------------ 54| 1.87k| OQS_KEM_alg_efrodokem_640_aes, ------------------ | | 107| 1.87k|#define OQS_KEM_alg_efrodokem_640_aes "eFrodoKEM-640-AES" ------------------ 55| 1.87k| OQS_KEM_alg_efrodokem_640_shake, ------------------ | | 109| 1.87k|#define OQS_KEM_alg_efrodokem_640_shake "eFrodoKEM-640-SHAKE" ------------------ 56| 1.87k| OQS_KEM_alg_efrodokem_976_aes, ------------------ | | 111| 1.87k|#define OQS_KEM_alg_efrodokem_976_aes "eFrodoKEM-976-AES" ------------------ 57| 1.87k| OQS_KEM_alg_efrodokem_976_shake, ------------------ | | 113| 1.87k|#define OQS_KEM_alg_efrodokem_976_shake "eFrodoKEM-976-SHAKE" ------------------ 58| 1.87k| OQS_KEM_alg_efrodokem_1344_aes, ------------------ | | 115| 1.87k|#define OQS_KEM_alg_efrodokem_1344_aes "eFrodoKEM-1344-AES" ------------------ 59| 1.87k| OQS_KEM_alg_efrodokem_1344_shake, ------------------ | | 117| 1.87k|#define OQS_KEM_alg_efrodokem_1344_shake "eFrodoKEM-1344-SHAKE" ------------------ 60| 1.87k| }; 61| 1.87k| if (i >= OQS_KEM_algs_length) { ------------------ | | 122| 1.87k|#define OQS_KEM_algs_length 41 ------------------ | Branch (61:6): [True: 0, False: 1.87k] ------------------ 62| 0| return NULL; 63| 1.87k| } else { 64| 1.87k| return a[i]; 65| 1.87k| } 66| 1.87k|} OQS_KEM_new: 348| 1.87k|OQS_API OQS_KEM *OQS_KEM_new(const char *method_name) { 349| 1.87k| if (method_name == NULL) { ------------------ | Branch (349:6): [True: 0, False: 1.87k] ------------------ 350| 0| return NULL; 351| 0| } 352| 1.87k| if (0 == strcasecmp(method_name, OQS_KEM_alg_bike_l1)) { ------------------ | | 35| 1.87k|#define OQS_KEM_alg_bike_l1 "BIKE-L1" ------------------ | Branch (352:6): [True: 5, False: 1.86k] ------------------ 353| 5|#ifdef OQS_ENABLE_KEM_bike_l1 354| 5| return OQS_KEM_bike_l1_new(); 355| |#else 356| | return NULL; 357| |#endif 358| 1.86k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_bike_l3)) { ------------------ | | 37| 1.86k|#define OQS_KEM_alg_bike_l3 "BIKE-L3" ------------------ | Branch (358:13): [True: 1, False: 1.86k] ------------------ 359| 1|#ifdef OQS_ENABLE_KEM_bike_l3 360| 1| return OQS_KEM_bike_l3_new(); 361| |#else 362| | return NULL; 363| |#endif 364| 1.86k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_bike_l5)) { ------------------ | | 39| 1.86k|#define OQS_KEM_alg_bike_l5 "BIKE-L5" ------------------ | Branch (364:13): [True: 1, False: 1.86k] ------------------ 365| 1|#ifdef OQS_ENABLE_KEM_bike_l5 366| 1| return OQS_KEM_bike_l5_new(); 367| |#else 368| | return NULL; 369| |#endif 370| | ///// OQS_COPY_FROM_UPSTREAM_FRAGMENT_NEW_CASE_START 371| 1.86k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_classic_mceliece_348864)) { ------------------ | | 42| 1.86k|#define OQS_KEM_alg_classic_mceliece_348864 "Classic-McEliece-348864" ------------------ | Branch (371:13): [True: 102, False: 1.76k] ------------------ 372| 102|#ifdef OQS_ENABLE_KEM_classic_mceliece_348864 373| 102| return OQS_KEM_classic_mceliece_348864_new(); 374| |#else 375| | return NULL; 376| |#endif 377| | 378| 1.76k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_classic_mceliece_348864f)) { ------------------ | | 44| 1.76k|#define OQS_KEM_alg_classic_mceliece_348864f "Classic-McEliece-348864f" ------------------ | Branch (378:13): [True: 78, False: 1.68k] ------------------ 379| 78|#ifdef OQS_ENABLE_KEM_classic_mceliece_348864f 380| 78| return OQS_KEM_classic_mceliece_348864f_new(); 381| |#else 382| | return NULL; 383| |#endif 384| | 385| 1.68k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_classic_mceliece_460896)) { ------------------ | | 46| 1.68k|#define OQS_KEM_alg_classic_mceliece_460896 "Classic-McEliece-460896" ------------------ | Branch (385:13): [True: 116, False: 1.57k] ------------------ 386| 116|#ifdef OQS_ENABLE_KEM_classic_mceliece_460896 387| 116| return OQS_KEM_classic_mceliece_460896_new(); 388| |#else 389| | return NULL; 390| |#endif 391| | 392| 1.57k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_classic_mceliece_460896f)) { ------------------ | | 48| 1.57k|#define OQS_KEM_alg_classic_mceliece_460896f "Classic-McEliece-460896f" ------------------ | Branch (392:13): [True: 92, False: 1.47k] ------------------ 393| 92|#ifdef OQS_ENABLE_KEM_classic_mceliece_460896f 394| 92| return OQS_KEM_classic_mceliece_460896f_new(); 395| |#else 396| | return NULL; 397| |#endif 398| | 399| 1.47k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_classic_mceliece_6688128)) { ------------------ | | 50| 1.47k|#define OQS_KEM_alg_classic_mceliece_6688128 "Classic-McEliece-6688128" ------------------ | Branch (399:13): [True: 102, False: 1.37k] ------------------ 400| 102|#ifdef OQS_ENABLE_KEM_classic_mceliece_6688128 401| 102| return OQS_KEM_classic_mceliece_6688128_new(); 402| |#else 403| | return NULL; 404| |#endif 405| | 406| 1.37k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_classic_mceliece_6688128f)) { ------------------ | | 52| 1.37k|#define OQS_KEM_alg_classic_mceliece_6688128f "Classic-McEliece-6688128f" ------------------ | Branch (406:13): [True: 90, False: 1.28k] ------------------ 407| 90|#ifdef OQS_ENABLE_KEM_classic_mceliece_6688128f 408| 90| return OQS_KEM_classic_mceliece_6688128f_new(); 409| |#else 410| | return NULL; 411| |#endif 412| | 413| 1.28k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_classic_mceliece_6960119)) { ------------------ | | 54| 1.28k|#define OQS_KEM_alg_classic_mceliece_6960119 "Classic-McEliece-6960119" ------------------ | Branch (413:13): [True: 114, False: 1.17k] ------------------ 414| 114|#ifdef OQS_ENABLE_KEM_classic_mceliece_6960119 415| 114| return OQS_KEM_classic_mceliece_6960119_new(); 416| |#else 417| | return NULL; 418| |#endif 419| | 420| 1.17k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_classic_mceliece_6960119f)) { ------------------ | | 56| 1.17k|#define OQS_KEM_alg_classic_mceliece_6960119f "Classic-McEliece-6960119f" ------------------ | Branch (420:13): [True: 88, False: 1.08k] ------------------ 421| 88|#ifdef OQS_ENABLE_KEM_classic_mceliece_6960119f 422| 88| return OQS_KEM_classic_mceliece_6960119f_new(); 423| |#else 424| | return NULL; 425| |#endif 426| | 427| 1.08k| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_classic_mceliece_8192128)) { ------------------ | | 58| 1.08k|#define OQS_KEM_alg_classic_mceliece_8192128 "Classic-McEliece-8192128" ------------------ | Branch (427:13): [True: 88, False: 996] ------------------ 428| 88|#ifdef OQS_ENABLE_KEM_classic_mceliece_8192128 429| 88| return OQS_KEM_classic_mceliece_8192128_new(); 430| |#else 431| | return NULL; 432| |#endif 433| | 434| 996| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_classic_mceliece_8192128f)) { ------------------ | | 60| 996|#define OQS_KEM_alg_classic_mceliece_8192128f "Classic-McEliece-8192128f" ------------------ | Branch (434:13): [True: 66, False: 930] ------------------ 435| 66|#ifdef OQS_ENABLE_KEM_classic_mceliece_8192128f 436| 66| return OQS_KEM_classic_mceliece_8192128f_new(); 437| |#else 438| | return NULL; 439| |#endif 440| | 441| 930| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_hqc_1)) { ------------------ | | 62| 930|#define OQS_KEM_alg_hqc_1 "HQC-1" ------------------ | Branch (441:13): [True: 38, False: 892] ------------------ 442| 38|#ifdef OQS_ENABLE_KEM_hqc_1 443| 38| return OQS_KEM_hqc_1_new(); 444| |#else 445| | return NULL; 446| |#endif 447| | 448| 892| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_hqc_3)) { ------------------ | | 64| 892|#define OQS_KEM_alg_hqc_3 "HQC-3" ------------------ | Branch (448:13): [True: 42, False: 850] ------------------ 449| 42|#ifdef OQS_ENABLE_KEM_hqc_3 450| 42| return OQS_KEM_hqc_3_new(); 451| |#else 452| | return NULL; 453| |#endif 454| | 455| 850| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_hqc_5)) { ------------------ | | 66| 850|#define OQS_KEM_alg_hqc_5 "HQC-5" ------------------ | Branch (455:13): [True: 42, False: 808] ------------------ 456| 42|#ifdef OQS_ENABLE_KEM_hqc_5 457| 42| return OQS_KEM_hqc_5_new(); 458| |#else 459| | return NULL; 460| |#endif 461| | 462| 808| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_kyber_512)) { ------------------ | | 68| 808|#define OQS_KEM_alg_kyber_512 "Kyber512" ------------------ | Branch (462:13): [True: 66, False: 742] ------------------ 463| 66|#ifdef OQS_ENABLE_KEM_kyber_512 464| 66| return OQS_KEM_kyber_512_new(); 465| |#else 466| | return NULL; 467| |#endif 468| | 469| 742| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_kyber_768)) { ------------------ | | 70| 742|#define OQS_KEM_alg_kyber_768 "Kyber768" ------------------ | Branch (469:13): [True: 133, False: 609] ------------------ 470| 133|#ifdef OQS_ENABLE_KEM_kyber_768 471| 133| return OQS_KEM_kyber_768_new(); 472| |#else 473| | return NULL; 474| |#endif 475| | 476| 609| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_kyber_1024)) { ------------------ | | 72| 609|#define OQS_KEM_alg_kyber_1024 "Kyber1024" ------------------ | Branch (476:13): [True: 89, False: 520] ------------------ 477| 89|#ifdef OQS_ENABLE_KEM_kyber_1024 478| 89| return OQS_KEM_kyber_1024_new(); 479| |#else 480| | return NULL; 481| |#endif 482| | 483| 520| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_ml_kem_512)) { ------------------ | | 74| 520|#define OQS_KEM_alg_ml_kem_512 "ML-KEM-512" ------------------ | Branch (483:13): [True: 28, False: 492] ------------------ 484| 28|#ifdef OQS_ENABLE_KEM_ml_kem_512 485| 28| return OQS_KEM_ml_kem_512_new(); 486| |#else 487| | return NULL; 488| |#endif 489| | 490| 492| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_ml_kem_768)) { ------------------ | | 76| 492|#define OQS_KEM_alg_ml_kem_768 "ML-KEM-768" ------------------ | Branch (490:13): [True: 30, False: 462] ------------------ 491| 30|#ifdef OQS_ENABLE_KEM_ml_kem_768 492| 30| return OQS_KEM_ml_kem_768_new(); 493| |#else 494| | return NULL; 495| |#endif 496| | 497| 462| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_ml_kem_1024)) { ------------------ | | 78| 462|#define OQS_KEM_alg_ml_kem_1024 "ML-KEM-1024" ------------------ | Branch (497:13): [True: 28, False: 434] ------------------ 498| 28|#ifdef OQS_ENABLE_KEM_ml_kem_1024 499| 28| return OQS_KEM_ml_kem_1024_new(); 500| |#else 501| | return NULL; 502| |#endif 503| | 504| | ///// OQS_COPY_FROM_UPSTREAM_FRAGMENT_NEW_CASE_END 505| 434| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_ntru_hps2048509)) { ------------------ | | 81| 434|#define OQS_KEM_alg_ntru_hps2048509 "NTRU-HPS-2048-509" ------------------ | Branch (505:13): [True: 191, False: 243] ------------------ 506| 191|#ifdef OQS_ENABLE_KEM_ntru_hps2048509 507| 191| return OQS_KEM_ntru_hps2048509_new(); 508| |#else 509| | return NULL; 510| |#endif 511| 243| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_ntru_hps2048677)) { ------------------ | | 83| 243|#define OQS_KEM_alg_ntru_hps2048677 "NTRU-HPS-2048-677" ------------------ | Branch (511:13): [True: 18, False: 225] ------------------ 512| 18|#ifdef OQS_ENABLE_KEM_ntru_hps2048677 513| 18| return OQS_KEM_ntru_hps2048677_new(); 514| |#else 515| | return NULL; 516| |#endif 517| 225| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_ntru_hps4096821)) { ------------------ | | 85| 225|#define OQS_KEM_alg_ntru_hps4096821 "NTRU-HPS-4096-821" ------------------ | Branch (517:13): [True: 95, False: 130] ------------------ 518| 95|#ifdef OQS_ENABLE_KEM_ntru_hps4096821 519| 95| return OQS_KEM_ntru_hps4096821_new(); 520| |#else 521| | return NULL; 522| |#endif 523| 130| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_ntru_hps40961229)) { ------------------ | | 87| 130|#define OQS_KEM_alg_ntru_hps40961229 "NTRU-HPS-4096-1229" ------------------ | Branch (523:13): [True: 33, False: 97] ------------------ 524| 33|#ifdef OQS_ENABLE_KEM_ntru_hps40961229 525| 33| return OQS_KEM_ntru_hps40961229_new(); 526| |#else 527| | return NULL; 528| |#endif 529| 97| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_ntru_hrss701)) { ------------------ | | 89| 97|#define OQS_KEM_alg_ntru_hrss701 "NTRU-HRSS-701" ------------------ | Branch (529:13): [True: 9, False: 88] ------------------ 530| 9|#ifdef OQS_ENABLE_KEM_ntru_hrss701 531| 9| return OQS_KEM_ntru_hrss701_new(); 532| |#else 533| | return NULL; 534| |#endif 535| 88| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_ntru_hrss1373)) { ------------------ | | 91| 88|#define OQS_KEM_alg_ntru_hrss1373 "NTRU-HRSS-1373" ------------------ | Branch (535:13): [True: 2, False: 86] ------------------ 536| 2|#ifdef OQS_ENABLE_KEM_ntru_hrss1373 537| 2| return OQS_KEM_ntru_hrss1373_new(); 538| |#else 539| | return NULL; 540| |#endif 541| 86| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_ntruprime_sntrup761)) { ------------------ | | 93| 86|#define OQS_KEM_alg_ntruprime_sntrup761 "sntrup761" ------------------ | Branch (541:13): [True: 11, False: 75] ------------------ 542| 11|#ifdef OQS_ENABLE_KEM_ntruprime_sntrup761 543| 11| return OQS_KEM_ntruprime_sntrup761_new(); 544| |#else 545| | return NULL; 546| |#endif 547| 75| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_frodokem_640_aes)) { ------------------ | | 95| 75|#define OQS_KEM_alg_frodokem_640_aes "FrodoKEM-640-AES" ------------------ | Branch (547:13): [True: 2, False: 73] ------------------ 548| 2|#ifdef OQS_ENABLE_KEM_frodokem_640_aes 549| 2| return OQS_KEM_frodokem_640_aes_new(); 550| |#else 551| | return NULL; 552| |#endif 553| 73| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_frodokem_640_shake)) { ------------------ | | 97| 73|#define OQS_KEM_alg_frodokem_640_shake "FrodoKEM-640-SHAKE" ------------------ | Branch (553:13): [True: 3, False: 70] ------------------ 554| 3|#ifdef OQS_ENABLE_KEM_frodokem_640_shake 555| 3| return OQS_KEM_frodokem_640_shake_new(); 556| |#else 557| | return NULL; 558| |#endif 559| 70| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_frodokem_976_aes)) { ------------------ | | 99| 70|#define OQS_KEM_alg_frodokem_976_aes "FrodoKEM-976-AES" ------------------ | Branch (559:13): [True: 9, False: 61] ------------------ 560| 9|#ifdef OQS_ENABLE_KEM_frodokem_976_aes 561| 9| return OQS_KEM_frodokem_976_aes_new(); 562| |#else 563| | return NULL; 564| |#endif 565| 61| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_frodokem_976_shake)) { ------------------ | | 101| 61|#define OQS_KEM_alg_frodokem_976_shake "FrodoKEM-976-SHAKE" ------------------ | Branch (565:13): [True: 9, False: 52] ------------------ 566| 9|#ifdef OQS_ENABLE_KEM_frodokem_976_shake 567| 9| return OQS_KEM_frodokem_976_shake_new(); 568| |#else 569| | return NULL; 570| |#endif 571| 52| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_frodokem_1344_aes)) { ------------------ | | 103| 52|#define OQS_KEM_alg_frodokem_1344_aes "FrodoKEM-1344-AES" ------------------ | Branch (571:13): [True: 7, False: 45] ------------------ 572| 7|#ifdef OQS_ENABLE_KEM_frodokem_1344_aes 573| 7| return OQS_KEM_frodokem_1344_aes_new(); 574| |#else 575| | return NULL; 576| |#endif 577| 45| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_frodokem_1344_shake)) { ------------------ | | 105| 45|#define OQS_KEM_alg_frodokem_1344_shake "FrodoKEM-1344-SHAKE" ------------------ | Branch (577:13): [True: 6, False: 39] ------------------ 578| 6|#ifdef OQS_ENABLE_KEM_frodokem_1344_shake 579| 6| return OQS_KEM_frodokem_1344_shake_new(); 580| |#else 581| | return NULL; 582| |#endif 583| 39| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_efrodokem_640_aes)) { ------------------ | | 107| 39|#define OQS_KEM_alg_efrodokem_640_aes "eFrodoKEM-640-AES" ------------------ | Branch (583:13): [True: 4, False: 35] ------------------ 584| 4|#ifdef OQS_ENABLE_KEM_efrodokem_640_aes 585| 4| return OQS_KEM_efrodokem_640_aes_new(); 586| |#else 587| | return NULL; 588| |#endif 589| 35| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_efrodokem_640_shake)) { ------------------ | | 109| 35|#define OQS_KEM_alg_efrodokem_640_shake "eFrodoKEM-640-SHAKE" ------------------ | Branch (589:13): [True: 2, False: 33] ------------------ 590| 2|#ifdef OQS_ENABLE_KEM_efrodokem_640_shake 591| 2| return OQS_KEM_efrodokem_640_shake_new(); 592| |#else 593| | return NULL; 594| |#endif 595| 33| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_efrodokem_976_aes)) { ------------------ | | 111| 33|#define OQS_KEM_alg_efrodokem_976_aes "eFrodoKEM-976-AES" ------------------ | Branch (595:13): [True: 9, False: 24] ------------------ 596| 9|#ifdef OQS_ENABLE_KEM_efrodokem_976_aes 597| 9| return OQS_KEM_efrodokem_976_aes_new(); 598| |#else 599| | return NULL; 600| |#endif 601| 24| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_efrodokem_976_shake)) { ------------------ | | 113| 24|#define OQS_KEM_alg_efrodokem_976_shake "eFrodoKEM-976-SHAKE" ------------------ | Branch (601:13): [True: 8, False: 16] ------------------ 602| 8|#ifdef OQS_ENABLE_KEM_efrodokem_976_shake 603| 8| return OQS_KEM_efrodokem_976_shake_new(); 604| |#else 605| | return NULL; 606| |#endif 607| 16| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_efrodokem_1344_aes)) { ------------------ | | 115| 16|#define OQS_KEM_alg_efrodokem_1344_aes "eFrodoKEM-1344-AES" ------------------ | Branch (607:13): [True: 9, False: 7] ------------------ 608| 9|#ifdef OQS_ENABLE_KEM_efrodokem_1344_aes 609| 9| return OQS_KEM_efrodokem_1344_aes_new(); 610| |#else 611| | return NULL; 612| |#endif 613| 9| } else if (0 == strcasecmp(method_name, OQS_KEM_alg_efrodokem_1344_shake)) { ------------------ | | 117| 7|#define OQS_KEM_alg_efrodokem_1344_shake "eFrodoKEM-1344-SHAKE" ------------------ | Branch (613:13): [True: 7, False: 0] ------------------ 614| 7|#ifdef OQS_ENABLE_KEM_efrodokem_1344_shake 615| 7| return OQS_KEM_efrodokem_1344_shake_new(); 616| |#else 617| | return NULL; 618| |#endif 619| | // EDIT-WHEN-ADDING-KEM 620| 7| } else { 621| | return NULL; 622| 0| } 623| 1.87k|} OQS_KEM_keypair: 633| 1.87k|OQS_API OQS_STATUS OQS_KEM_keypair(const OQS_KEM *kem, uint8_t *public_key, uint8_t *secret_key) { 634| 1.87k| if (kem == NULL || kem->keypair == NULL) { ------------------ | Branch (634:6): [True: 0, False: 1.87k] | Branch (634:21): [True: 0, False: 1.87k] ------------------ 635| 0| return OQS_ERROR; 636| 1.87k| } else { 637| 1.87k| return kem->keypair(public_key, secret_key); 638| 1.87k| } 639| 1.87k|} OQS_KEM_encaps: 649| 1.87k|OQS_API OQS_STATUS OQS_KEM_encaps(const OQS_KEM *kem, uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 650| 1.87k| if (kem == NULL || kem->encaps == NULL) { ------------------ | Branch (650:6): [True: 0, False: 1.87k] | Branch (650:21): [True: 0, False: 1.87k] ------------------ 651| 0| return OQS_ERROR; 652| 1.87k| } else { 653| 1.87k| return kem->encaps(ciphertext, shared_secret, public_key); 654| 1.87k| } 655| 1.87k|} OQS_KEM_decaps: 657| 1.87k|OQS_API OQS_STATUS OQS_KEM_decaps(const OQS_KEM *kem, uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 658| 1.87k| if (kem == NULL || kem->decaps == NULL) { ------------------ | Branch (658:6): [True: 0, False: 1.87k] | Branch (658:21): [True: 0, False: 1.87k] ------------------ 659| 0| return OQS_ERROR; 660| 1.87k| } else { 661| 1.87k| return kem->decaps(shared_secret, ciphertext, secret_key); 662| 1.87k| } 663| 1.87k|} OQS_KEM_free: 665| 1.87k|OQS_API void OQS_KEM_free(OQS_KEM *kem) { 666| 1.87k| OQS_MEM_insecure_free(kem); 667| 1.87k|} OQS_KEM_kyber_1024_new: 9| 89|OQS_KEM *OQS_KEM_kyber_1024_new(void) { 10| | 11| 89| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 89| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 89] ------------------ 13| 0| return NULL; 14| 0| } 15| 89| kem->method_name = OQS_KEM_alg_kyber_1024; ------------------ | | 72| 89|#define OQS_KEM_alg_kyber_1024 "Kyber1024" ------------------ 16| 89| kem->alg_version = "https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ff"; 17| | 18| 89| kem->claimed_nist_level = 5; 19| 89| kem->ind_cca = true; 20| | 21| 89| kem->length_public_key = OQS_KEM_kyber_1024_length_public_key; ------------------ | | 39| 89|#define OQS_KEM_kyber_1024_length_public_key 1568 ------------------ 22| 89| kem->length_secret_key = OQS_KEM_kyber_1024_length_secret_key; ------------------ | | 40| 89|#define OQS_KEM_kyber_1024_length_secret_key 3168 ------------------ 23| 89| kem->length_ciphertext = OQS_KEM_kyber_1024_length_ciphertext; ------------------ | | 41| 89|#define OQS_KEM_kyber_1024_length_ciphertext 1568 ------------------ 24| 89| kem->length_shared_secret = OQS_KEM_kyber_1024_length_shared_secret; ------------------ | | 42| 89|#define OQS_KEM_kyber_1024_length_shared_secret 32 ------------------ 25| 89| kem->length_keypair_seed = OQS_KEM_kyber_1024_length_keypair_seed; ------------------ | | 43| 89|#define OQS_KEM_kyber_1024_length_keypair_seed 0 ------------------ 26| 89| kem->length_encaps_seed = OQS_KEM_kyber_1024_length_encaps_seed; ------------------ | | 44| 89|#define OQS_KEM_kyber_1024_length_encaps_seed 0 ------------------ 27| | 28| 89| kem->keypair = OQS_KEM_kyber_1024_keypair; 29| 89| kem->keypair_derand = OQS_KEM_kyber_1024_keypair_derand; 30| 89| kem->encaps = OQS_KEM_kyber_1024_encaps; 31| 89| kem->encaps_derand = OQS_KEM_kyber_1024_encaps_derand; 32| 89| kem->decaps = OQS_KEM_kyber_1024_decaps; 33| | 34| 89| return kem; 35| 89|} OQS_KEM_kyber_1024_keypair: 60| 89|OQS_API OQS_STATUS OQS_KEM_kyber_1024_keypair(uint8_t *public_key, uint8_t *secret_key) { 61| 89|#if defined(OQS_ENABLE_KEM_kyber_1024_avx2) 62| 89|#if defined(OQS_DIST_BUILD) 63| 89| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (63:6): [True: 89, False: 0] | Branch (63:49): [True: 89, False: 0] | Branch (63:92): [True: 89, False: 0] ------------------ 64| 89|#endif /* OQS_DIST_BUILD */ 65| 89| return (OQS_STATUS) pqcrystals_kyber1024_avx2_keypair(public_key, secret_key); 66| 89|#if defined(OQS_DIST_BUILD) 67| 89| } else { 68| 0| return (OQS_STATUS) pqcrystals_kyber1024_ref_keypair(public_key, secret_key); 69| 0| } 70| 89|#endif /* OQS_DIST_BUILD */ 71| |#elif defined(OQS_ENABLE_KEM_kyber_1024_aarch64) 72| |#if defined(OQS_DIST_BUILD) 73| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 74| |#endif /* OQS_DIST_BUILD */ 75| | return (OQS_STATUS) PQCLEAN_KYBER1024_AARCH64_crypto_kem_keypair(public_key, secret_key); 76| |#if defined(OQS_DIST_BUILD) 77| | } else { 78| | return (OQS_STATUS) pqcrystals_kyber1024_ref_keypair(public_key, secret_key); 79| | } 80| |#endif /* OQS_DIST_BUILD */ 81| |#else 82| | return (OQS_STATUS) pqcrystals_kyber1024_ref_keypair(public_key, secret_key); 83| |#endif 84| 89|} OQS_KEM_kyber_1024_encaps: 94| 89|OQS_API OQS_STATUS OQS_KEM_kyber_1024_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 95| 89|#if defined(OQS_ENABLE_KEM_kyber_1024_avx2) 96| 89|#if defined(OQS_DIST_BUILD) 97| 89| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (97:6): [True: 89, False: 0] | Branch (97:49): [True: 89, False: 0] | Branch (97:92): [True: 89, False: 0] ------------------ 98| 89|#endif /* OQS_DIST_BUILD */ 99| 89| return (OQS_STATUS) pqcrystals_kyber1024_avx2_enc(ciphertext, shared_secret, public_key); 100| 89|#if defined(OQS_DIST_BUILD) 101| 89| } else { 102| 0| return (OQS_STATUS) pqcrystals_kyber1024_ref_enc(ciphertext, shared_secret, public_key); 103| 0| } 104| 89|#endif /* OQS_DIST_BUILD */ 105| |#elif defined(OQS_ENABLE_KEM_kyber_1024_aarch64) 106| |#if defined(OQS_DIST_BUILD) 107| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 108| |#endif /* OQS_DIST_BUILD */ 109| | return (OQS_STATUS) PQCLEAN_KYBER1024_AARCH64_crypto_kem_enc(ciphertext, shared_secret, public_key); 110| |#if defined(OQS_DIST_BUILD) 111| | } else { 112| | return (OQS_STATUS) pqcrystals_kyber1024_ref_enc(ciphertext, shared_secret, public_key); 113| | } 114| |#endif /* OQS_DIST_BUILD */ 115| |#else 116| | return (OQS_STATUS) pqcrystals_kyber1024_ref_enc(ciphertext, shared_secret, public_key); 117| |#endif 118| 89|} OQS_KEM_kyber_1024_decaps: 120| 89|OQS_API OQS_STATUS OQS_KEM_kyber_1024_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 121| 89|#if defined(OQS_ENABLE_KEM_kyber_1024_avx2) 122| 89|#if defined(OQS_DIST_BUILD) 123| 89| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (123:6): [True: 89, False: 0] | Branch (123:49): [True: 89, False: 0] | Branch (123:92): [True: 89, False: 0] ------------------ 124| 89|#endif /* OQS_DIST_BUILD */ 125| 89| return (OQS_STATUS) pqcrystals_kyber1024_avx2_dec(shared_secret, ciphertext, secret_key); 126| 89|#if defined(OQS_DIST_BUILD) 127| 89| } else { 128| 0| return (OQS_STATUS) pqcrystals_kyber1024_ref_dec(shared_secret, ciphertext, secret_key); 129| 0| } 130| 89|#endif /* OQS_DIST_BUILD */ 131| |#elif defined(OQS_ENABLE_KEM_kyber_1024_aarch64) 132| |#if defined(OQS_DIST_BUILD) 133| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 134| |#endif /* OQS_DIST_BUILD */ 135| | return (OQS_STATUS) PQCLEAN_KYBER1024_AARCH64_crypto_kem_dec(shared_secret, ciphertext, secret_key); 136| |#if defined(OQS_DIST_BUILD) 137| | } else { 138| | return (OQS_STATUS) pqcrystals_kyber1024_ref_dec(shared_secret, ciphertext, secret_key); 139| | } 140| |#endif /* OQS_DIST_BUILD */ 141| |#else 142| | return (OQS_STATUS) pqcrystals_kyber1024_ref_dec(shared_secret, ciphertext, secret_key); 143| |#endif 144| 89|} OQS_KEM_kyber_512_new: 9| 66|OQS_KEM *OQS_KEM_kyber_512_new(void) { 10| | 11| 66| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 66| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 66] ------------------ 13| 0| return NULL; 14| 0| } 15| 66| kem->method_name = OQS_KEM_alg_kyber_512; ------------------ | | 68| 66|#define OQS_KEM_alg_kyber_512 "Kyber512" ------------------ 16| 66| kem->alg_version = "https://github.com/pq-crystals/kyber/commit/74cad307858b61e434490c75f812cb9b9ef7279b"; 17| | 18| 66| kem->claimed_nist_level = 1; 19| 66| kem->ind_cca = true; 20| | 21| 66| kem->length_public_key = OQS_KEM_kyber_512_length_public_key; ------------------ | | 9| 66|#define OQS_KEM_kyber_512_length_public_key 800 ------------------ 22| 66| kem->length_secret_key = OQS_KEM_kyber_512_length_secret_key; ------------------ | | 10| 66|#define OQS_KEM_kyber_512_length_secret_key 1632 ------------------ 23| 66| kem->length_ciphertext = OQS_KEM_kyber_512_length_ciphertext; ------------------ | | 11| 66|#define OQS_KEM_kyber_512_length_ciphertext 768 ------------------ 24| 66| kem->length_shared_secret = OQS_KEM_kyber_512_length_shared_secret; ------------------ | | 12| 66|#define OQS_KEM_kyber_512_length_shared_secret 32 ------------------ 25| 66| kem->length_keypair_seed = OQS_KEM_kyber_512_length_keypair_seed; ------------------ | | 13| 66|#define OQS_KEM_kyber_512_length_keypair_seed 0 ------------------ 26| 66| kem->length_encaps_seed = OQS_KEM_kyber_512_length_encaps_seed; ------------------ | | 14| 66|#define OQS_KEM_kyber_512_length_encaps_seed 0 ------------------ 27| | 28| 66| kem->keypair = OQS_KEM_kyber_512_keypair; 29| 66| kem->keypair_derand = OQS_KEM_kyber_512_keypair_derand; 30| 66| kem->encaps = OQS_KEM_kyber_512_encaps; 31| 66| kem->encaps_derand = OQS_KEM_kyber_512_encaps_derand; 32| 66| kem->decaps = OQS_KEM_kyber_512_decaps; 33| | 34| 66| return kem; 35| 66|} OQS_KEM_kyber_512_keypair: 73| 66|OQS_API OQS_STATUS OQS_KEM_kyber_512_keypair(uint8_t *public_key, uint8_t *secret_key) { 74| |#if defined(OQS_LIBJADE_BUILD) && (defined(OQS_ENABLE_LIBJADE_KEM_kyber_512)) 75| |#if defined(OQS_ENABLE_LIBJADE_KEM_kyber_512_avx2) 76| |#if defined(OQS_DIST_BUILD) 77| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { 78| |#endif /* OQS_DIST_BUILD */ 79| | return (OQS_STATUS) libjade_kyber512_avx2_keypair(public_key, secret_key); 80| |#if defined(OQS_DIST_BUILD) 81| | } else { 82| | return (OQS_STATUS) libjade_kyber512_ref_keypair(public_key, secret_key); 83| | } 84| |#endif /* OQS_DIST_BUILD */ 85| |#else 86| | return (OQS_STATUS) libjade_kyber512_ref_keypair(public_key, secret_key); 87| |#endif 88| |#else /*OQS_LIBJADE_BUILD && (OQS_ENABLE_LIBJADE_KEM_kyber_512)*/ 89| 66|#if defined(OQS_ENABLE_KEM_kyber_512_avx2) 90| 66|#if defined(OQS_DIST_BUILD) 91| 66| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (91:6): [True: 66, False: 0] | Branch (91:49): [True: 66, False: 0] | Branch (91:92): [True: 66, False: 0] ------------------ 92| 66|#endif /* OQS_DIST_BUILD */ 93| 66| return (OQS_STATUS) pqcrystals_kyber512_avx2_keypair(public_key, secret_key); 94| 66|#if defined(OQS_DIST_BUILD) 95| 66| } else { 96| 0| return (OQS_STATUS) pqcrystals_kyber512_ref_keypair(public_key, secret_key); 97| 0| } 98| 66|#endif /* OQS_DIST_BUILD */ 99| |#elif defined(OQS_ENABLE_KEM_kyber_512_aarch64) 100| |#if defined(OQS_DIST_BUILD) 101| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 102| |#endif /* OQS_DIST_BUILD */ 103| | return (OQS_STATUS) PQCLEAN_KYBER512_AARCH64_crypto_kem_keypair(public_key, secret_key); 104| |#if defined(OQS_DIST_BUILD) 105| | } else { 106| | return (OQS_STATUS) pqcrystals_kyber512_ref_keypair(public_key, secret_key); 107| | } 108| |#endif /* OQS_DIST_BUILD */ 109| |#else 110| | return (OQS_STATUS) pqcrystals_kyber512_ref_keypair(public_key, secret_key); 111| |#endif 112| 66|#endif /* OQS_LIBJADE_BUILD */ 113| 66|} OQS_KEM_kyber_512_encaps: 123| 66|OQS_API OQS_STATUS OQS_KEM_kyber_512_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 124| |#if defined(OQS_LIBJADE_BUILD) && (defined(OQS_ENABLE_LIBJADE_KEM_kyber_512)) 125| |#if defined(OQS_ENABLE_LIBJADE_KEM_kyber_512_avx2) 126| |#if defined(OQS_DIST_BUILD) 127| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { 128| |#endif /* OQS_DIST_BUILD */ 129| | return (OQS_STATUS) libjade_kyber512_avx2_enc(ciphertext, shared_secret, public_key); 130| |#if defined(OQS_DIST_BUILD) 131| | } else { 132| | return (OQS_STATUS) libjade_kyber512_ref_enc(ciphertext, shared_secret, public_key); 133| | } 134| |#endif /* OQS_DIST_BUILD */ 135| |#else 136| | return (OQS_STATUS) libjade_kyber512_ref_enc(ciphertext, shared_secret, public_key); 137| |#endif 138| |#else /*OQS_LIBJADE_BUILD && (OQS_ENABLE_LIBJADE_KEM_kyber_512)*/ 139| 66|#if defined(OQS_ENABLE_KEM_kyber_512_avx2) 140| 66|#if defined(OQS_DIST_BUILD) 141| 66| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (141:6): [True: 66, False: 0] | Branch (141:49): [True: 66, False: 0] | Branch (141:92): [True: 66, False: 0] ------------------ 142| 66|#endif /* OQS_DIST_BUILD */ 143| 66| return (OQS_STATUS) pqcrystals_kyber512_avx2_enc(ciphertext, shared_secret, public_key); 144| 66|#if defined(OQS_DIST_BUILD) 145| 66| } else { 146| 0| return (OQS_STATUS) pqcrystals_kyber512_ref_enc(ciphertext, shared_secret, public_key); 147| 0| } 148| 66|#endif /* OQS_DIST_BUILD */ 149| |#elif defined(OQS_ENABLE_KEM_kyber_512_aarch64) 150| |#if defined(OQS_DIST_BUILD) 151| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 152| |#endif /* OQS_DIST_BUILD */ 153| | return (OQS_STATUS) PQCLEAN_KYBER512_AARCH64_crypto_kem_enc(ciphertext, shared_secret, public_key); 154| |#if defined(OQS_DIST_BUILD) 155| | } else { 156| | return (OQS_STATUS) pqcrystals_kyber512_ref_enc(ciphertext, shared_secret, public_key); 157| | } 158| |#endif /* OQS_DIST_BUILD */ 159| |#else 160| | return (OQS_STATUS) pqcrystals_kyber512_ref_enc(ciphertext, shared_secret, public_key); 161| |#endif 162| 66|#endif /* OQS_LIBJADE_BUILD */ 163| 66|} OQS_KEM_kyber_512_decaps: 165| 66|OQS_API OQS_STATUS OQS_KEM_kyber_512_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 166| |#if defined(OQS_LIBJADE_BUILD) && (defined(OQS_ENABLE_LIBJADE_KEM_kyber_512)) 167| |#if defined(OQS_ENABLE_LIBJADE_KEM_kyber_512_avx2) 168| |#if defined(OQS_DIST_BUILD) 169| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { 170| |#endif /* OQS_DIST_BUILD */ 171| | return (OQS_STATUS) libjade_kyber512_avx2_dec(shared_secret, ciphertext, secret_key); 172| |#if defined(OQS_DIST_BUILD) 173| | } else { 174| | return (OQS_STATUS) libjade_kyber512_ref_dec(shared_secret, ciphertext, secret_key); 175| | } 176| |#endif /* OQS_DIST_BUILD */ 177| |#else 178| | return (OQS_STATUS) libjade_kyber512_ref_dec(shared_secret, ciphertext, secret_key); 179| |#endif 180| |#else /*OQS_LIBJADE_BUILD && (OQS_ENABLE_LIBJADE_KEM_kyber_512)*/ 181| 66|#if defined(OQS_ENABLE_KEM_kyber_512_avx2) 182| 66|#if defined(OQS_DIST_BUILD) 183| 66| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (183:6): [True: 66, False: 0] | Branch (183:49): [True: 66, False: 0] | Branch (183:92): [True: 66, False: 0] ------------------ 184| 66|#endif /* OQS_DIST_BUILD */ 185| 66| return (OQS_STATUS) pqcrystals_kyber512_avx2_dec(shared_secret, ciphertext, secret_key); 186| 66|#if defined(OQS_DIST_BUILD) 187| 66| } else { 188| 0| return (OQS_STATUS) pqcrystals_kyber512_ref_dec(shared_secret, ciphertext, secret_key); 189| 0| } 190| 66|#endif /* OQS_DIST_BUILD */ 191| |#elif defined(OQS_ENABLE_KEM_kyber_512_aarch64) 192| |#if defined(OQS_DIST_BUILD) 193| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 194| |#endif /* OQS_DIST_BUILD */ 195| | return (OQS_STATUS) PQCLEAN_KYBER512_AARCH64_crypto_kem_dec(shared_secret, ciphertext, secret_key); 196| |#if defined(OQS_DIST_BUILD) 197| | } else { 198| | return (OQS_STATUS) pqcrystals_kyber512_ref_dec(shared_secret, ciphertext, secret_key); 199| | } 200| |#endif /* OQS_DIST_BUILD */ 201| |#else 202| | return (OQS_STATUS) pqcrystals_kyber512_ref_dec(shared_secret, ciphertext, secret_key); 203| |#endif 204| 66|#endif /* OQS_LIBJADE_BUILD */ 205| 66|} OQS_KEM_kyber_768_new: 9| 133|OQS_KEM *OQS_KEM_kyber_768_new(void) { 10| | 11| 133| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 133| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 133] ------------------ 13| 0| return NULL; 14| 0| } 15| 133| kem->method_name = OQS_KEM_alg_kyber_768; ------------------ | | 70| 133|#define OQS_KEM_alg_kyber_768 "Kyber768" ------------------ 16| 133| kem->alg_version = "https://github.com/pq-crystals/kyber/commit/28413dfbf523fdde181246451c2bd77199c0f7ff"; 17| | 18| 133| kem->claimed_nist_level = 3; 19| 133| kem->ind_cca = true; 20| | 21| 133| kem->length_public_key = OQS_KEM_kyber_768_length_public_key; ------------------ | | 24| 133|#define OQS_KEM_kyber_768_length_public_key 1184 ------------------ 22| 133| kem->length_secret_key = OQS_KEM_kyber_768_length_secret_key; ------------------ | | 25| 133|#define OQS_KEM_kyber_768_length_secret_key 2400 ------------------ 23| 133| kem->length_ciphertext = OQS_KEM_kyber_768_length_ciphertext; ------------------ | | 26| 133|#define OQS_KEM_kyber_768_length_ciphertext 1088 ------------------ 24| 133| kem->length_shared_secret = OQS_KEM_kyber_768_length_shared_secret; ------------------ | | 27| 133|#define OQS_KEM_kyber_768_length_shared_secret 32 ------------------ 25| 133| kem->length_keypair_seed = OQS_KEM_kyber_768_length_keypair_seed; ------------------ | | 28| 133|#define OQS_KEM_kyber_768_length_keypair_seed 0 ------------------ 26| 133| kem->length_encaps_seed = OQS_KEM_kyber_768_length_encaps_seed; ------------------ | | 29| 133|#define OQS_KEM_kyber_768_length_encaps_seed 0 ------------------ 27| | 28| 133| kem->keypair = OQS_KEM_kyber_768_keypair; 29| 133| kem->keypair_derand = OQS_KEM_kyber_768_keypair_derand; 30| 133| kem->encaps = OQS_KEM_kyber_768_encaps; 31| 133| kem->encaps_derand = OQS_KEM_kyber_768_encaps_derand; 32| 133| kem->decaps = OQS_KEM_kyber_768_decaps; 33| | 34| 133| return kem; 35| 133|} OQS_KEM_kyber_768_keypair: 73| 133|OQS_API OQS_STATUS OQS_KEM_kyber_768_keypair(uint8_t *public_key, uint8_t *secret_key) { 74| |#if defined(OQS_LIBJADE_BUILD) && (defined(OQS_ENABLE_LIBJADE_KEM_kyber_768)) 75| |#if defined(OQS_ENABLE_LIBJADE_KEM_kyber_768_avx2) 76| |#if defined(OQS_DIST_BUILD) 77| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { 78| |#endif /* OQS_DIST_BUILD */ 79| | return (OQS_STATUS) libjade_kyber768_avx2_keypair(public_key, secret_key); 80| |#if defined(OQS_DIST_BUILD) 81| | } else { 82| | return (OQS_STATUS) libjade_kyber768_ref_keypair(public_key, secret_key); 83| | } 84| |#endif /* OQS_DIST_BUILD */ 85| |#else 86| | return (OQS_STATUS) libjade_kyber768_ref_keypair(public_key, secret_key); 87| |#endif 88| |#else /*OQS_LIBJADE_BUILD && (OQS_ENABLE_LIBJADE_KEM_kyber_768)*/ 89| 133|#if defined(OQS_ENABLE_KEM_kyber_768_avx2) 90| 133|#if defined(OQS_DIST_BUILD) 91| 133| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (91:6): [True: 133, False: 0] | Branch (91:49): [True: 133, False: 0] | Branch (91:92): [True: 133, False: 0] ------------------ 92| 133|#endif /* OQS_DIST_BUILD */ 93| 133| return (OQS_STATUS) pqcrystals_kyber768_avx2_keypair(public_key, secret_key); 94| 133|#if defined(OQS_DIST_BUILD) 95| 133| } else { 96| 0| return (OQS_STATUS) pqcrystals_kyber768_ref_keypair(public_key, secret_key); 97| 0| } 98| 133|#endif /* OQS_DIST_BUILD */ 99| |#elif defined(OQS_ENABLE_KEM_kyber_768_aarch64) 100| |#if defined(OQS_DIST_BUILD) 101| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 102| |#endif /* OQS_DIST_BUILD */ 103| | return (OQS_STATUS) PQCLEAN_KYBER768_AARCH64_crypto_kem_keypair(public_key, secret_key); 104| |#if defined(OQS_DIST_BUILD) 105| | } else { 106| | return (OQS_STATUS) pqcrystals_kyber768_ref_keypair(public_key, secret_key); 107| | } 108| |#endif /* OQS_DIST_BUILD */ 109| |#else 110| | return (OQS_STATUS) pqcrystals_kyber768_ref_keypair(public_key, secret_key); 111| |#endif 112| 133|#endif /* OQS_LIBJADE_BUILD */ 113| 133|} OQS_KEM_kyber_768_encaps: 123| 133|OQS_API OQS_STATUS OQS_KEM_kyber_768_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 124| |#if defined(OQS_LIBJADE_BUILD) && (defined(OQS_ENABLE_LIBJADE_KEM_kyber_768)) 125| |#if defined(OQS_ENABLE_LIBJADE_KEM_kyber_768_avx2) 126| |#if defined(OQS_DIST_BUILD) 127| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { 128| |#endif /* OQS_DIST_BUILD */ 129| | return (OQS_STATUS) libjade_kyber768_avx2_enc(ciphertext, shared_secret, public_key); 130| |#if defined(OQS_DIST_BUILD) 131| | } else { 132| | return (OQS_STATUS) libjade_kyber768_ref_enc(ciphertext, shared_secret, public_key); 133| | } 134| |#endif /* OQS_DIST_BUILD */ 135| |#else 136| | return (OQS_STATUS) libjade_kyber768_ref_enc(ciphertext, shared_secret, public_key); 137| |#endif 138| |#else /*OQS_LIBJADE_BUILD && (OQS_ENABLE_LIBJADE_KEM_kyber_768)*/ 139| 133|#if defined(OQS_ENABLE_KEM_kyber_768_avx2) 140| 133|#if defined(OQS_DIST_BUILD) 141| 133| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (141:6): [True: 133, False: 0] | Branch (141:49): [True: 133, False: 0] | Branch (141:92): [True: 133, False: 0] ------------------ 142| 133|#endif /* OQS_DIST_BUILD */ 143| 133| return (OQS_STATUS) pqcrystals_kyber768_avx2_enc(ciphertext, shared_secret, public_key); 144| 133|#if defined(OQS_DIST_BUILD) 145| 133| } else { 146| 0| return (OQS_STATUS) pqcrystals_kyber768_ref_enc(ciphertext, shared_secret, public_key); 147| 0| } 148| 133|#endif /* OQS_DIST_BUILD */ 149| |#elif defined(OQS_ENABLE_KEM_kyber_768_aarch64) 150| |#if defined(OQS_DIST_BUILD) 151| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 152| |#endif /* OQS_DIST_BUILD */ 153| | return (OQS_STATUS) PQCLEAN_KYBER768_AARCH64_crypto_kem_enc(ciphertext, shared_secret, public_key); 154| |#if defined(OQS_DIST_BUILD) 155| | } else { 156| | return (OQS_STATUS) pqcrystals_kyber768_ref_enc(ciphertext, shared_secret, public_key); 157| | } 158| |#endif /* OQS_DIST_BUILD */ 159| |#else 160| | return (OQS_STATUS) pqcrystals_kyber768_ref_enc(ciphertext, shared_secret, public_key); 161| |#endif 162| 133|#endif /* OQS_LIBJADE_BUILD */ 163| 133|} OQS_KEM_kyber_768_decaps: 165| 133|OQS_API OQS_STATUS OQS_KEM_kyber_768_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 166| |#if defined(OQS_LIBJADE_BUILD) && (defined(OQS_ENABLE_LIBJADE_KEM_kyber_768)) 167| |#if defined(OQS_ENABLE_LIBJADE_KEM_kyber_768_avx2) 168| |#if defined(OQS_DIST_BUILD) 169| | if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { 170| |#endif /* OQS_DIST_BUILD */ 171| | return (OQS_STATUS) libjade_kyber768_avx2_dec(shared_secret, ciphertext, secret_key); 172| |#if defined(OQS_DIST_BUILD) 173| | } else { 174| | return (OQS_STATUS) libjade_kyber768_ref_dec(shared_secret, ciphertext, secret_key); 175| | } 176| |#endif /* OQS_DIST_BUILD */ 177| |#else 178| | return (OQS_STATUS) libjade_kyber768_ref_dec(shared_secret, ciphertext, secret_key); 179| |#endif 180| |#else /*OQS_LIBJADE_BUILD && (OQS_ENABLE_LIBJADE_KEM_kyber_768)*/ 181| 133|#if defined(OQS_ENABLE_KEM_kyber_768_avx2) 182| 133|#if defined(OQS_DIST_BUILD) 183| 133| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (183:6): [True: 133, False: 0] | Branch (183:49): [True: 133, False: 0] | Branch (183:92): [True: 133, False: 0] ------------------ 184| 133|#endif /* OQS_DIST_BUILD */ 185| 133| return (OQS_STATUS) pqcrystals_kyber768_avx2_dec(shared_secret, ciphertext, secret_key); 186| 133|#if defined(OQS_DIST_BUILD) 187| 133| } else { 188| 0| return (OQS_STATUS) pqcrystals_kyber768_ref_dec(shared_secret, ciphertext, secret_key); 189| 0| } 190| 133|#endif /* OQS_DIST_BUILD */ 191| |#elif defined(OQS_ENABLE_KEM_kyber_768_aarch64) 192| |#if defined(OQS_DIST_BUILD) 193| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 194| |#endif /* OQS_DIST_BUILD */ 195| | return (OQS_STATUS) PQCLEAN_KYBER768_AARCH64_crypto_kem_dec(shared_secret, ciphertext, secret_key); 196| |#if defined(OQS_DIST_BUILD) 197| | } else { 198| | return (OQS_STATUS) pqcrystals_kyber768_ref_dec(shared_secret, ciphertext, secret_key); 199| | } 200| |#endif /* OQS_DIST_BUILD */ 201| |#else 202| | return (OQS_STATUS) pqcrystals_kyber768_ref_dec(shared_secret, ciphertext, secret_key); 203| |#endif 204| 133|#endif /* OQS_LIBJADE_BUILD */ 205| 133|} pqcrystals_kyber1024_avx2_poly_cbd_eta1: 127| 2.13k|{ 128| 2.13k|#if KYBER_ETA1 == 2 129| 2.13k| cbd2(r, buf); 130| |#elif KYBER_ETA1 == 3 131| | cbd3(r, (uint8_t *)buf); 132| |#else 133| |#error "This implementation requires eta1 in {2,3}" 134| |#endif 135| 2.13k|} pqcrystals_kyber1024_avx2_poly_cbd_eta2: 138| 178|{ 139| 178|#if KYBER_ETA2 == 2 140| 178| cbd2(r, buf); 141| |#else 142| |#error "This implementation requires eta2 = 2" 143| |#endif 144| 178|} pqcrystals_kyber1024_avx2_gen_matrix: 397| 267|{ 398| 267| unsigned int i, ctr0, ctr1, ctr2, ctr3; 399| 267| ALIGNED_UINT8(REJ_UNIFORM_AVX_NBLOCKS*SHAKE128_RATE) buf[4]; ------------------ | | 8| 267| union { \ | | 9| 267| uint8_t coeffs[N]; \ | | 10| 267| __m256i vec[(N+31)/32]; \ | | 11| 267| } ------------------ 400| 267| __m256i f; 401| 267| shake128x4incctx state; ------------------ | | 18| 267|#define shake128x4incctx OQS_SHA3_shake128_x4_inc_ctx ------------------ 402| 267| shake128x4_inc_init(&state); ------------------ | | 19| 267|#define shake128x4_inc_init OQS_SHA3_shake128_x4_inc_init ------------------ 403| | 404| 1.33k| for(i=0;i<4;i++) { ------------------ | Branch (404:11): [True: 1.06k, False: 267] ------------------ 405| 1.06k| f = _mm256_loadu_si256((__m256i *)seed); 406| 1.06k| _mm256_store_si256(buf[0].vec, f); 407| 1.06k| _mm256_store_si256(buf[1].vec, f); 408| 1.06k| _mm256_store_si256(buf[2].vec, f); 409| 1.06k| _mm256_store_si256(buf[3].vec, f); 410| | 411| 1.06k| if(transposed) { ------------------ | Branch (411:8): [True: 712, False: 356] ------------------ 412| 712| buf[0].coeffs[32] = i; 413| 712| buf[0].coeffs[33] = 0; 414| 712| buf[1].coeffs[32] = i; 415| 712| buf[1].coeffs[33] = 1; 416| 712| buf[2].coeffs[32] = i; 417| 712| buf[2].coeffs[33] = 2; 418| 712| buf[3].coeffs[32] = i; 419| 712| buf[3].coeffs[33] = 3; 420| 712| } 421| 356| else { 422| 356| buf[0].coeffs[32] = 0; 423| 356| buf[0].coeffs[33] = i; 424| 356| buf[1].coeffs[32] = 1; 425| 356| buf[1].coeffs[33] = i; 426| 356| buf[2].coeffs[32] = 2; 427| 356| buf[2].coeffs[33] = i; 428| 356| buf[3].coeffs[32] = 3; 429| 356| buf[3].coeffs[33] = i; 430| 356| } 431| | 432| 1.06k| shake128x4_absorb_once(&state, buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 34); ------------------ | | 39| 1.06k|#define shake128x4_absorb_once OQS_SHA3_shake128_x4_absorb_once ------------------ 433| 1.06k| shake128x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, REJ_UNIFORM_AVX_NBLOCKS, &state); ------------------ | | 46| 1.06k| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | ------------------ | | | | 239| 1.06k|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 434| | 435| 1.06k| ctr0 = rej_uniform_avx(a[i].vec[0].coeffs, buf[0].coeffs); ------------------ | | 11| 1.06k|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 27| 1.06k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 436| 1.06k| ctr1 = rej_uniform_avx(a[i].vec[1].coeffs, buf[1].coeffs); ------------------ | | 11| 1.06k|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 27| 1.06k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 437| 1.06k| ctr2 = rej_uniform_avx(a[i].vec[2].coeffs, buf[2].coeffs); ------------------ | | 11| 1.06k|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 27| 1.06k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 438| 1.06k| ctr3 = rej_uniform_avx(a[i].vec[3].coeffs, buf[3].coeffs); ------------------ | | 11| 1.06k|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 27| 1.06k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 439| | 440| 1.36k| while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 2.72k|#define KYBER_N 256 ------------------ while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 2.64k|#define KYBER_N 256 ------------------ while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 2.56k|#define KYBER_N 256 ------------------ while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 1.12k|#define KYBER_N 256 ------------------ | Branch (440:11): [True: 80, False: 1.28k] | Branch (440:29): [True: 86, False: 1.19k] | Branch (440:47): [True: 75, False: 1.12k] | Branch (440:65): [True: 55, False: 1.06k] ------------------ 441| 296| shake128x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 1, &state); ------------------ | | 46| 296| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | ------------------ | | | | 239| 296|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 442| | 443| 296| ctr0 += rej_uniform(a[i].vec[0].coeffs + ctr0, KYBER_N - ctr0, buf[0].coeffs, SHAKE128_RATE); ------------------ | | 33| 296|#define KYBER_N 256 ------------------ ctr0 += rej_uniform(a[i].vec[0].coeffs + ctr0, KYBER_N - ctr0, buf[0].coeffs, SHAKE128_RATE); ------------------ | | 8| 296|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 296|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 444| 296| ctr1 += rej_uniform(a[i].vec[1].coeffs + ctr1, KYBER_N - ctr1, buf[1].coeffs, SHAKE128_RATE); ------------------ | | 33| 296|#define KYBER_N 256 ------------------ ctr1 += rej_uniform(a[i].vec[1].coeffs + ctr1, KYBER_N - ctr1, buf[1].coeffs, SHAKE128_RATE); ------------------ | | 8| 296|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 296|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 445| 296| ctr2 += rej_uniform(a[i].vec[2].coeffs + ctr2, KYBER_N - ctr2, buf[2].coeffs, SHAKE128_RATE); ------------------ | | 33| 296|#define KYBER_N 256 ------------------ ctr2 += rej_uniform(a[i].vec[2].coeffs + ctr2, KYBER_N - ctr2, buf[2].coeffs, SHAKE128_RATE); ------------------ | | 8| 296|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 296|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 446| 296| ctr3 += rej_uniform(a[i].vec[3].coeffs + ctr3, KYBER_N - ctr3, buf[3].coeffs, SHAKE128_RATE); ------------------ | | 33| 296|#define KYBER_N 256 ------------------ ctr3 += rej_uniform(a[i].vec[3].coeffs + ctr3, KYBER_N - ctr3, buf[3].coeffs, SHAKE128_RATE); ------------------ | | 8| 296|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 296|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 447| 296| } 448| | 449| 1.06k| poly_nttunpack(&a[i].vec[0]); ------------------ | | 62| 1.06k|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 27| 1.06k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 450| 1.06k| poly_nttunpack(&a[i].vec[1]); ------------------ | | 62| 1.06k|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 27| 1.06k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 451| 1.06k| poly_nttunpack(&a[i].vec[2]); ------------------ | | 62| 1.06k|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 27| 1.06k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 452| 1.06k| poly_nttunpack(&a[i].vec[3]); ------------------ | | 62| 1.06k|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 27| 1.06k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 453| 1.06k| } 454| 267| shake128x4_inc_ctx_release(&state); ------------------ | | 23| 267|#define shake128x4_inc_ctx_release OQS_SHA3_shake128_x4_inc_ctx_release ------------------ 455| 267|} pqcrystals_kyber1024_avx2_indcpa_keypair: 472| 89|{ 473| 89| unsigned int i; 474| 89| uint8_t buf[2*KYBER_SYMBYTES]; 475| 89| const uint8_t *publicseed = buf; 476| 89| const uint8_t *noiseseed = buf + KYBER_SYMBYTES; ------------------ | | 36| 89|#define KYBER_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 477| 89| polyvec a[KYBER_K], e, pkpv, skpv; 478| | 479| 89| randombytes(buf, KYBER_SYMBYTES); ------------------ | | 8| 89|#define randombytes OQS_randombytes ------------------ randombytes(buf, KYBER_SYMBYTES); ------------------ | | 36| 89|#define KYBER_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 480| 89| hash_g(buf, buf, KYBER_SYMBYTES); ------------------ | | 53| 89|#define hash_g(OUT, IN, INBYTES) sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 31| 89|#define sha3_512 OQS_SHA3_sha3_512 | | ------------------ ------------------ 481| | 482| 89| gen_a(a, publicseed); ------------------ | | 157| 89|#define gen_a(A,B) gen_matrix(A,B,0) | | ------------------ | | | | 8| 89|#define gen_matrix KYBER_NAMESPACE(gen_matrix) | | | | ------------------ | | | | | | 27| 89|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | | | ------------------ | | ------------------ ------------------ 483| | 484| |#ifdef KYBER_90S 485| |#define NOISE_NBLOCKS ((KYBER_ETA1*KYBER_N/4)/AES256CTR_BLOCKBYTES) /* Assumes divisibility */ 486| | uint64_t nonce = 0; 487| | ALIGNED_UINT8(NOISE_NBLOCKS*AES256CTR_BLOCKBYTES+32) coins; // +32 bytes as required by poly_cbd_eta1 488| | aes256ctr_ctx state; 489| | aes256ctr_init_u64(&state, noiseseed, nonce++); 490| | for(i=0;ivec[2*i+0]); 190| 1.42k| f1 = _mm256_load_si256(&a->vec[2*i+1]); 191| 1.42k| f0 = _mm256_mulhi_epi16(f0,v); 192| 1.42k| f1 = _mm256_mulhi_epi16(f1,v); 193| 1.42k| f0 = _mm256_mulhrs_epi16(f0,shift1); 194| 1.42k| f1 = _mm256_mulhrs_epi16(f1,shift1); 195| 1.42k| f0 = _mm256_and_si256(f0,mask); 196| 1.42k| f1 = _mm256_and_si256(f1,mask); 197| 1.42k| f0 = _mm256_packus_epi16(f0,f1); 198| 1.42k| f0 = _mm256_maddubs_epi16(f0,shift2); // a0 a1 a2 a3 b0 b1 b2 b3 a4 a5 a6 a7 b4 b5 b6 b7 199| 1.42k| f0 = _mm256_madd_epi16(f0,shift3); // a0 a1 b0 b1 a2 a3 b2 b3 200| 1.42k| f0 = _mm256_sllv_epi32(f0,sllvdidx); 201| 1.42k| f0 = _mm256_srlv_epi64(f0,sllvdidx); 202| 1.42k| f0 = _mm256_shuffle_epi8(f0,shufbidx); 203| 1.42k| t0 = _mm256_castsi256_si128(f0); 204| | t1 = _mm256_extracti128_si256(f0,1); 205| 1.42k| t0 = _mm_blendv_epi8(t0,t1,_mm256_castsi256_si128(shufbidx)); 206| 1.42k| _mm_storeu_si128((__m128i *)&r[20*i+ 0],t0); 207| 1.42k| memcpy(&r[20*i+16],&t1,4); 208| 1.42k| } 209| 178|} pqcrystals_kyber1024_avx2_poly_decompress: 212| 89|{ 213| 89| unsigned int i; 214| 89| __m128i t; 215| 89| __m256i f; 216| 89| int16_t ti; 217| 89| const __m256i q = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 39| 89|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 89|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ const __m256i q = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 6| 89|#define _16XQ 0 ------------------ 218| 89| const __m256i shufbidx = _mm256_set_epi8(9,9,9,8,8,8,8,7,7,6,6,6,6,5,5,5, 219| 89| 4,4,4,3,3,3,3,2,2,1,1,1,1,0,0,0); 220| 89| const __m256i mask = _mm256_set_epi16(248,1984,62,496,3968,124,992,31, 221| 89| 248,1984,62,496,3968,124,992,31); 222| 89| const __m256i shift = _mm256_set_epi16(128,16,512,64,8,256,32,1024, 223| 89| 128,16,512,64,8,256,32,1024); 224| | 225| 1.51k| for(i=0;ivec[i],f); 235| 1.42k| } 236| 89|} pqcrystals_kyber1024_avx2_poly_tobytes: 255| 712|{ 256| 712| ntttobytes_avx(r, a->vec, qdata.vec); ------------------ | | 23| 712|#define ntttobytes_avx KYBER_NAMESPACE(ntttobytes_avx) | | ------------------ | | | | 27| 712|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ ntttobytes_avx(r, a->vec, qdata.vec); ------------------ | | 39| 712|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 712|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 257| 712|} pqcrystals_kyber1024_avx2_poly_frombytes: 270| 1.06k|{ 271| 1.06k| nttfrombytes_avx(r->vec, a, qdata.vec); ------------------ | | 25| 1.06k|#define nttfrombytes_avx KYBER_NAMESPACE(nttfrombytes_avx) | | ------------------ | | | | 27| 1.06k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ nttfrombytes_avx(r->vec, a, qdata.vec); ------------------ | | 39| 1.06k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 1.06k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 272| 1.06k|} pqcrystals_kyber1024_avx2_poly_frommsg: 283| 178|{ 284| |#if (KYBER_INDCPA_MSGBYTES != 32) 285| |#error "KYBER_INDCPA_MSGBYTES must be equal to 32!" 286| |#endif 287| 178| __m256i f, g0, g1, g2, g3, h0, h1, h2, h3; 288| 178| const __m256i shift = _mm256_broadcastsi128_si256(_mm_set_epi32(0,1,2,3)); 289| 178| const __m256i idx = _mm256_broadcastsi128_si256(_mm_set_epi8(15,14,11,10,7,6,3,2,13,12,9,8,5,4,1,0)); 290| 178| const __m256i hqs = _mm256_set1_epi16((KYBER_Q+1)/2); ------------------ | | 34| 178|#define KYBER_Q 3329 ------------------ 291| | 292| 178|#define FROMMSG64(i) \ 293| 178| g3 = _mm256_shuffle_epi32(f,0x55*i); \ 294| 178| g3 = _mm256_sllv_epi32(g3,shift); \ 295| 178| g3 = _mm256_shuffle_epi8(g3,idx); \ 296| 178| g0 = _mm256_slli_epi16(g3,12); \ 297| 178| g1 = _mm256_slli_epi16(g3,8); \ 298| 178| g2 = _mm256_slli_epi16(g3,4); \ 299| 178| g0 = _mm256_srai_epi16(g0,15); \ 300| 178| g1 = _mm256_srai_epi16(g1,15); \ 301| 178| g2 = _mm256_srai_epi16(g2,15); \ 302| 178| g3 = _mm256_srai_epi16(g3,15); \ 303| 178| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ 304| 178| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ 305| 178| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ 306| 178| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ 307| 178| h0 = _mm256_unpacklo_epi64(g0,g1); \ 308| 178| h2 = _mm256_unpackhi_epi64(g0,g1); \ 309| 178| h1 = _mm256_unpacklo_epi64(g2,g3); \ 310| 178| h3 = _mm256_unpackhi_epi64(g2,g3); \ 311| 178| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ 312| 178| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ 313| 178| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ 314| 178| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ 315| 178| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ 316| 178| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ 317| 178| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ 318| 178| _mm256_store_si256(&r->vec[8+2*i+1],g3) 319| | 320| 178| f = _mm256_loadu_si256((__m256i *)msg); 321| 178| FROMMSG64(0); ------------------ | | 293| 178| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 178| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 178| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 178| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 178| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 178| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 178| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 178| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 178| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 178| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 178| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 178| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 178| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 178| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 178| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 178| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 178| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 178| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 178| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 178| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 178| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 178| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 178| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 178| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 178| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 178| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 322| 178| FROMMSG64(1); ------------------ | | 293| 178| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 178| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 178| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 178| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 178| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 178| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 178| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 178| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 178| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 178| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 178| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 178| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 178| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 178| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 178| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 178| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 178| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 178| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 178| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 178| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 178| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 178| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 178| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 178| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 178| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 178| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 323| 178| FROMMSG64(2); ------------------ | | 293| 178| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 178| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 178| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 178| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 178| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 178| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 178| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 178| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 178| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 178| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 178| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 178| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 178| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 178| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 178| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 178| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 178| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 178| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 178| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 178| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 178| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 178| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 178| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 178| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 178| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 178| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 324| | FROMMSG64(3); ------------------ | | 293| 178| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 178| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 178| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 178| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 178| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 178| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 178| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 178| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 178| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 178| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 178| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 178| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 178| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 178| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 178| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 178| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 178| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 178| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 178| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 178| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 178| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 178| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 178| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 178| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 178| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 178| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 325| 178|} pqcrystals_kyber1024_avx2_poly_tomsg: 339| 89|{ 340| 89| unsigned int i; 341| 89| uint32_t small; 342| 89| __m256i f0, f1, g0, g1; 343| 89| const __m256i hq = _mm256_set1_epi16((KYBER_Q - 1)/2); ------------------ | | 34| 89|#define KYBER_Q 3329 ------------------ 344| 89| const __m256i hhq = _mm256_set1_epi16((KYBER_Q - 1)/4); ------------------ | | 34| 89|#define KYBER_Q 3329 ------------------ 345| | 346| 801| for(i=0;ivec[2*i+0]); 348| 712| f1 = _mm256_load_si256(&a->vec[2*i+1]); 349| 712| f0 = _mm256_sub_epi16(hq, f0); 350| 712| f1 = _mm256_sub_epi16(hq, f1); 351| 712| g0 = _mm256_srai_epi16(f0, 15); 352| 712| g1 = _mm256_srai_epi16(f1, 15); 353| 712| f0 = _mm256_xor_si256(f0, g0); 354| 712| f1 = _mm256_xor_si256(f1, g1); 355| 712| f0 = _mm256_sub_epi16(f0, hhq); 356| 712| f1 = _mm256_sub_epi16(f1, hhq); 357| 712| f0 = _mm256_packs_epi16(f0, f1); 358| | f0 = _mm256_permute4x64_epi64(f0, 0xD8); 359| 712| small = _mm256_movemask_epi8(f0); 360| 712| memcpy(&msg[4*i], &small, 4); 361| 712| } 362| 89|} pqcrystals_kyber1024_avx2_poly_getnoise_eta2: 397| 178|{ 398| 178| ALIGNED_UINT8(KYBER_ETA2*KYBER_N/4) buf; ------------------ | | 8| 178| union { \ | | 9| 178| uint8_t coeffs[N]; \ | | 10| 178| __m256i vec[(N+31)/32]; \ | | 11| 178| } ------------------ 399| 178| prf(buf.coeffs, KYBER_ETA2*KYBER_N/4, seed, nonce); ------------------ | | 58| 178| kyber_shake256_prf(OUT, OUTBYTES, KEY, NONCE) | | ------------------ | | | | 44| 178|#define kyber_shake256_prf KYBER_NAMESPACE(kyber_shake256_prf) | | | | ------------------ | | | | | | 27| 178|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | | | ------------------ | | ------------------ ------------------ 400| 178| poly_cbd_eta2(r, buf.vec); ------------------ | | 12| 178|#define poly_cbd_eta2 KYBER_NAMESPACE(poly_cbd_eta2) | | ------------------ | | | | 27| 178|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 401| 178|} pqcrystals_kyber1024_avx2_poly_getnoise_eta2_4x: 415| 534|{ 416| 534| ALIGNED_UINT8(NOISE_NBLOCKS*SHAKE256_RATE) buf[4]; ------------------ | | 8| 534| union { \ | | 9| 534| uint8_t coeffs[N]; \ | | 10| 534| __m256i vec[(N+31)/32]; \ | | 11| 534| } ------------------ 417| 534| __m256i f; 418| 534| shake256x4incctx state; ------------------ | | 27| 534|#define shake256x4incctx OQS_SHA3_shake256_x4_inc_ctx ------------------ 419| | 420| 534| f = _mm256_loadu_si256((__m256i *)seed); 421| 534| _mm256_store_si256(buf[0].vec, f); 422| 534| _mm256_store_si256(buf[1].vec, f); 423| 534| _mm256_store_si256(buf[2].vec, f); 424| 534| _mm256_store_si256(buf[3].vec, f); 425| | 426| 534| buf[0].coeffs[32] = nonce0; 427| 534| buf[1].coeffs[32] = nonce1; 428| 534| buf[2].coeffs[32] = nonce2; 429| 534| buf[3].coeffs[32] = nonce3; 430| | 431| 534| shake256x4_inc_init(&state); ------------------ | | 28| 534|#define shake256x4_inc_init OQS_SHA3_shake256_x4_inc_init ------------------ 432| 534| shake256x4_absorb_once(&state, buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 33); ------------------ | | 42| 534|#define shake256x4_absorb_once OQS_SHA3_shake256_x4_absorb_once ------------------ 433| 534| shake256x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, NOISE_NBLOCKS, &state); ------------------ | | 49| 534| OQS_SHA3_shake256_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE256_RATE, STATE) | | ------------------ | | | | 320| 534|#define OQS_SHA3_SHAKE256_RATE 136 | | ------------------ ------------------ 434| 534| shake256x4_inc_ctx_release(&state); ------------------ | | 32| 534|#define shake256x4_inc_ctx_release OQS_SHA3_shake256_x4_inc_ctx_release ------------------ 435| | 436| 534| poly_cbd_eta1(r0, buf[0].vec); ------------------ | | 9| 534|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 27| 534|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 437| 534| poly_cbd_eta1(r1, buf[1].vec); ------------------ | | 9| 534|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 27| 534|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 438| 534| poly_cbd_eta1(r2, buf[2].vec); ------------------ | | 9| 534|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 27| 534|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 439| 534| poly_cbd_eta1(r3, buf[3].vec); ------------------ | | 9| 534|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 27| 534|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 440| 534|} pqcrystals_kyber1024_avx2_poly_ntt: 495| 1.78k|{ 496| 1.78k| ntt_avx(r->vec, qdata.vec); ------------------ | | 7| 1.78k|#define ntt_avx KYBER_NAMESPACE(ntt_avx) | | ------------------ | | | | 27| 1.78k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ ntt_avx(r->vec, qdata.vec); ------------------ | | 39| 1.78k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 1.78k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 497| 1.78k|} pqcrystals_kyber1024_avx2_poly_invntt_tomont: 512| 979|{ 513| 979| invntt_avx(r->vec, qdata.vec); ------------------ | | 9| 979|#define invntt_avx KYBER_NAMESPACE(invntt_avx) | | ------------------ | | | | 27| 979|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ invntt_avx(r->vec, qdata.vec); ------------------ | | 39| 979|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 979|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 514| 979|} pqcrystals_kyber1024_avx2_poly_nttunpack: 517| 4.27k|{ 518| 4.27k| nttunpack_avx(r->vec, qdata.vec); ------------------ | | 14| 4.27k|#define nttunpack_avx KYBER_NAMESPACE(nttunpack_avx) | | ------------------ | | | | 27| 4.27k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ nttunpack_avx(r->vec, qdata.vec); ------------------ | | 39| 4.27k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 4.27k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 519| 4.27k|} pqcrystals_kyber1024_avx2_poly_basemul_montgomery: 534| 5.34k|{ 535| 5.34k| basemul_avx(r->vec, a->vec, b->vec, qdata.vec); ------------------ | | 17| 5.34k|#define basemul_avx KYBER_NAMESPACE(basemul_avx) | | ------------------ | | | | 27| 5.34k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ basemul_avx(r->vec, a->vec, b->vec, qdata.vec); ------------------ | | 39| 5.34k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 5.34k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 536| 5.34k|} pqcrystals_kyber1024_avx2_poly_tomont: 547| 356|{ 548| 356| tomont_avx(r->vec, qdata.vec); ------------------ | | 9| 356|#define tomont_avx KYBER_NAMESPACE(tomont_avx) | | ------------------ | | | | 27| 356|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ tomont_avx(r->vec, qdata.vec); ------------------ | | 39| 356|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 356|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 549| 356|} pqcrystals_kyber1024_avx2_poly_reduce: 560| 1.69k|{ 561| 1.69k| reduce_avx(r->vec, qdata.vec); ------------------ | | 7| 1.69k|#define reduce_avx KYBER_NAMESPACE(reduce_avx) | | ------------------ | | | | 27| 1.69k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ reduce_avx(r->vec, qdata.vec); ------------------ | | 39| 1.69k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 1.69k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 562| 1.69k|} pqcrystals_kyber1024_avx2_poly_add: 575| 5.42k|{ 576| 5.42k| unsigned int i; 577| 5.42k| __m256i f0, f1; 578| | 579| 92.2k| for(i=0;ivec[i]); 581| 86.8k| f1 = _mm256_load_si256(&b->vec[i]); 582| 86.8k| f0 = _mm256_add_epi16(f0, f1); 583| 86.8k| _mm256_store_si256(&r->vec[i], f0); 584| 86.8k| } 585| 5.42k|} pqcrystals_kyber1024_avx2_poly_sub: 598| 89|{ 599| 89| unsigned int i; 600| 89| __m256i f0, f1; 601| | 602| 1.51k| for(i=0;ivec[i]); 604| 1.42k| f1 = _mm256_load_si256(&b->vec[i]); 605| 1.42k| f0 = _mm256_sub_epi16(f0, f1); 606| 1.42k| _mm256_store_si256(&r->vec[i], f0); 607| 1.42k| } 608| 89|} pqcrystals_kyber1024_avx2_polyvec_compress: 158| 178|{ 159| 178| unsigned int i; 160| | 161| |#if (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 320)) 162| | for(i=0;ivec[i]); 164| |#elif (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 352)) 165| 890| for(i=0;ivec[i]); 167| 178|#endif 168| 178|} pqcrystals_kyber1024_avx2_polyvec_decompress: 181| 89|{ 182| 89| unsigned int i; 183| | 184| |#if (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 320)) 185| | for(i=0;ivec[i],&a[320*i]); 187| |#elif (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 352)) 188| 445| for(i=0;ivec[i],&a[352*i]); 190| 89|#endif 191| 89|} pqcrystals_kyber1024_avx2_polyvec_tobytes: 203| 178|{ 204| 178| unsigned int i; 205| 890| for(i=0;ivec[i]); ------------------ | | 15| 712|#define poly_tobytes KYBER_NAMESPACE(poly_tobytes) | | ------------------ | | | | 27| 712|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ poly_tobytes(r+i*KYBER_POLYBYTES, &a->vec[i]); ------------------ | | 39| 712|#define KYBER_POLYBYTES 384 ------------------ 207| 178|} pqcrystals_kyber1024_avx2_polyvec_frombytes: 220| 267|{ 221| 267| unsigned int i; 222| 1.33k| for(i=0;ivec[i], a+i*KYBER_POLYBYTES); ------------------ | | 17| 1.06k|#define poly_frombytes KYBER_NAMESPACE(poly_frombytes) | | ------------------ | | | | 27| 1.06k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ poly_frombytes(&r->vec[i], a+i*KYBER_POLYBYTES); ------------------ | | 39| 1.06k|#define KYBER_POLYBYTES 384 ------------------ 224| 267|} pqcrystals_kyber1024_avx2_polyvec_ntt: 234| 445|{ 235| 445| unsigned int i; 236| 2.22k| for(i=0;ivec[i]); ------------------ | | 58| 1.78k|#define poly_ntt KYBER_NAMESPACE(poly_ntt) | | ------------------ | | | | 27| 1.78k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 238| 445|} pqcrystals_kyber1024_avx2_polyvec_invntt_tomont: 249| 178|{ 250| 178| unsigned int i; 251| 890| for(i=0;ivec[i]); ------------------ | | 60| 712|#define poly_invntt_tomont KYBER_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 27| 712|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 253| 178|} pqcrystals_kyber1024_avx2_polyvec_basemul_acc_montgomery: 266| 1.33k|{ 267| 1.33k| unsigned int i; 268| 1.33k| poly tmp; 269| | 270| 1.33k| poly_basemul_montgomery(r,&a->vec[0],&b->vec[0]); ------------------ | | 64| 1.33k|#define poly_basemul_montgomery KYBER_NAMESPACE(poly_basemul_montgomery) | | ------------------ | | | | 27| 1.33k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 271| 5.34k| for(i=1;ivec[i],&b->vec[i]); ------------------ | | 64| 4.00k|#define poly_basemul_montgomery KYBER_NAMESPACE(poly_basemul_montgomery) | | ------------------ | | | | 27| 4.00k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 273| 4.00k| poly_add(r,r,&tmp); ------------------ | | 72| 4.00k|#define poly_add KYBER_NAMESPACE(poly_add) | | ------------------ | | | | 27| 4.00k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 274| 4.00k| } 275| 1.33k|} pqcrystals_kyber1024_avx2_polyvec_reduce: 287| 356|{ 288| 356| unsigned int i; 289| 1.78k| for(i=0;ivec[i]); ------------------ | | 69| 1.42k|#define poly_reduce KYBER_NAMESPACE(poly_reduce) | | ------------------ | | | | 27| 1.42k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 291| 356|} pqcrystals_kyber1024_avx2_polyvec_add: 303| 267|{ 304| 267| unsigned int i; 305| 1.33k| for(i=0;ivec[i], &a->vec[i], &b->vec[i]); ------------------ | | 72| 1.06k|#define poly_add KYBER_NAMESPACE(poly_add) | | ------------------ | | | | 27| 1.06k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ 307| 267|} polyvec.c:poly_compress11: 76| 712|{ 77| 712| unsigned int i; 78| 712| __m256i f0, f1, f2; 79| 712| __m128i t0, t1; 80| 712| const __m256i v = _mm256_load_si256(&qdata.vec[_16XV/16]); ------------------ | | 39| 712|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 712|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ const __m256i v = _mm256_load_si256(&qdata.vec[_16XV/16]); ------------------ | | 8| 712|#define _16XV 32 ------------------ 81| 712| const __m256i v8 = _mm256_slli_epi16(v,3); 82| 712| const __m256i off = _mm256_set1_epi16(36); 83| 712| const __m256i shift1 = _mm256_set1_epi16(1 << 13); 84| 712| const __m256i mask = _mm256_set1_epi16(2047); 85| 712| const __m256i shift2 = _mm256_set1_epi64x((2048LL << 48) + (1LL << 32) + (2048 << 16) + 1); 86| 712| const __m256i sllvdidx = _mm256_set1_epi64x(10); 87| 712| const __m256i srlvqidx = _mm256_set_epi64x(30,10,30,10); 88| 712| const __m256i shufbidx = _mm256_set_epi8( 4, 3, 2, 1, 0, 0,-1,-1,-1,-1,10, 9, 8, 7, 6, 5, 89| 712| -1,-1,-1,-1,-1,10, 9, 8, 7, 6, 5, 4, 3, 2, 1, 0); 90| | 91| 12.1k| for(i=0;ivec[i]); 93| 11.3k| f1 = _mm256_mullo_epi16(f0,v8); 94| 11.3k| f2 = _mm256_add_epi16(f0,off); 95| 11.3k| f0 = _mm256_slli_epi16(f0,3); 96| 11.3k| f0 = _mm256_mulhi_epi16(f0,v); 97| 11.3k| f2 = _mm256_sub_epi16(f1,f2); 98| 11.3k| f1 = _mm256_andnot_si256(f1,f2); 99| 11.3k| f1 = _mm256_srli_epi16(f1,15); 100| 11.3k| f0 = _mm256_sub_epi16(f0,f1); 101| 11.3k| f0 = _mm256_mulhrs_epi16(f0,shift1); 102| 11.3k| f0 = _mm256_and_si256(f0,mask); 103| 11.3k| f0 = _mm256_madd_epi16(f0,shift2); 104| 11.3k| f0 = _mm256_sllv_epi32(f0,sllvdidx); 105| 11.3k| f1 = _mm256_bsrli_epi128(f0,8); 106| 11.3k| f0 = _mm256_srlv_epi64(f0,srlvqidx); 107| 11.3k| f1 = _mm256_slli_epi64(f1,34); 108| 11.3k| f0 = _mm256_add_epi64(f0,f1); 109| 11.3k| f0 = _mm256_shuffle_epi8(f0,shufbidx); 110| 11.3k| t0 = _mm256_castsi256_si128(f0); 111| | t1 = _mm256_extracti128_si256(f0,1); 112| 11.3k| t0 = _mm_blendv_epi8(t0,t1,_mm256_castsi256_si128(shufbidx)); 113| 11.3k| _mm_storeu_si128((__m128i *)&r[22*i+ 0],t0); 114| 11.3k| _mm_storel_epi64((__m128i *)&r[22*i+16],t1); 115| 11.3k| } 116| 712|} polyvec.c:poly_decompress11: 119| 356|{ 120| 356| unsigned int i; 121| 356| __m256i f; 122| 356| const __m256i q = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 39| 356|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 356|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ const __m256i q = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 6| 356|#define _16XQ 0 ------------------ 123| 356| const __m256i shufbidx = _mm256_set_epi8(13,12,12,11,10, 9, 9, 8, 124| 356| 8, 7, 6, 5, 5, 4, 4, 3, 125| 356| 10, 9, 9, 8, 7, 6, 6, 5, 126| 356| 5, 4, 3, 2, 2, 1, 1, 0); 127| 356| const __m256i srlvdidx = _mm256_set_epi32(0,0,1,0,0,0,1,0); 128| 356| const __m256i srlvqidx = _mm256_set_epi64x(2,0,2,0); 129| 356| const __m256i shift = _mm256_set_epi16(4,32,1,8,32,1,4,32,4,32,1,8,32,1,4,32); 130| 356| const __m256i mask = _mm256_set1_epi16(32752); 131| | 132| 6.05k| for(i=0;ivec[i],f); 143| 5.69k| } 144| 356|} pqcrystals_kyber1024_avx2_rej_uniform_avx: 275| 4.27k|{ 276| 4.27k| unsigned int ctr, pos; 277| 4.27k| uint16_t val0, val1; 278| 4.27k| uint32_t good; 279| |#ifdef BMI 280| | uint64_t idx0, idx1, idx2, idx3; 281| |#endif 282| 4.27k| const __m256i bound = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 39| 4.27k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 27| 4.27k|#define KYBER_NAMESPACE(s) pqcrystals_kyber1024_avx2_##s | | ------------------ ------------------ const __m256i bound = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 6| 4.27k|#define _16XQ 0 ------------------ 283| 4.27k| const __m256i ones = _mm256_set1_epi8(1); 284| 4.27k| const __m256i mask = _mm256_set1_epi16(0xFFF); 285| 4.27k| const __m256i idx8 = _mm256_set_epi8(15,14,14,13,12,11,11,10, 286| 4.27k| 9, 8, 8, 7, 6, 5, 5, 4, 287| 4.27k| 11,10,10, 9, 8, 7, 7, 6, 288| 4.27k| 5, 4, 4, 3, 2, 1, 1, 0); 289| 4.27k| __m256i f0, f1, g0, g1, g2, g3; 290| 4.27k| __m128i f, t, pilo, pihi; 291| | 292| 4.27k| ctr = pos = 0; 293| 43.3k| while(ctr <= KYBER_N - 32 && pos <= REJ_UNIFORM_AVX_BUFLEN - 48) { ------------------ | | 33| 43.3k|#define KYBER_N 256 ------------------ while(ctr <= KYBER_N - 32 && pos <= REJ_UNIFORM_AVX_BUFLEN - 48) { ------------------ | | 9| 39.0k|#define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 8| 39.0k|#define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 33| 39.0k|#define KYBER_N 256 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 34| 39.0k|#define KYBER_Q 3329 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 39.0k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 39.0k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 39.0k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 39.0k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 39.0k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 39.0k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 50| 39.0k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | ------------------ | | | | | | 8| 39.0k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 39.0k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (293:9): [True: 39.0k, False: 4.26k] | Branch (293:32): [True: 39.0k, False: 9] ------------------ 294| 39.0k| f0 = _mm256_loadu_si256((__m256i *)&buf[pos]); 295| 39.0k| f1 = _mm256_loadu_si256((__m256i *)&buf[pos+24]); 296| 39.0k| f0 = _mm256_permute4x64_epi64(f0, 0x94); 297| 39.0k| f1 = _mm256_permute4x64_epi64(f1, 0x94); 298| 39.0k| f0 = _mm256_shuffle_epi8(f0, idx8); 299| 39.0k| f1 = _mm256_shuffle_epi8(f1, idx8); 300| 39.0k| g0 = _mm256_srli_epi16(f0, 4); 301| 39.0k| g1 = _mm256_srli_epi16(f1, 4); 302| 39.0k| f0 = _mm256_blend_epi16(f0, g0, 0xAA); 303| 39.0k| f1 = _mm256_blend_epi16(f1, g1, 0xAA); 304| 39.0k| f0 = _mm256_and_si256(f0, mask); 305| 39.0k| f1 = _mm256_and_si256(f1, mask); 306| 39.0k| pos += 48; 307| | 308| 39.0k| g0 = _mm256_cmpgt_epi16(bound, f0); 309| 39.0k| g1 = _mm256_cmpgt_epi16(bound, f1); 310| | 311| 39.0k| g0 = _mm256_packs_epi16(g0, g1); 312| 39.0k| good = _mm256_movemask_epi8(g0); 313| | 314| |#ifdef BMI 315| | idx0 = _pdep_u64(good >> 0, 0x0101010101010101); 316| | idx1 = _pdep_u64(good >> 8, 0x0101010101010101); 317| | idx2 = _pdep_u64(good >> 16, 0x0101010101010101); 318| | idx3 = _pdep_u64(good >> 24, 0x0101010101010101); 319| | idx0 = (idx0 << 8) - idx0; 320| | idx0 = _pext_u64(0x0E0C0A0806040200, idx0); 321| | idx1 = (idx1 << 8) - idx1; 322| | idx1 = _pext_u64(0x0E0C0A0806040200, idx1); 323| | idx2 = (idx2 << 8) - idx2; 324| | idx2 = _pext_u64(0x0E0C0A0806040200, idx2); 325| | idx3 = (idx3 << 8) - idx3; 326| | idx3 = _pext_u64(0x0E0C0A0806040200, idx3); 327| | 328| | g0 = _mm256_castsi128_si256(_mm_cvtsi64_si128(idx0)); 329| | g1 = _mm256_castsi128_si256(_mm_cvtsi64_si128(idx1)); 330| | g0 = _mm256_inserti128_si256(g0, _mm_cvtsi64_si128(idx2), 1); 331| | g1 = _mm256_inserti128_si256(g1, _mm_cvtsi64_si128(idx3), 1); 332| |#else 333| 39.0k| g0 = _mm256_castsi128_si256(_mm_loadl_epi64((__m128i *)&idx[(good >> 0) & 0xFF])); 334| 39.0k| g1 = _mm256_castsi128_si256(_mm_loadl_epi64((__m128i *)&idx[(good >> 8) & 0xFF])); 335| 39.0k| g0 = _mm256_inserti128_si256(g0, _mm_loadl_epi64((__m128i *)&idx[(good >> 16) & 0xFF]), 1); 336| 39.0k| g1 = _mm256_inserti128_si256(g1, _mm_loadl_epi64((__m128i *)&idx[(good >> 24) & 0xFF]), 1); 337| 39.0k|#endif 338| | 339| 39.0k| g2 = _mm256_add_epi8(g0, ones); 340| 39.0k| g3 = _mm256_add_epi8(g1, ones); 341| 39.0k| g0 = _mm256_unpacklo_epi8(g0, g2); 342| 39.0k| g1 = _mm256_unpacklo_epi8(g1, g3); 343| | 344| 39.0k| f0 = _mm256_shuffle_epi8(f0, g0); 345| 39.0k| f1 = _mm256_shuffle_epi8(f1, g1); 346| | 347| 39.0k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_castsi256_si128(f0)); 348| 39.0k| ctr += _mm_popcnt_u32((good >> 0) & 0xFF); 349| 39.0k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_extracti128_si256(f0, 1)); 350| 39.0k| ctr += _mm_popcnt_u32((good >> 16) & 0xFF); 351| 39.0k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_castsi256_si128(f1)); 352| 39.0k| ctr += _mm_popcnt_u32((good >> 8) & 0xFF); 353| 39.0k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_extracti128_si256(f1, 1)); 354| 39.0k| ctr += _mm_popcnt_u32((good >> 24) & 0xFF); 355| 39.0k| } 356| | 357| 14.4k| while(ctr <= KYBER_N - 8 && pos <= REJ_UNIFORM_AVX_BUFLEN - 12) { ------------------ | | 33| 14.4k|#define KYBER_N 256 ------------------ while(ctr <= KYBER_N - 8 && pos <= REJ_UNIFORM_AVX_BUFLEN - 12) { ------------------ | | 9| 10.2k|#define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 8| 10.2k|#define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 33| 10.2k|#define KYBER_N 256 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 34| 10.2k|#define KYBER_Q 3329 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 10.2k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 10.2k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 10.2k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 10.2k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 10.2k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 10.2k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 50| 10.2k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | ------------------ | | | | | | 8| 10.2k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 10.2k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (357:9): [True: 10.2k, False: 4.19k] | Branch (357:31): [True: 10.1k, False: 81] ------------------ 358| 10.1k| f = _mm_loadu_si128((__m128i *)&buf[pos]); 359| 10.1k| f = _mm_shuffle_epi8(f, _mm256_castsi256_si128(idx8)); 360| 10.1k| t = _mm_srli_epi16(f, 4); 361| 10.1k| f = _mm_blend_epi16(f, t, 0xAA); 362| 10.1k| f = _mm_and_si128(f, _mm256_castsi256_si128(mask)); 363| 10.1k| pos += 12; 364| | 365| 10.1k| t = _mm_cmpgt_epi16(_mm256_castsi256_si128(bound), f); 366| 10.1k| good = _mm_movemask_epi8(t); 367| | 368| |#ifdef BMI 369| | good &= 0x5555; 370| | idx0 = _pdep_u64(good, 0x1111111111111111); 371| | idx0 = (idx0 << 8) - idx0; 372| | idx0 = _pext_u64(0x0E0C0A0806040200, idx0); 373| | pilo = _mm_cvtsi64_si128(idx0); 374| |#else 375| 10.1k| good = _pext_u32(good, 0x5555); 376| 10.1k| pilo = _mm_loadl_epi64((__m128i *)&idx[good]); 377| 10.1k|#endif 378| | 379| 10.1k| pihi = _mm_add_epi8(pilo, _mm256_castsi256_si128(ones)); 380| 10.1k| pilo = _mm_unpacklo_epi8(pilo, pihi); 381| 10.1k| f = _mm_shuffle_epi8(f, pilo); 382| 10.1k| _mm_storeu_si128((__m128i *)&r[ctr], f); 383| 10.1k| ctr += _mm_popcnt_u32(good); 384| 10.1k| } 385| | 386| 15.3k| while(ctr < KYBER_N && pos <= REJ_UNIFORM_AVX_BUFLEN - 3) { ------------------ | | 33| 30.6k|#define KYBER_N 256 ------------------ while(ctr < KYBER_N && pos <= REJ_UNIFORM_AVX_BUFLEN - 3) { ------------------ | | 9| 11.3k|#define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 8| 11.3k|#define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 33| 11.3k|#define KYBER_N 256 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 34| 11.3k|#define KYBER_Q 3329 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 11.3k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 11.3k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 11.3k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 11.3k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 11.3k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 11.3k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 50| 11.3k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | ------------------ | | | | | | 8| 11.3k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 11.3k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (386:9): [True: 11.3k, False: 3.94k] | Branch (386:26): [True: 11.0k, False: 327] ------------------ 387| 11.0k| val0 = ((buf[pos+0] >> 0) | ((uint16_t)buf[pos+1] << 8)) & 0xFFF; 388| 11.0k| val1 = ((buf[pos+1] >> 4) | ((uint16_t)buf[pos+2] << 4)); 389| 11.0k| pos += 3; 390| | 391| 11.0k| if(val0 < KYBER_Q) ------------------ | | 34| 11.0k|#define KYBER_Q 3329 ------------------ | Branch (391:8): [True: 8.91k, False: 2.13k] ------------------ 392| 8.91k| r[ctr++] = val0; 393| 11.0k| if(val1 < KYBER_Q && ctr < KYBER_N) ------------------ | | 34| 22.0k|#define KYBER_Q 3329 ------------------ if(val1 < KYBER_Q && ctr < KYBER_N) ------------------ | | 33| 8.90k|#define KYBER_N 256 ------------------ | Branch (393:8): [True: 8.90k, False: 2.14k] | Branch (393:26): [True: 7.23k, False: 1.66k] ------------------ 394| 7.23k| r[ctr++] = val1; 395| 11.0k| } 396| | 397| 4.27k| return ctr; 398| 4.27k|} pqcrystals_kyber1024_avx2_kyber_shake256_prf: 44| 178|{ 45| 178| uint8_t extkey[KYBER_SYMBYTES+1]; 46| | 47| 178| memcpy(extkey, key, KYBER_SYMBYTES); ------------------ | | 36| 178|#define KYBER_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 48| 178| extkey[KYBER_SYMBYTES] = nonce; ------------------ | | 36| 178|#define KYBER_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 49| | 50| 178| shake256(out, outlen, extkey, sizeof(extkey)); ------------------ | | 12| 178|#define shake256 OQS_SHA3_shake256 ------------------ 51| 178|} pqcrystals_kyber1024_avx2_verify: 18| 89|{ 19| 89| size_t i; 20| 89| uint64_t r; 21| 89| __m256i f, g, h; 22| | 23| 89| h = _mm256_setzero_si256(); 24| 4.45k| for(i=0;i> 63; 39| 89| return r; 40| 89|} pqcrystals_kyber1024_avx2_cmov: 56| 89|{ 57| 89| size_t i; 58| 89| __m256i xvec, rvec, bvec; 59| | 60| 89|#if defined(__GNUC__) || defined(__clang__) 61| | // Prevent the compiler from 62| | // 1) inferring that b is 0/1-valued, and 63| | // 2) handling the two cases with a branch. 64| | // This is not necessary when verify.c and kem.c are separate translation 65| | // units, but we expect that downstream consumers will copy this code and/or 66| | // change how it is built. 67| 89| __asm__("" : "+r"(b) : /* no inputs */); 68| 89|#endif 69| | 70| 89| bvec = _mm256_set1_epi64x(-(uint64_t)b); 71| 178| for(i=0;ivec[4*i+0]); 126| 528| f1 = _mm256_load_si256(&a->vec[4*i+1]); 127| 528| f2 = _mm256_load_si256(&a->vec[4*i+2]); 128| 528| f3 = _mm256_load_si256(&a->vec[4*i+3]); 129| 528| f0 = _mm256_mulhi_epi16(f0,v); 130| 528| f1 = _mm256_mulhi_epi16(f1,v); 131| 528| f2 = _mm256_mulhi_epi16(f2,v); 132| 528| f3 = _mm256_mulhi_epi16(f3,v); 133| 528| f0 = _mm256_mulhrs_epi16(f0,shift1); 134| 528| f1 = _mm256_mulhrs_epi16(f1,shift1); 135| 528| f2 = _mm256_mulhrs_epi16(f2,shift1); 136| 528| f3 = _mm256_mulhrs_epi16(f3,shift1); 137| 528| f0 = _mm256_and_si256(f0,mask); 138| 528| f1 = _mm256_and_si256(f1,mask); 139| 528| f2 = _mm256_and_si256(f2,mask); 140| 528| f3 = _mm256_and_si256(f3,mask); 141| 528| f0 = _mm256_packus_epi16(f0,f1); 142| 528| f2 = _mm256_packus_epi16(f2,f3); 143| 528| f0 = _mm256_maddubs_epi16(f0,shift2); 144| 528| f2 = _mm256_maddubs_epi16(f2,shift2); 145| 528| f0 = _mm256_packus_epi16(f0,f2); 146| 528| f0 = _mm256_permutevar8x32_epi32(f0,permdidx); 147| 528| _mm256_storeu_si256((__m256i *)&r[32*i],f0); 148| 528| } 149| 132|} pqcrystals_kyber512_avx2_poly_decompress: 152| 66|{ 153| 66| unsigned int i; 154| 66| __m128i t; 155| 66| __m256i f; 156| 66| const __m256i q = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 39| 66|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 66|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ const __m256i q = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 6| 66|#define _16XQ 0 ------------------ 157| 66| const __m256i shufbidx = _mm256_set_epi8(7,7,7,7,6,6,6,6,5,5,5,5,4,4,4,4, 158| 66| 3,3,3,3,2,2,2,2,1,1,1,1,0,0,0,0); 159| 66| const __m256i mask = _mm256_set1_epi32(0x00F0000F); 160| 66| const __m256i shift = _mm256_set1_epi32((128 << 16) + 2048); 161| | 162| 1.12k| for(i=0;ivec[i],f); 170| 1.05k| } 171| 66|} pqcrystals_kyber512_avx2_poly_tobytes: 255| 264|{ 256| 264| ntttobytes_avx(r, a->vec, qdata.vec); ------------------ | | 23| 264|#define ntttobytes_avx KYBER_NAMESPACE(ntttobytes_avx) | | ------------------ | | | | 15| 264|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ ntttobytes_avx(r, a->vec, qdata.vec); ------------------ | | 39| 264|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 264|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 257| 264|} pqcrystals_kyber512_avx2_poly_frombytes: 270| 396|{ 271| 396| nttfrombytes_avx(r->vec, a, qdata.vec); ------------------ | | 25| 396|#define nttfrombytes_avx KYBER_NAMESPACE(nttfrombytes_avx) | | ------------------ | | | | 15| 396|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ nttfrombytes_avx(r->vec, a, qdata.vec); ------------------ | | 39| 396|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 396|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 272| 396|} pqcrystals_kyber512_avx2_poly_frommsg: 283| 132|{ 284| |#if (KYBER_INDCPA_MSGBYTES != 32) 285| |#error "KYBER_INDCPA_MSGBYTES must be equal to 32!" 286| |#endif 287| 132| __m256i f, g0, g1, g2, g3, h0, h1, h2, h3; 288| 132| const __m256i shift = _mm256_broadcastsi128_si256(_mm_set_epi32(0,1,2,3)); 289| 132| const __m256i idx = _mm256_broadcastsi128_si256(_mm_set_epi8(15,14,11,10,7,6,3,2,13,12,9,8,5,4,1,0)); 290| 132| const __m256i hqs = _mm256_set1_epi16((KYBER_Q+1)/2); ------------------ | | 34| 132|#define KYBER_Q 3329 ------------------ 291| | 292| 132|#define FROMMSG64(i) \ 293| 132| g3 = _mm256_shuffle_epi32(f,0x55*i); \ 294| 132| g3 = _mm256_sllv_epi32(g3,shift); \ 295| 132| g3 = _mm256_shuffle_epi8(g3,idx); \ 296| 132| g0 = _mm256_slli_epi16(g3,12); \ 297| 132| g1 = _mm256_slli_epi16(g3,8); \ 298| 132| g2 = _mm256_slli_epi16(g3,4); \ 299| 132| g0 = _mm256_srai_epi16(g0,15); \ 300| 132| g1 = _mm256_srai_epi16(g1,15); \ 301| 132| g2 = _mm256_srai_epi16(g2,15); \ 302| 132| g3 = _mm256_srai_epi16(g3,15); \ 303| 132| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ 304| 132| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ 305| 132| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ 306| 132| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ 307| 132| h0 = _mm256_unpacklo_epi64(g0,g1); \ 308| 132| h2 = _mm256_unpackhi_epi64(g0,g1); \ 309| 132| h1 = _mm256_unpacklo_epi64(g2,g3); \ 310| 132| h3 = _mm256_unpackhi_epi64(g2,g3); \ 311| 132| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ 312| 132| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ 313| 132| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ 314| 132| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ 315| 132| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ 316| 132| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ 317| 132| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ 318| 132| _mm256_store_si256(&r->vec[8+2*i+1],g3) 319| | 320| 132| f = _mm256_loadu_si256((__m256i *)msg); 321| 132| FROMMSG64(0); ------------------ | | 293| 132| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 132| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 132| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 132| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 132| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 132| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 132| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 132| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 132| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 132| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 132| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 132| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 132| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 132| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 132| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 132| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 132| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 132| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 132| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 132| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 132| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 132| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 132| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 132| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 132| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 132| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 322| 132| FROMMSG64(1); ------------------ | | 293| 132| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 132| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 132| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 132| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 132| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 132| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 132| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 132| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 132| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 132| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 132| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 132| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 132| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 132| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 132| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 132| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 132| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 132| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 132| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 132| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 132| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 132| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 132| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 132| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 132| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 132| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 323| 132| FROMMSG64(2); ------------------ | | 293| 132| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 132| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 132| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 132| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 132| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 132| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 132| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 132| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 132| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 132| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 132| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 132| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 132| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 132| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 132| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 132| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 132| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 132| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 132| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 132| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 132| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 132| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 132| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 132| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 132| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 132| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 324| | FROMMSG64(3); ------------------ | | 293| 132| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 132| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 132| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 132| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 132| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 132| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 132| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 132| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 132| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 132| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 132| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 132| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 132| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 132| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 132| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 132| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 132| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 132| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 132| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 132| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 132| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 132| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 132| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 132| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 132| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 132| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 325| 132|} pqcrystals_kyber512_avx2_poly_tomsg: 339| 66|{ 340| 66| unsigned int i; 341| 66| uint32_t small; 342| 66| __m256i f0, f1, g0, g1; 343| 66| const __m256i hq = _mm256_set1_epi16((KYBER_Q - 1)/2); ------------------ | | 34| 66|#define KYBER_Q 3329 ------------------ 344| 66| const __m256i hhq = _mm256_set1_epi16((KYBER_Q - 1)/4); ------------------ | | 34| 66|#define KYBER_Q 3329 ------------------ 345| | 346| 594| for(i=0;ivec[2*i+0]); 348| 528| f1 = _mm256_load_si256(&a->vec[2*i+1]); 349| 528| f0 = _mm256_sub_epi16(hq, f0); 350| 528| f1 = _mm256_sub_epi16(hq, f1); 351| 528| g0 = _mm256_srai_epi16(f0, 15); 352| 528| g1 = _mm256_srai_epi16(f1, 15); 353| 528| f0 = _mm256_xor_si256(f0, g0); 354| 528| f1 = _mm256_xor_si256(f1, g1); 355| 528| f0 = _mm256_sub_epi16(f0, hhq); 356| 528| f1 = _mm256_sub_epi16(f1, hhq); 357| 528| f0 = _mm256_packs_epi16(f0, f1); 358| | f0 = _mm256_permute4x64_epi64(f0, 0xD8); 359| 528| small = _mm256_movemask_epi8(f0); 360| 528| memcpy(&msg[4*i], &small, 4); 361| 528| } 362| 66|} pqcrystals_kyber512_avx2_poly_getnoise_eta2: 397| 132|{ 398| 132| ALIGNED_UINT8(KYBER_ETA2*KYBER_N/4) buf; ------------------ | | 8| 132| union { \ | | 9| 132| uint8_t coeffs[N]; \ | | 10| 132| __m256i vec[(N+31)/32]; \ | | 11| 132| } ------------------ 399| 132| prf(buf.coeffs, KYBER_ETA2*KYBER_N/4, seed, nonce); ------------------ | | 58| 132| kyber_shake256_prf(OUT, OUTBYTES, KEY, NONCE) | | ------------------ | | | | 44| 132|#define kyber_shake256_prf KYBER_NAMESPACE(kyber_shake256_prf) | | | | ------------------ | | | | | | 15| 132|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | | | ------------------ | | ------------------ ------------------ 400| 132| poly_cbd_eta2(r, buf.vec); ------------------ | | 12| 132|#define poly_cbd_eta2 KYBER_NAMESPACE(poly_cbd_eta2) | | ------------------ | | | | 15| 132|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 401| 132|} pqcrystals_kyber512_avx2_poly_getnoise_eta2_4x: 415| 66|{ 416| 66| ALIGNED_UINT8(NOISE_NBLOCKS*SHAKE256_RATE) buf[4]; ------------------ | | 8| 66| union { \ | | 9| 66| uint8_t coeffs[N]; \ | | 10| 66| __m256i vec[(N+31)/32]; \ | | 11| 66| } ------------------ 417| 66| __m256i f; 418| 66| shake256x4incctx state; ------------------ | | 27| 66|#define shake256x4incctx OQS_SHA3_shake256_x4_inc_ctx ------------------ 419| | 420| 66| f = _mm256_loadu_si256((__m256i *)seed); 421| 66| _mm256_store_si256(buf[0].vec, f); 422| 66| _mm256_store_si256(buf[1].vec, f); 423| 66| _mm256_store_si256(buf[2].vec, f); 424| 66| _mm256_store_si256(buf[3].vec, f); 425| | 426| 66| buf[0].coeffs[32] = nonce0; 427| 66| buf[1].coeffs[32] = nonce1; 428| 66| buf[2].coeffs[32] = nonce2; 429| 66| buf[3].coeffs[32] = nonce3; 430| | 431| 66| shake256x4_inc_init(&state); ------------------ | | 28| 66|#define shake256x4_inc_init OQS_SHA3_shake256_x4_inc_init ------------------ 432| 66| shake256x4_absorb_once(&state, buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 33); ------------------ | | 42| 66|#define shake256x4_absorb_once OQS_SHA3_shake256_x4_absorb_once ------------------ 433| 66| shake256x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, NOISE_NBLOCKS, &state); ------------------ | | 49| 66| OQS_SHA3_shake256_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE256_RATE, STATE) | | ------------------ | | | | 320| 66|#define OQS_SHA3_SHAKE256_RATE 136 | | ------------------ ------------------ 434| 66| shake256x4_inc_ctx_release(&state); ------------------ | | 32| 66|#define shake256x4_inc_ctx_release OQS_SHA3_shake256_x4_inc_ctx_release ------------------ 435| | 436| 66| poly_cbd_eta1(r0, buf[0].vec); ------------------ | | 9| 66|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 15| 66|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 437| 66| poly_cbd_eta1(r1, buf[1].vec); ------------------ | | 9| 66|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 15| 66|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 438| 66| poly_cbd_eta1(r2, buf[2].vec); ------------------ | | 9| 66|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 15| 66|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 439| 66| poly_cbd_eta1(r3, buf[3].vec); ------------------ | | 9| 66|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 15| 66|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 440| 66|} pqcrystals_kyber512_avx2_poly_getnoise_eta1122_4x: 452| 132|{ 453| 132| ALIGNED_UINT8(NOISE_NBLOCKS*SHAKE256_RATE) buf[4]; ------------------ | | 8| 132| union { \ | | 9| 132| uint8_t coeffs[N]; \ | | 10| 132| __m256i vec[(N+31)/32]; \ | | 11| 132| } ------------------ 454| 132| __m256i f; 455| 132| shake256x4incctx state; ------------------ | | 27| 132|#define shake256x4incctx OQS_SHA3_shake256_x4_inc_ctx ------------------ 456| | 457| 132| f = _mm256_loadu_si256((__m256i *)seed); 458| 132| _mm256_store_si256(buf[0].vec, f); 459| 132| _mm256_store_si256(buf[1].vec, f); 460| 132| _mm256_store_si256(buf[2].vec, f); 461| 132| _mm256_store_si256(buf[3].vec, f); 462| | 463| 132| buf[0].coeffs[32] = nonce0; 464| 132| buf[1].coeffs[32] = nonce1; 465| 132| buf[2].coeffs[32] = nonce2; 466| 132| buf[3].coeffs[32] = nonce3; 467| | 468| 132| shake256x4_inc_init(&state); ------------------ | | 28| 132|#define shake256x4_inc_init OQS_SHA3_shake256_x4_inc_init ------------------ 469| 132| shake256x4_absorb_once(&state, buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 33); ------------------ | | 42| 132|#define shake256x4_absorb_once OQS_SHA3_shake256_x4_absorb_once ------------------ 470| 132| shake256x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, NOISE_NBLOCKS, &state); ------------------ | | 49| 132| OQS_SHA3_shake256_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE256_RATE, STATE) | | ------------------ | | | | 320| 132|#define OQS_SHA3_SHAKE256_RATE 136 | | ------------------ ------------------ 471| 132| shake256x4_inc_ctx_release(&state); ------------------ | | 32| 132|#define shake256x4_inc_ctx_release OQS_SHA3_shake256_x4_inc_ctx_release ------------------ 472| | 473| 132| poly_cbd_eta1(r0, buf[0].vec); ------------------ | | 9| 132|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 15| 132|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 474| 132| poly_cbd_eta1(r1, buf[1].vec); ------------------ | | 9| 132|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 15| 132|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 475| 132| poly_cbd_eta2(r2, buf[2].vec); ------------------ | | 12| 132|#define poly_cbd_eta2 KYBER_NAMESPACE(poly_cbd_eta2) | | ------------------ | | | | 15| 132|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 476| 132| poly_cbd_eta2(r3, buf[3].vec); ------------------ | | 12| 132|#define poly_cbd_eta2 KYBER_NAMESPACE(poly_cbd_eta2) | | ------------------ | | | | 15| 132|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 477| 132|} pqcrystals_kyber512_avx2_poly_ntt: 495| 660|{ 496| 660| ntt_avx(r->vec, qdata.vec); ------------------ | | 7| 660|#define ntt_avx KYBER_NAMESPACE(ntt_avx) | | ------------------ | | | | 15| 660|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ ntt_avx(r->vec, qdata.vec); ------------------ | | 39| 660|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 660|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 497| 660|} pqcrystals_kyber512_avx2_poly_invntt_tomont: 512| 462|{ 513| 462| invntt_avx(r->vec, qdata.vec); ------------------ | | 9| 462|#define invntt_avx KYBER_NAMESPACE(invntt_avx) | | ------------------ | | | | 15| 462|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ invntt_avx(r->vec, qdata.vec); ------------------ | | 39| 462|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 462|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 514| 462|} pqcrystals_kyber512_avx2_poly_nttunpack: 517| 792|{ 518| 792| nttunpack_avx(r->vec, qdata.vec); ------------------ | | 14| 792|#define nttunpack_avx KYBER_NAMESPACE(nttunpack_avx) | | ------------------ | | | | 15| 792|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ nttunpack_avx(r->vec, qdata.vec); ------------------ | | 39| 792|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 792|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 519| 792|} pqcrystals_kyber512_avx2_poly_basemul_montgomery: 534| 1.18k|{ 535| 1.18k| basemul_avx(r->vec, a->vec, b->vec, qdata.vec); ------------------ | | 17| 1.18k|#define basemul_avx KYBER_NAMESPACE(basemul_avx) | | ------------------ | | | | 15| 1.18k|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ basemul_avx(r->vec, a->vec, b->vec, qdata.vec); ------------------ | | 39| 1.18k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 1.18k|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 536| 1.18k|} pqcrystals_kyber512_avx2_poly_tomont: 547| 132|{ 548| 132| tomont_avx(r->vec, qdata.vec); ------------------ | | 9| 132|#define tomont_avx KYBER_NAMESPACE(tomont_avx) | | ------------------ | | | | 15| 132|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ tomont_avx(r->vec, qdata.vec); ------------------ | | 39| 132|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 132|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 549| 132|} pqcrystals_kyber512_avx2_poly_reduce: 560| 726|{ 561| 726| reduce_avx(r->vec, qdata.vec); ------------------ | | 7| 726|#define reduce_avx KYBER_NAMESPACE(reduce_avx) | | ------------------ | | | | 15| 726|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ reduce_avx(r->vec, qdata.vec); ------------------ | | 39| 726|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 726|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 562| 726|} pqcrystals_kyber512_avx2_poly_add: 575| 1.25k|{ 576| 1.25k| unsigned int i; 577| 1.25k| __m256i f0, f1; 578| | 579| 21.3k| for(i=0;ivec[i]); 581| 20.0k| f1 = _mm256_load_si256(&b->vec[i]); 582| 20.0k| f0 = _mm256_add_epi16(f0, f1); 583| 20.0k| _mm256_store_si256(&r->vec[i], f0); 584| 20.0k| } 585| 1.25k|} pqcrystals_kyber512_avx2_poly_sub: 598| 66|{ 599| 66| unsigned int i; 600| 66| __m256i f0, f1; 601| | 602| 1.12k| for(i=0;ivec[i]); 604| 1.05k| f1 = _mm256_load_si256(&b->vec[i]); 605| 1.05k| f0 = _mm256_sub_epi16(f0, f1); 606| 1.05k| _mm256_store_si256(&r->vec[i], f0); 607| 1.05k| } 608| 66|} pqcrystals_kyber512_avx2_polyvec_compress: 158| 132|{ 159| 132| unsigned int i; 160| | 161| 132|#if (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 320)) 162| 396| for(i=0;ivec[i]); 164| |#elif (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 352)) 165| | for(i=0;ivec[i]); 167| |#endif 168| 132|} pqcrystals_kyber512_avx2_polyvec_decompress: 181| 66|{ 182| 66| unsigned int i; 183| | 184| 66|#if (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 320)) 185| 198| for(i=0;ivec[i],&a[320*i]); 187| |#elif (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 352)) 188| | for(i=0;ivec[i],&a[352*i]); 190| |#endif 191| 66|} pqcrystals_kyber512_avx2_polyvec_tobytes: 203| 132|{ 204| 132| unsigned int i; 205| 396| for(i=0;ivec[i]); ------------------ | | 15| 264|#define poly_tobytes KYBER_NAMESPACE(poly_tobytes) | | ------------------ | | | | 15| 264|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ poly_tobytes(r+i*KYBER_POLYBYTES, &a->vec[i]); ------------------ | | 39| 264|#define KYBER_POLYBYTES 384 ------------------ 207| 132|} pqcrystals_kyber512_avx2_polyvec_frombytes: 220| 198|{ 221| 198| unsigned int i; 222| 594| for(i=0;ivec[i], a+i*KYBER_POLYBYTES); ------------------ | | 17| 396|#define poly_frombytes KYBER_NAMESPACE(poly_frombytes) | | ------------------ | | | | 15| 396|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ poly_frombytes(&r->vec[i], a+i*KYBER_POLYBYTES); ------------------ | | 39| 396|#define KYBER_POLYBYTES 384 ------------------ 224| 198|} pqcrystals_kyber512_avx2_polyvec_ntt: 234| 330|{ 235| 330| unsigned int i; 236| 990| for(i=0;ivec[i]); ------------------ | | 58| 660|#define poly_ntt KYBER_NAMESPACE(poly_ntt) | | ------------------ | | | | 15| 660|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 238| 330|} pqcrystals_kyber512_avx2_polyvec_invntt_tomont: 249| 132|{ 250| 132| unsigned int i; 251| 396| for(i=0;ivec[i]); ------------------ | | 60| 264|#define poly_invntt_tomont KYBER_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 15| 264|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 253| 132|} pqcrystals_kyber512_avx2_polyvec_basemul_acc_montgomery: 266| 594|{ 267| 594| unsigned int i; 268| 594| poly tmp; 269| | 270| 594| poly_basemul_montgomery(r,&a->vec[0],&b->vec[0]); ------------------ | | 64| 594|#define poly_basemul_montgomery KYBER_NAMESPACE(poly_basemul_montgomery) | | ------------------ | | | | 15| 594|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 271| 1.18k| for(i=1;ivec[i],&b->vec[i]); ------------------ | | 64| 594|#define poly_basemul_montgomery KYBER_NAMESPACE(poly_basemul_montgomery) | | ------------------ | | | | 15| 594|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 273| 594| poly_add(r,r,&tmp); ------------------ | | 72| 594|#define poly_add KYBER_NAMESPACE(poly_add) | | ------------------ | | | | 15| 594|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 274| 594| } 275| 594|} pqcrystals_kyber512_avx2_polyvec_reduce: 287| 264|{ 288| 264| unsigned int i; 289| 792| for(i=0;ivec[i]); ------------------ | | 69| 528|#define poly_reduce KYBER_NAMESPACE(poly_reduce) | | ------------------ | | | | 15| 528|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 291| 264|} pqcrystals_kyber512_avx2_polyvec_add: 303| 198|{ 304| 198| unsigned int i; 305| 594| for(i=0;ivec[i], &a->vec[i], &b->vec[i]); ------------------ | | 72| 396|#define poly_add KYBER_NAMESPACE(poly_add) | | ------------------ | | | | 15| 396|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ 307| 198|} polyvec.c:poly_compress10: 12| 1.06k|{ 13| 1.06k| unsigned int i; 14| 1.06k| __m256i f0, f1, f2; 15| 1.06k| __m128i t0, t1; 16| 1.06k| const __m256i v = _mm256_load_si256(&qdata.vec[_16XV/16]); ------------------ | | 39| 1.06k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 1.06k|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ const __m256i v = _mm256_load_si256(&qdata.vec[_16XV/16]); ------------------ | | 8| 1.06k|#define _16XV 32 ------------------ 17| 1.06k| const __m256i v8 = _mm256_slli_epi16(v,3); 18| 1.06k| const __m256i off = _mm256_set1_epi16(15); 19| 1.06k| const __m256i shift1 = _mm256_set1_epi16(1 << 12); 20| 1.06k| const __m256i mask = _mm256_set1_epi16(1023); 21| 1.06k| const __m256i shift2 = _mm256_set1_epi64x((1024LL << 48) + (1LL << 32) + (1024 << 16) + 1); 22| 1.06k| const __m256i sllvdidx = _mm256_set1_epi64x(12); 23| 1.06k| const __m256i shufbidx = _mm256_set_epi8( 8, 4, 3, 2, 1, 0,-1,-1,-1,-1,-1,-1,12,11,10, 9, 24| 1.06k| -1,-1,-1,-1,-1,-1,12,11,10, 9, 8, 4, 3, 2, 1, 0); 25| | 26| 18.0k| for(i=0;ivec[i]); 28| 16.9k| f1 = _mm256_mullo_epi16(f0,v8); 29| 16.9k| f2 = _mm256_add_epi16(f0,off); 30| 16.9k| f0 = _mm256_slli_epi16(f0,3); 31| 16.9k| f0 = _mm256_mulhi_epi16(f0,v); 32| 16.9k| f2 = _mm256_sub_epi16(f1,f2); 33| 16.9k| f1 = _mm256_andnot_si256(f1,f2); 34| 16.9k| f1 = _mm256_srli_epi16(f1,15); 35| 16.9k| f0 = _mm256_sub_epi16(f0,f1); 36| 16.9k| f0 = _mm256_mulhrs_epi16(f0,shift1); 37| 16.9k| f0 = _mm256_and_si256(f0,mask); 38| 16.9k| f0 = _mm256_madd_epi16(f0,shift2); 39| 16.9k| f0 = _mm256_sllv_epi32(f0,sllvdidx); 40| 16.9k| f0 = _mm256_srli_epi64(f0,12); 41| 16.9k| f0 = _mm256_shuffle_epi8(f0,shufbidx); 42| 16.9k| t0 = _mm256_castsi256_si128(f0); 43| 16.9k| t1 = _mm256_extracti128_si256(f0,1); 44| | t0 = _mm_blend_epi16(t0,t1,0xE0); 45| 16.9k| _mm_storeu_si128((__m128i *)&r[20*i+ 0],t0); 46| 16.9k| memcpy(&r[20*i+16],&t1,4); 47| 16.9k| } 48| 1.06k|} polyvec.c:poly_decompress10: 51| 531|{ 52| 531| unsigned int i; 53| 531| __m256i f; 54| 531| const __m256i q = _mm256_set1_epi32((KYBER_Q << 16) + 4*KYBER_Q); ------------------ | | 34| 531|#define KYBER_Q 3329 ------------------ const __m256i q = _mm256_set1_epi32((KYBER_Q << 16) + 4*KYBER_Q); ------------------ | | 34| 531|#define KYBER_Q 3329 ------------------ 55| 531| const __m256i shufbidx = _mm256_set_epi8(11,10,10, 9, 9, 8, 8, 7, 56| 531| 6, 5, 5, 4, 4, 3, 3, 2, 57| 531| 9, 8, 8, 7, 7, 6, 6, 5, 58| 531| 4, 3, 3, 2, 2, 1, 1, 0); 59| 531| const __m256i sllvdidx = _mm256_set1_epi64x(4); 60| 531| const __m256i mask = _mm256_set1_epi32((32736 << 16) + 8184); 61| | 62| 9.02k| for(i=0;ivec[i],f); 71| 8.49k| } 72| 531|} pqcrystals_kyber512_avx2_rej_uniform_avx: 275| 792|{ 276| 792| unsigned int ctr, pos; 277| 792| uint16_t val0, val1; 278| 792| uint32_t good; 279| |#ifdef BMI 280| | uint64_t idx0, idx1, idx2, idx3; 281| |#endif 282| 792| const __m256i bound = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 39| 792|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 15| 792|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_avx2_##s | | ------------------ ------------------ const __m256i bound = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 6| 792|#define _16XQ 0 ------------------ 283| 792| const __m256i ones = _mm256_set1_epi8(1); 284| 792| const __m256i mask = _mm256_set1_epi16(0xFFF); 285| 792| const __m256i idx8 = _mm256_set_epi8(15,14,14,13,12,11,11,10, 286| 792| 9, 8, 8, 7, 6, 5, 5, 4, 287| 792| 11,10,10, 9, 8, 7, 7, 6, 288| 792| 5, 4, 4, 3, 2, 1, 1, 0); 289| 792| __m256i f0, f1, g0, g1, g2, g3; 290| 792| __m128i f, t, pilo, pihi; 291| | 292| 792| ctr = pos = 0; 293| 8.15k| while(ctr <= KYBER_N - 32 && pos <= REJ_UNIFORM_AVX_BUFLEN - 48) { ------------------ | | 33| 8.15k|#define KYBER_N 256 ------------------ while(ctr <= KYBER_N - 32 && pos <= REJ_UNIFORM_AVX_BUFLEN - 48) { ------------------ | | 9| 7.37k|#define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 8| 7.37k|#define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 33| 7.37k|#define KYBER_N 256 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 34| 7.37k|#define KYBER_Q 3329 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 7.37k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 7.37k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 7.37k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 7.37k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 7.37k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 7.37k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 50| 7.37k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | ------------------ | | | | | | 8| 7.37k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 7.37k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (293:9): [True: 7.37k, False: 786] | Branch (293:32): [True: 7.36k, False: 6] ------------------ 294| 7.36k| f0 = _mm256_loadu_si256((__m256i *)&buf[pos]); 295| 7.36k| f1 = _mm256_loadu_si256((__m256i *)&buf[pos+24]); 296| 7.36k| f0 = _mm256_permute4x64_epi64(f0, 0x94); 297| 7.36k| f1 = _mm256_permute4x64_epi64(f1, 0x94); 298| 7.36k| f0 = _mm256_shuffle_epi8(f0, idx8); 299| 7.36k| f1 = _mm256_shuffle_epi8(f1, idx8); 300| 7.36k| g0 = _mm256_srli_epi16(f0, 4); 301| 7.36k| g1 = _mm256_srli_epi16(f1, 4); 302| 7.36k| f0 = _mm256_blend_epi16(f0, g0, 0xAA); 303| 7.36k| f1 = _mm256_blend_epi16(f1, g1, 0xAA); 304| 7.36k| f0 = _mm256_and_si256(f0, mask); 305| 7.36k| f1 = _mm256_and_si256(f1, mask); 306| 7.36k| pos += 48; 307| | 308| 7.36k| g0 = _mm256_cmpgt_epi16(bound, f0); 309| 7.36k| g1 = _mm256_cmpgt_epi16(bound, f1); 310| | 311| 7.36k| g0 = _mm256_packs_epi16(g0, g1); 312| 7.36k| good = _mm256_movemask_epi8(g0); 313| | 314| |#ifdef BMI 315| | idx0 = _pdep_u64(good >> 0, 0x0101010101010101); 316| | idx1 = _pdep_u64(good >> 8, 0x0101010101010101); 317| | idx2 = _pdep_u64(good >> 16, 0x0101010101010101); 318| | idx3 = _pdep_u64(good >> 24, 0x0101010101010101); 319| | idx0 = (idx0 << 8) - idx0; 320| | idx0 = _pext_u64(0x0E0C0A0806040200, idx0); 321| | idx1 = (idx1 << 8) - idx1; 322| | idx1 = _pext_u64(0x0E0C0A0806040200, idx1); 323| | idx2 = (idx2 << 8) - idx2; 324| | idx2 = _pext_u64(0x0E0C0A0806040200, idx2); 325| | idx3 = (idx3 << 8) - idx3; 326| | idx3 = _pext_u64(0x0E0C0A0806040200, idx3); 327| | 328| | g0 = _mm256_castsi128_si256(_mm_cvtsi64_si128(idx0)); 329| | g1 = _mm256_castsi128_si256(_mm_cvtsi64_si128(idx1)); 330| | g0 = _mm256_inserti128_si256(g0, _mm_cvtsi64_si128(idx2), 1); 331| | g1 = _mm256_inserti128_si256(g1, _mm_cvtsi64_si128(idx3), 1); 332| |#else 333| 7.36k| g0 = _mm256_castsi128_si256(_mm_loadl_epi64((__m128i *)&idx[(good >> 0) & 0xFF])); 334| 7.36k| g1 = _mm256_castsi128_si256(_mm_loadl_epi64((__m128i *)&idx[(good >> 8) & 0xFF])); 335| 7.36k| g0 = _mm256_inserti128_si256(g0, _mm_loadl_epi64((__m128i *)&idx[(good >> 16) & 0xFF]), 1); 336| 7.36k| g1 = _mm256_inserti128_si256(g1, _mm_loadl_epi64((__m128i *)&idx[(good >> 24) & 0xFF]), 1); 337| 7.36k|#endif 338| | 339| 7.36k| g2 = _mm256_add_epi8(g0, ones); 340| 7.36k| g3 = _mm256_add_epi8(g1, ones); 341| 7.36k| g0 = _mm256_unpacklo_epi8(g0, g2); 342| 7.36k| g1 = _mm256_unpacklo_epi8(g1, g3); 343| | 344| 7.36k| f0 = _mm256_shuffle_epi8(f0, g0); 345| 7.36k| f1 = _mm256_shuffle_epi8(f1, g1); 346| | 347| 7.36k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_castsi256_si128(f0)); 348| 7.36k| ctr += _mm_popcnt_u32((good >> 0) & 0xFF); 349| 7.36k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_extracti128_si256(f0, 1)); 350| 7.36k| ctr += _mm_popcnt_u32((good >> 16) & 0xFF); 351| 7.36k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_castsi256_si128(f1)); 352| 7.36k| ctr += _mm_popcnt_u32((good >> 8) & 0xFF); 353| 7.36k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_extracti128_si256(f1, 1)); 354| 7.36k| ctr += _mm_popcnt_u32((good >> 24) & 0xFF); 355| 7.36k| } 356| | 357| 2.68k| while(ctr <= KYBER_N - 8 && pos <= REJ_UNIFORM_AVX_BUFLEN - 12) { ------------------ | | 33| 2.68k|#define KYBER_N 256 ------------------ while(ctr <= KYBER_N - 8 && pos <= REJ_UNIFORM_AVX_BUFLEN - 12) { ------------------ | | 9| 1.93k|#define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 8| 1.93k|#define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 33| 1.93k|#define KYBER_N 256 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 34| 1.93k|#define KYBER_Q 3329 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 1.93k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 1.93k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 1.93k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 1.93k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 1.93k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 1.93k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 50| 1.93k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | ------------------ | | | | | | 8| 1.93k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 1.93k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (357:9): [True: 1.93k, False: 744] | Branch (357:31): [True: 1.89k, False: 48] ------------------ 358| 1.89k| f = _mm_loadu_si128((__m128i *)&buf[pos]); 359| 1.89k| f = _mm_shuffle_epi8(f, _mm256_castsi256_si128(idx8)); 360| 1.89k| t = _mm_srli_epi16(f, 4); 361| 1.89k| f = _mm_blend_epi16(f, t, 0xAA); 362| 1.89k| f = _mm_and_si128(f, _mm256_castsi256_si128(mask)); 363| 1.89k| pos += 12; 364| | 365| 1.89k| t = _mm_cmpgt_epi16(_mm256_castsi256_si128(bound), f); 366| 1.89k| good = _mm_movemask_epi8(t); 367| | 368| |#ifdef BMI 369| | good &= 0x5555; 370| | idx0 = _pdep_u64(good, 0x1111111111111111); 371| | idx0 = (idx0 << 8) - idx0; 372| | idx0 = _pext_u64(0x0E0C0A0806040200, idx0); 373| | pilo = _mm_cvtsi64_si128(idx0); 374| |#else 375| 1.89k| good = _pext_u32(good, 0x5555); 376| 1.89k| pilo = _mm_loadl_epi64((__m128i *)&idx[good]); 377| 1.89k|#endif 378| | 379| 1.89k| pihi = _mm_add_epi8(pilo, _mm256_castsi256_si128(ones)); 380| 1.89k| pilo = _mm_unpacklo_epi8(pilo, pihi); 381| 1.89k| f = _mm_shuffle_epi8(f, pilo); 382| 1.89k| _mm_storeu_si128((__m128i *)&r[ctr], f); 383| 1.89k| ctr += _mm_popcnt_u32(good); 384| 1.89k| } 385| | 386| 2.60k| while(ctr < KYBER_N && pos <= REJ_UNIFORM_AVX_BUFLEN - 3) { ------------------ | | 33| 5.20k|#define KYBER_N 256 ------------------ while(ctr < KYBER_N && pos <= REJ_UNIFORM_AVX_BUFLEN - 3) { ------------------ | | 9| 1.99k|#define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 8| 1.99k|#define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 33| 1.99k|#define KYBER_N 256 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 34| 1.99k|#define KYBER_Q 3329 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 1.99k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 1.99k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 1.99k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 1.99k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 1.99k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 1.99k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 50| 1.99k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | ------------------ | | | | | | 8| 1.99k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 1.99k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (386:9): [True: 1.99k, False: 612] | Branch (386:26): [True: 1.81k, False: 180] ------------------ 387| 1.81k| val0 = ((buf[pos+0] >> 0) | ((uint16_t)buf[pos+1] << 8)) & 0xFFF; 388| 1.81k| val1 = ((buf[pos+1] >> 4) | ((uint16_t)buf[pos+2] << 4)); 389| 1.81k| pos += 3; 390| | 391| 1.81k| if(val0 < KYBER_Q) ------------------ | | 34| 1.81k|#define KYBER_Q 3329 ------------------ | Branch (391:8): [True: 1.34k, False: 465] ------------------ 392| 1.34k| r[ctr++] = val0; 393| 1.81k| if(val1 < KYBER_Q && ctr < KYBER_N) ------------------ | | 34| 3.62k|#define KYBER_Q 3329 ------------------ if(val1 < KYBER_Q && ctr < KYBER_N) ------------------ | | 33| 1.42k|#define KYBER_N 256 ------------------ | Branch (393:8): [True: 1.42k, False: 384] | Branch (393:26): [True: 1.21k, False: 216] ------------------ 394| 1.21k| r[ctr++] = val1; 395| 1.81k| } 396| | 397| 792| return ctr; 398| 792|} pqcrystals_kyber512_avx2_kyber_shake256_prf: 44| 132|{ 45| 132| uint8_t extkey[KYBER_SYMBYTES+1]; 46| | 47| 132| memcpy(extkey, key, KYBER_SYMBYTES); ------------------ | | 36| 132|#define KYBER_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 48| 132| extkey[KYBER_SYMBYTES] = nonce; ------------------ | | 36| 132|#define KYBER_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 49| | 50| 132| shake256(out, outlen, extkey, sizeof(extkey)); ------------------ | | 12| 132|#define shake256 OQS_SHA3_shake256 ------------------ 51| 132|} pqcrystals_kyber512_avx2_verify: 18| 66|{ 19| 66| size_t i; 20| 66| uint64_t r; 21| 66| __m256i f, g, h; 22| | 23| 66| h = _mm256_setzero_si256(); 24| 1.65k| for(i=0;i> 63; 39| 66| return r; 40| 66|} pqcrystals_kyber512_avx2_cmov: 56| 66|{ 57| 66| size_t i; 58| 66| __m256i xvec, rvec, bvec; 59| | 60| 66|#if defined(__GNUC__) || defined(__clang__) 61| | // Prevent the compiler from 62| | // 1) inferring that b is 0/1-valued, and 63| | // 2) handling the two cases with a branch. 64| | // This is not necessary when verify.c and kem.c are separate translation 65| | // units, but we expect that downstream consumers will copy this code and/or 66| | // change how it is built. 67| 66| __asm__("" : "+r"(b) : /* no inputs */); 68| 66|#endif 69| | 70| 66| bvec = _mm256_set1_epi64x(-(uint64_t)b); 71| 132| for(i=0;i> 0) | ((uint16_t)buf[pos+1] << 8)) & 0xFFF; 135| 4.09k| val1 = ((buf[pos+1] >> 4) | ((uint16_t)buf[pos+2] << 4)) & 0xFFF; 136| 4.09k| pos += 3; 137| | 138| 4.09k| if(val0 < KYBER_Q) ------------------ | | 34| 4.09k|#define KYBER_Q 3329 ------------------ | Branch (138:8): [True: 3.01k, False: 1.08k] ------------------ 139| 3.01k| r[ctr++] = val0; 140| 4.09k| if(ctr < len && val1 < KYBER_Q) ------------------ | | 34| 3.52k|#define KYBER_Q 3329 ------------------ | Branch (140:8): [True: 3.52k, False: 573] | Branch (140:21): [True: 2.54k, False: 984] ------------------ 141| 2.54k| r[ctr++] = val1; 142| 4.09k| } 143| | 144| 3.21k| return ctr; 145| 3.21k|} indcpa.c:pack_sk: 61| 288|{ 62| 288| polyvec_tobytes(r, sk); ------------------ | | 17| 288|#define polyvec_tobytes KYBER_NAMESPACE(polyvec_tobytes) | | ------------------ | | | | 15| 288|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_ref_##s | | ------------------ ------------------ 63| 288|} indcpa.c:pack_ciphertext: 90| 576|{ 91| 576| polyvec_compress(r, b); ------------------ | | 12| 576|#define polyvec_compress KYBER_NAMESPACE(polyvec_compress) | | ------------------ | | | | 15| 576|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_ref_##s | | ------------------ ------------------ 92| 576| poly_compress(r+KYBER_POLYVECCOMPRESSEDBYTES, v); ------------------ | | 15| 576|#define poly_compress KYBER_NAMESPACE(poly_compress) | | ------------------ | | | | 15| 576|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_ref_##s | | ------------------ ------------------ poly_compress(r+KYBER_POLYVECCOMPRESSEDBYTES, v); ------------------ | | 45| 576|#define KYBER_POLYVECCOMPRESSEDBYTES (KYBER_K * 320) ------------------ 93| 576|} indcpa.c:unpack_ciphertext: 106| 288|{ 107| 288| polyvec_decompress(b, c); ------------------ | | 14| 288|#define polyvec_decompress KYBER_NAMESPACE(polyvec_decompress) | | ------------------ | | | | 15| 288|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_ref_##s | | ------------------ ------------------ 108| 288| poly_decompress(v, c+KYBER_POLYVECCOMPRESSEDBYTES); ------------------ | | 17| 288|#define poly_decompress KYBER_NAMESPACE(poly_decompress) | | ------------------ | | | | 15| 288|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_ref_##s | | ------------------ ------------------ poly_decompress(v, c+KYBER_POLYVECCOMPRESSEDBYTES); ------------------ | | 45| 288|#define KYBER_POLYVECCOMPRESSEDBYTES (KYBER_K * 320) ------------------ 109| 288|} indcpa.c:unpack_sk: 74| 288|{ 75| 288| polyvec_frombytes(sk, packedsk); ------------------ | | 19| 288|#define polyvec_frombytes KYBER_NAMESPACE(polyvec_frombytes) | | ------------------ | | | | 15| 288|#define KYBER_NAMESPACE(s) pqcrystals_kyber512_ref_##s | | ------------------ ------------------ 76| 288|} pqcrystals_kyber768_avx2_poly_cbd_eta1: 127| 3.19k|{ 128| 3.19k|#if KYBER_ETA1 == 2 129| 3.19k| cbd2(r, buf); 130| |#elif KYBER_ETA1 == 3 131| | cbd3(r, (uint8_t *)buf); 132| |#else 133| |#error "This implementation requires eta1 in {2,3}" 134| |#endif 135| 3.19k|} pqcrystals_kyber768_avx2_gen_matrix: 271| 399|{ 272| 399| unsigned int ctr0, ctr1, ctr2, ctr3; 273| 399| ALIGNED_UINT8(REJ_UNIFORM_AVX_NBLOCKS*SHAKE128_RATE) buf[4]; ------------------ | | 8| 399| union { \ | | 9| 399| uint8_t coeffs[N]; \ | | 10| 399| __m256i vec[(N+31)/32]; \ | | 11| 399| } ------------------ 274| 399| __m256i f; 275| 399| shake128x4incctx state; ------------------ | | 18| 399|#define shake128x4incctx OQS_SHA3_shake128_x4_inc_ctx ------------------ 276| 399| shake128incctx state1x; ------------------ | | 38| 399|#define shake128incctx OQS_SHA3_shake128_inc_ctx ------------------ 277| | 278| 399| f = _mm256_loadu_si256((__m256i *)seed); 279| 399| _mm256_store_si256(buf[0].vec, f); 280| 399| _mm256_store_si256(buf[1].vec, f); 281| 399| _mm256_store_si256(buf[2].vec, f); 282| 399| _mm256_store_si256(buf[3].vec, f); 283| | 284| 399| if(transposed) { ------------------ | Branch (284:6): [True: 266, False: 133] ------------------ 285| 266| buf[0].coeffs[32] = 0; 286| 266| buf[0].coeffs[33] = 0; 287| 266| buf[1].coeffs[32] = 0; 288| 266| buf[1].coeffs[33] = 1; 289| 266| buf[2].coeffs[32] = 0; 290| 266| buf[2].coeffs[33] = 2; 291| 266| buf[3].coeffs[32] = 1; 292| 266| buf[3].coeffs[33] = 0; 293| 266| } 294| 133| else { 295| 133| buf[0].coeffs[32] = 0; 296| 133| buf[0].coeffs[33] = 0; 297| 133| buf[1].coeffs[32] = 1; 298| 133| buf[1].coeffs[33] = 0; 299| 133| buf[2].coeffs[32] = 2; 300| 133| buf[2].coeffs[33] = 0; 301| 133| buf[3].coeffs[32] = 0; 302| 133| buf[3].coeffs[33] = 1; 303| 133| } 304| | 305| 399| shake128x4_inc_init(&state); ------------------ | | 19| 399|#define shake128x4_inc_init OQS_SHA3_shake128_x4_inc_init ------------------ 306| 399| shake128x4_absorb_once(&state, buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 34); ------------------ | | 39| 399|#define shake128x4_absorb_once OQS_SHA3_shake128_x4_absorb_once ------------------ 307| 399| shake128x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, REJ_UNIFORM_AVX_NBLOCKS, &state); ------------------ | | 46| 399| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | ------------------ | | | | 239| 399|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 308| | 309| 399| ctr0 = rej_uniform_avx(a[0].vec[0].coeffs, buf[0].coeffs); ------------------ | | 11| 399|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 21| 399|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 310| 399| ctr1 = rej_uniform_avx(a[0].vec[1].coeffs, buf[1].coeffs); ------------------ | | 11| 399|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 21| 399|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 311| 399| ctr2 = rej_uniform_avx(a[0].vec[2].coeffs, buf[2].coeffs); ------------------ | | 11| 399|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 21| 399|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 312| 399| ctr3 = rej_uniform_avx(a[1].vec[0].coeffs, buf[3].coeffs); ------------------ | | 11| 399|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 21| 399|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 313| | 314| 558| while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 1.11k|#define KYBER_N 256 ------------------ while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 1.07k|#define KYBER_N 256 ------------------ while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 1.03k|#define KYBER_N 256 ------------------ while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 432|#define KYBER_N 256 ------------------ | Branch (314:9): [True: 42, False: 516] | Branch (314:27): [True: 36, False: 480] | Branch (314:45): [True: 48, False: 432] | Branch (314:63): [True: 33, False: 399] ------------------ 315| 159| shake128x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 1, &state); ------------------ | | 46| 159| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | ------------------ | | | | 239| 159|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 316| | 317| 159| ctr0 += rej_uniform(a[0].vec[0].coeffs + ctr0, KYBER_N - ctr0, buf[0].coeffs, SHAKE128_RATE); ------------------ | | 33| 159|#define KYBER_N 256 ------------------ ctr0 += rej_uniform(a[0].vec[0].coeffs + ctr0, KYBER_N - ctr0, buf[0].coeffs, SHAKE128_RATE); ------------------ | | 8| 159|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 159|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 318| 159| ctr1 += rej_uniform(a[0].vec[1].coeffs + ctr1, KYBER_N - ctr1, buf[1].coeffs, SHAKE128_RATE); ------------------ | | 33| 159|#define KYBER_N 256 ------------------ ctr1 += rej_uniform(a[0].vec[1].coeffs + ctr1, KYBER_N - ctr1, buf[1].coeffs, SHAKE128_RATE); ------------------ | | 8| 159|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 159|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 319| 159| ctr2 += rej_uniform(a[0].vec[2].coeffs + ctr2, KYBER_N - ctr2, buf[2].coeffs, SHAKE128_RATE); ------------------ | | 33| 159|#define KYBER_N 256 ------------------ ctr2 += rej_uniform(a[0].vec[2].coeffs + ctr2, KYBER_N - ctr2, buf[2].coeffs, SHAKE128_RATE); ------------------ | | 8| 159|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 159|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 320| 159| ctr3 += rej_uniform(a[1].vec[0].coeffs + ctr3, KYBER_N - ctr3, buf[3].coeffs, SHAKE128_RATE); ------------------ | | 33| 159|#define KYBER_N 256 ------------------ ctr3 += rej_uniform(a[1].vec[0].coeffs + ctr3, KYBER_N - ctr3, buf[3].coeffs, SHAKE128_RATE); ------------------ | | 8| 159|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 159|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 321| 159| } 322| | 323| 399| poly_nttunpack(&a[0].vec[0]); ------------------ | | 62| 399|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 21| 399|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 324| 399| poly_nttunpack(&a[0].vec[1]); ------------------ | | 62| 399|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 21| 399|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 325| 399| poly_nttunpack(&a[0].vec[2]); ------------------ | | 62| 399|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 21| 399|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 326| 399| poly_nttunpack(&a[1].vec[0]); ------------------ | | 62| 399|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 21| 399|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 327| | 328| 399| f = _mm256_loadu_si256((__m256i *)seed); 329| 399| _mm256_store_si256(buf[0].vec, f); 330| 399| _mm256_store_si256(buf[1].vec, f); 331| 399| _mm256_store_si256(buf[2].vec, f); 332| 399| _mm256_store_si256(buf[3].vec, f); 333| | 334| 399| if(transposed) { ------------------ | Branch (334:6): [True: 266, False: 133] ------------------ 335| 266| buf[0].coeffs[32] = 1; 336| 266| buf[0].coeffs[33] = 1; 337| 266| buf[1].coeffs[32] = 1; 338| 266| buf[1].coeffs[33] = 2; 339| 266| buf[2].coeffs[32] = 2; 340| 266| buf[2].coeffs[33] = 0; 341| 266| buf[3].coeffs[32] = 2; 342| 266| buf[3].coeffs[33] = 1; 343| 266| } 344| 133| else { 345| 133| buf[0].coeffs[32] = 1; 346| 133| buf[0].coeffs[33] = 1; 347| 133| buf[1].coeffs[32] = 2; 348| 133| buf[1].coeffs[33] = 1; 349| 133| buf[2].coeffs[32] = 0; 350| 133| buf[2].coeffs[33] = 2; 351| 133| buf[3].coeffs[32] = 1; 352| 133| buf[3].coeffs[33] = 2; 353| 133| } 354| | 355| 399| shake128x4_absorb_once(&state, buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 34); ------------------ | | 39| 399|#define shake128x4_absorb_once OQS_SHA3_shake128_x4_absorb_once ------------------ 356| 399| shake128x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, REJ_UNIFORM_AVX_NBLOCKS, &state); ------------------ | | 46| 399| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | ------------------ | | | | 239| 399|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 357| | 358| 399| ctr0 = rej_uniform_avx(a[1].vec[1].coeffs, buf[0].coeffs); ------------------ | | 11| 399|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 21| 399|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 359| 399| ctr1 = rej_uniform_avx(a[1].vec[2].coeffs, buf[1].coeffs); ------------------ | | 11| 399|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 21| 399|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 360| 399| ctr2 = rej_uniform_avx(a[2].vec[0].coeffs, buf[2].coeffs); ------------------ | | 11| 399|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 21| 399|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 361| 399| ctr3 = rej_uniform_avx(a[2].vec[1].coeffs, buf[3].coeffs); ------------------ | | 11| 399|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 21| 399|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 362| | 363| 582| while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 1.16k|#define KYBER_N 256 ------------------ while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 1.11k|#define KYBER_N 256 ------------------ while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 1.07k|#define KYBER_N 256 ------------------ while(ctr0 < KYBER_N || ctr1 < KYBER_N || ctr2 < KYBER_N || ctr3 < KYBER_N) { ------------------ | | 33| 438|#define KYBER_N 256 ------------------ | Branch (363:9): [True: 48, False: 534] | Branch (363:27): [True: 45, False: 489] | Branch (363:45): [True: 51, False: 438] | Branch (363:63): [True: 39, False: 399] ------------------ 364| 183| shake128x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 1, &state); ------------------ | | 46| 183| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | ------------------ | | | | 239| 183|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 365| | 366| 183| ctr0 += rej_uniform(a[1].vec[1].coeffs + ctr0, KYBER_N - ctr0, buf[0].coeffs, SHAKE128_RATE); ------------------ | | 33| 183|#define KYBER_N 256 ------------------ ctr0 += rej_uniform(a[1].vec[1].coeffs + ctr0, KYBER_N - ctr0, buf[0].coeffs, SHAKE128_RATE); ------------------ | | 8| 183|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 183|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 367| 183| ctr1 += rej_uniform(a[1].vec[2].coeffs + ctr1, KYBER_N - ctr1, buf[1].coeffs, SHAKE128_RATE); ------------------ | | 33| 183|#define KYBER_N 256 ------------------ ctr1 += rej_uniform(a[1].vec[2].coeffs + ctr1, KYBER_N - ctr1, buf[1].coeffs, SHAKE128_RATE); ------------------ | | 8| 183|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 183|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 368| 183| ctr2 += rej_uniform(a[2].vec[0].coeffs + ctr2, KYBER_N - ctr2, buf[2].coeffs, SHAKE128_RATE); ------------------ | | 33| 183|#define KYBER_N 256 ------------------ ctr2 += rej_uniform(a[2].vec[0].coeffs + ctr2, KYBER_N - ctr2, buf[2].coeffs, SHAKE128_RATE); ------------------ | | 8| 183|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 183|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 369| 183| ctr3 += rej_uniform(a[2].vec[1].coeffs + ctr3, KYBER_N - ctr3, buf[3].coeffs, SHAKE128_RATE); ------------------ | | 33| 183|#define KYBER_N 256 ------------------ ctr3 += rej_uniform(a[2].vec[1].coeffs + ctr3, KYBER_N - ctr3, buf[3].coeffs, SHAKE128_RATE); ------------------ | | 8| 183|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 183|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 370| 183| } 371| 399| shake128x4_inc_ctx_release(&state); ------------------ | | 23| 399|#define shake128x4_inc_ctx_release OQS_SHA3_shake128_x4_inc_ctx_release ------------------ 372| | 373| 399| poly_nttunpack(&a[1].vec[1]); ------------------ | | 62| 399|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 21| 399|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 374| 399| poly_nttunpack(&a[1].vec[2]); ------------------ | | 62| 399|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 21| 399|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 375| 399| poly_nttunpack(&a[2].vec[0]); ------------------ | | 62| 399|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 21| 399|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 376| 399| poly_nttunpack(&a[2].vec[1]); ------------------ | | 62| 399|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 21| 399|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 377| | 378| 399| f = _mm256_loadu_si256((__m256i *)seed); 379| 399| _mm256_store_si256(buf[0].vec, f); 380| 399| buf[0].coeffs[32] = 2; 381| 399| buf[0].coeffs[33] = 2; 382| | 383| 399| shake128_inc_init(&state1x); ------------------ | | 39| 399|#define shake128_inc_init OQS_SHA3_shake128_inc_init ------------------ 384| 399| shake128_absorb_once(&state1x, buf[0].coeffs, 34); ------------------ | | 57| 399|#define shake128_absorb_once OQS_SHA3_shake128_absorb_once ------------------ 385| 399| shake128_squeezeblocks(buf[0].coeffs, REJ_UNIFORM_AVX_NBLOCKS, &state1x); ------------------ | | 64| 399| OQS_SHA3_shake128_inc_squeeze(OUT, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | ------------------ | | | | 239| 399|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 386| 399| ctr0 = rej_uniform_avx(a[2].vec[2].coeffs, buf[0].coeffs); ------------------ | | 11| 399|#define rej_uniform_avx KYBER_NAMESPACE(rej_uniform_avx) | | ------------------ | | | | 21| 399|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 387| 453| while(ctr0 < KYBER_N) { ------------------ | | 33| 453|#define KYBER_N 256 ------------------ | Branch (387:9): [True: 54, False: 399] ------------------ 388| 54| shake128_squeezeblocks(buf[0].coeffs, 1, &state1x); ------------------ | | 64| 54| OQS_SHA3_shake128_inc_squeeze(OUT, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | ------------------ | | | | 239| 54|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 389| 54| ctr0 += rej_uniform(a[2].vec[2].coeffs + ctr0, KYBER_N - ctr0, buf[0].coeffs, SHAKE128_RATE); ------------------ | | 33| 54|#define KYBER_N 256 ------------------ ctr0 += rej_uniform(a[2].vec[2].coeffs + ctr0, KYBER_N - ctr0, buf[0].coeffs, SHAKE128_RATE); ------------------ | | 8| 54|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | ------------------ | | | | 239| 54|#define OQS_SHA3_SHAKE128_RATE 168 | | ------------------ ------------------ 390| 54| } 391| 399| shake128_inc_ctx_release(&state1x); ------------------ | | 43| 399|#define shake128_inc_ctx_release OQS_SHA3_shake128_inc_ctx_release ------------------ 392| | 393| 399| poly_nttunpack(&a[2].vec[2]); ------------------ | | 62| 399|#define poly_nttunpack KYBER_NAMESPACE(poly_nttunpack) | | ------------------ | | | | 21| 399|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 394| 399|} pqcrystals_kyber768_avx2_indcpa_keypair: 472| 133|{ 473| 133| unsigned int i; 474| 133| uint8_t buf[2*KYBER_SYMBYTES]; 475| 133| const uint8_t *publicseed = buf; 476| 133| const uint8_t *noiseseed = buf + KYBER_SYMBYTES; ------------------ | | 36| 133|#define KYBER_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 477| 133| polyvec a[KYBER_K], e, pkpv, skpv; 478| | 479| 133| randombytes(buf, KYBER_SYMBYTES); ------------------ | | 8| 133|#define randombytes OQS_randombytes ------------------ randombytes(buf, KYBER_SYMBYTES); ------------------ | | 36| 133|#define KYBER_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 480| 133| hash_g(buf, buf, KYBER_SYMBYTES); ------------------ | | 53| 133|#define hash_g(OUT, IN, INBYTES) sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 31| 133|#define sha3_512 OQS_SHA3_sha3_512 | | ------------------ ------------------ 481| | 482| 133| gen_a(a, publicseed); ------------------ | | 157| 133|#define gen_a(A,B) gen_matrix(A,B,0) | | ------------------ | | | | 8| 133|#define gen_matrix KYBER_NAMESPACE(gen_matrix) | | | | ------------------ | | | | | | 21| 133|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | | | ------------------ | | ------------------ ------------------ 483| | 484| |#ifdef KYBER_90S 485| |#define NOISE_NBLOCKS ((KYBER_ETA1*KYBER_N/4)/AES256CTR_BLOCKBYTES) /* Assumes divisibility */ 486| | uint64_t nonce = 0; 487| | ALIGNED_UINT8(NOISE_NBLOCKS*AES256CTR_BLOCKBYTES+32) coins; // +32 bytes as required by poly_cbd_eta1 488| | aes256ctr_ctx state; 489| | aes256ctr_init_u64(&state, noiseseed, nonce++); 490| | for(i=0;ivec[4*i+0]); 126| 1.06k| f1 = _mm256_load_si256(&a->vec[4*i+1]); 127| 1.06k| f2 = _mm256_load_si256(&a->vec[4*i+2]); 128| 1.06k| f3 = _mm256_load_si256(&a->vec[4*i+3]); 129| 1.06k| f0 = _mm256_mulhi_epi16(f0,v); 130| 1.06k| f1 = _mm256_mulhi_epi16(f1,v); 131| 1.06k| f2 = _mm256_mulhi_epi16(f2,v); 132| 1.06k| f3 = _mm256_mulhi_epi16(f3,v); 133| 1.06k| f0 = _mm256_mulhrs_epi16(f0,shift1); 134| 1.06k| f1 = _mm256_mulhrs_epi16(f1,shift1); 135| 1.06k| f2 = _mm256_mulhrs_epi16(f2,shift1); 136| 1.06k| f3 = _mm256_mulhrs_epi16(f3,shift1); 137| 1.06k| f0 = _mm256_and_si256(f0,mask); 138| 1.06k| f1 = _mm256_and_si256(f1,mask); 139| 1.06k| f2 = _mm256_and_si256(f2,mask); 140| 1.06k| f3 = _mm256_and_si256(f3,mask); 141| 1.06k| f0 = _mm256_packus_epi16(f0,f1); 142| 1.06k| f2 = _mm256_packus_epi16(f2,f3); 143| 1.06k| f0 = _mm256_maddubs_epi16(f0,shift2); 144| 1.06k| f2 = _mm256_maddubs_epi16(f2,shift2); 145| 1.06k| f0 = _mm256_packus_epi16(f0,f2); 146| 1.06k| f0 = _mm256_permutevar8x32_epi32(f0,permdidx); 147| 1.06k| _mm256_storeu_si256((__m256i *)&r[32*i],f0); 148| 1.06k| } 149| 266|} pqcrystals_kyber768_avx2_poly_decompress: 152| 133|{ 153| 133| unsigned int i; 154| 133| __m128i t; 155| 133| __m256i f; 156| 133| const __m256i q = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 39| 133|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 21| 133|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ const __m256i q = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 6| 133|#define _16XQ 0 ------------------ 157| 133| const __m256i shufbidx = _mm256_set_epi8(7,7,7,7,6,6,6,6,5,5,5,5,4,4,4,4, 158| 133| 3,3,3,3,2,2,2,2,1,1,1,1,0,0,0,0); 159| 133| const __m256i mask = _mm256_set1_epi32(0x00F0000F); 160| 133| const __m256i shift = _mm256_set1_epi32((128 << 16) + 2048); 161| | 162| 2.26k| for(i=0;ivec[i],f); 170| 2.12k| } 171| 133|} pqcrystals_kyber768_avx2_poly_tobytes: 255| 798|{ 256| 798| ntttobytes_avx(r, a->vec, qdata.vec); ------------------ | | 23| 798|#define ntttobytes_avx KYBER_NAMESPACE(ntttobytes_avx) | | ------------------ | | | | 21| 798|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ ntttobytes_avx(r, a->vec, qdata.vec); ------------------ | | 39| 798|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 21| 798|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 257| 798|} pqcrystals_kyber768_avx2_poly_frombytes: 270| 1.19k|{ 271| 1.19k| nttfrombytes_avx(r->vec, a, qdata.vec); ------------------ | | 25| 1.19k|#define nttfrombytes_avx KYBER_NAMESPACE(nttfrombytes_avx) | | ------------------ | | | | 21| 1.19k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ nttfrombytes_avx(r->vec, a, qdata.vec); ------------------ | | 39| 1.19k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 21| 1.19k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 272| 1.19k|} pqcrystals_kyber768_avx2_poly_frommsg: 283| 266|{ 284| |#if (KYBER_INDCPA_MSGBYTES != 32) 285| |#error "KYBER_INDCPA_MSGBYTES must be equal to 32!" 286| |#endif 287| 266| __m256i f, g0, g1, g2, g3, h0, h1, h2, h3; 288| 266| const __m256i shift = _mm256_broadcastsi128_si256(_mm_set_epi32(0,1,2,3)); 289| 266| const __m256i idx = _mm256_broadcastsi128_si256(_mm_set_epi8(15,14,11,10,7,6,3,2,13,12,9,8,5,4,1,0)); 290| 266| const __m256i hqs = _mm256_set1_epi16((KYBER_Q+1)/2); ------------------ | | 34| 266|#define KYBER_Q 3329 ------------------ 291| | 292| 266|#define FROMMSG64(i) \ 293| 266| g3 = _mm256_shuffle_epi32(f,0x55*i); \ 294| 266| g3 = _mm256_sllv_epi32(g3,shift); \ 295| 266| g3 = _mm256_shuffle_epi8(g3,idx); \ 296| 266| g0 = _mm256_slli_epi16(g3,12); \ 297| 266| g1 = _mm256_slli_epi16(g3,8); \ 298| 266| g2 = _mm256_slli_epi16(g3,4); \ 299| 266| g0 = _mm256_srai_epi16(g0,15); \ 300| 266| g1 = _mm256_srai_epi16(g1,15); \ 301| 266| g2 = _mm256_srai_epi16(g2,15); \ 302| 266| g3 = _mm256_srai_epi16(g3,15); \ 303| 266| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ 304| 266| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ 305| 266| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ 306| 266| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ 307| 266| h0 = _mm256_unpacklo_epi64(g0,g1); \ 308| 266| h2 = _mm256_unpackhi_epi64(g0,g1); \ 309| 266| h1 = _mm256_unpacklo_epi64(g2,g3); \ 310| 266| h3 = _mm256_unpackhi_epi64(g2,g3); \ 311| 266| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ 312| 266| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ 313| 266| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ 314| 266| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ 315| 266| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ 316| 266| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ 317| 266| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ 318| 266| _mm256_store_si256(&r->vec[8+2*i+1],g3) 319| | 320| 266| f = _mm256_loadu_si256((__m256i *)msg); 321| 266| FROMMSG64(0); ------------------ | | 293| 266| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 266| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 266| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 266| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 266| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 266| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 266| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 266| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 266| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 266| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 266| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 266| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 266| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 266| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 266| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 266| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 266| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 266| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 266| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 266| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 266| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 266| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 266| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 266| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 266| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 266| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 322| 266| FROMMSG64(1); ------------------ | | 293| 266| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 266| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 266| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 266| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 266| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 266| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 266| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 266| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 266| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 266| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 266| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 266| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 266| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 266| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 266| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 266| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 266| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 266| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 266| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 266| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 266| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 266| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 266| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 266| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 266| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 266| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 323| 266| FROMMSG64(2); ------------------ | | 293| 266| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 266| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 266| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 266| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 266| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 266| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 266| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 266| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 266| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 266| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 266| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 266| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 266| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 266| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 266| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 266| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 266| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 266| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 266| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 266| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 266| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 266| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 266| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 266| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 266| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 266| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 324| | FROMMSG64(3); ------------------ | | 293| 266| g3 = _mm256_shuffle_epi32(f,0x55*i); \ | | 294| 266| g3 = _mm256_sllv_epi32(g3,shift); \ | | 295| 266| g3 = _mm256_shuffle_epi8(g3,idx); \ | | 296| 266| g0 = _mm256_slli_epi16(g3,12); \ | | 297| 266| g1 = _mm256_slli_epi16(g3,8); \ | | 298| 266| g2 = _mm256_slli_epi16(g3,4); \ | | 299| 266| g0 = _mm256_srai_epi16(g0,15); \ | | 300| 266| g1 = _mm256_srai_epi16(g1,15); \ | | 301| 266| g2 = _mm256_srai_epi16(g2,15); \ | | 302| 266| g3 = _mm256_srai_epi16(g3,15); \ | | 303| 266| g0 = _mm256_and_si256(g0,hqs); /* 19 18 17 16 3 2 1 0 */ \ | | 304| 266| g1 = _mm256_and_si256(g1,hqs); /* 23 22 21 20 7 6 5 4 */ \ | | 305| 266| g2 = _mm256_and_si256(g2,hqs); /* 27 26 25 24 11 10 9 8 */ \ | | 306| 266| g3 = _mm256_and_si256(g3,hqs); /* 31 30 29 28 15 14 13 12 */ \ | | 307| 266| h0 = _mm256_unpacklo_epi64(g0,g1); \ | | 308| 266| h2 = _mm256_unpackhi_epi64(g0,g1); \ | | 309| 266| h1 = _mm256_unpacklo_epi64(g2,g3); \ | | 310| 266| h3 = _mm256_unpackhi_epi64(g2,g3); \ | | 311| 266| g0 = _mm256_permute2x128_si256(h0,h1,0x20); \ | | 312| 266| g2 = _mm256_permute2x128_si256(h0,h1,0x31); \ | | 313| 266| g1 = _mm256_permute2x128_si256(h2,h3,0x20); \ | | 314| 266| g3 = _mm256_permute2x128_si256(h2,h3,0x31); \ | | 315| 266| _mm256_store_si256(&r->vec[0+2*i+0],g0); \ | | 316| 266| _mm256_store_si256(&r->vec[0+2*i+1],g1); \ | | 317| 266| _mm256_store_si256(&r->vec[8+2*i+0],g2); \ | | 318| 266| _mm256_store_si256(&r->vec[8+2*i+1],g3) ------------------ 325| 266|} pqcrystals_kyber768_avx2_poly_tomsg: 339| 133|{ 340| 133| unsigned int i; 341| 133| uint32_t small; 342| 133| __m256i f0, f1, g0, g1; 343| 133| const __m256i hq = _mm256_set1_epi16((KYBER_Q - 1)/2); ------------------ | | 34| 133|#define KYBER_Q 3329 ------------------ 344| 133| const __m256i hhq = _mm256_set1_epi16((KYBER_Q - 1)/4); ------------------ | | 34| 133|#define KYBER_Q 3329 ------------------ 345| | 346| 1.19k| for(i=0;ivec[2*i+0]); 348| 1.06k| f1 = _mm256_load_si256(&a->vec[2*i+1]); 349| 1.06k| f0 = _mm256_sub_epi16(hq, f0); 350| 1.06k| f1 = _mm256_sub_epi16(hq, f1); 351| 1.06k| g0 = _mm256_srai_epi16(f0, 15); 352| 1.06k| g1 = _mm256_srai_epi16(f1, 15); 353| 1.06k| f0 = _mm256_xor_si256(f0, g0); 354| 1.06k| f1 = _mm256_xor_si256(f1, g1); 355| 1.06k| f0 = _mm256_sub_epi16(f0, hhq); 356| 1.06k| f1 = _mm256_sub_epi16(f1, hhq); 357| 1.06k| f0 = _mm256_packs_epi16(f0, f1); 358| | f0 = _mm256_permute4x64_epi64(f0, 0xD8); 359| 1.06k| small = _mm256_movemask_epi8(f0); 360| 1.06k| memcpy(&msg[4*i], &small, 4); 361| 1.06k| } 362| 133|} pqcrystals_kyber768_avx2_poly_getnoise_eta2_4x: 415| 798|{ 416| 798| ALIGNED_UINT8(NOISE_NBLOCKS*SHAKE256_RATE) buf[4]; ------------------ | | 8| 798| union { \ | | 9| 798| uint8_t coeffs[N]; \ | | 10| 798| __m256i vec[(N+31)/32]; \ | | 11| 798| } ------------------ 417| 798| __m256i f; 418| 798| shake256x4incctx state; ------------------ | | 27| 798|#define shake256x4incctx OQS_SHA3_shake256_x4_inc_ctx ------------------ 419| | 420| 798| f = _mm256_loadu_si256((__m256i *)seed); 421| 798| _mm256_store_si256(buf[0].vec, f); 422| 798| _mm256_store_si256(buf[1].vec, f); 423| 798| _mm256_store_si256(buf[2].vec, f); 424| 798| _mm256_store_si256(buf[3].vec, f); 425| | 426| 798| buf[0].coeffs[32] = nonce0; 427| 798| buf[1].coeffs[32] = nonce1; 428| 798| buf[2].coeffs[32] = nonce2; 429| 798| buf[3].coeffs[32] = nonce3; 430| | 431| 798| shake256x4_inc_init(&state); ------------------ | | 28| 798|#define shake256x4_inc_init OQS_SHA3_shake256_x4_inc_init ------------------ 432| 798| shake256x4_absorb_once(&state, buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, 33); ------------------ | | 42| 798|#define shake256x4_absorb_once OQS_SHA3_shake256_x4_absorb_once ------------------ 433| 798| shake256x4_squeezeblocks(buf[0].coeffs, buf[1].coeffs, buf[2].coeffs, buf[3].coeffs, NOISE_NBLOCKS, &state); ------------------ | | 49| 798| OQS_SHA3_shake256_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE256_RATE, STATE) | | ------------------ | | | | 320| 798|#define OQS_SHA3_SHAKE256_RATE 136 | | ------------------ ------------------ 434| 798| shake256x4_inc_ctx_release(&state); ------------------ | | 32| 798|#define shake256x4_inc_ctx_release OQS_SHA3_shake256_x4_inc_ctx_release ------------------ 435| | 436| 798| poly_cbd_eta1(r0, buf[0].vec); ------------------ | | 9| 798|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 21| 798|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 437| 798| poly_cbd_eta1(r1, buf[1].vec); ------------------ | | 9| 798|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 21| 798|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 438| 798| poly_cbd_eta1(r2, buf[2].vec); ------------------ | | 9| 798|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 21| 798|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 439| 798| poly_cbd_eta1(r3, buf[3].vec); ------------------ | | 9| 798|#define poly_cbd_eta1 KYBER_NAMESPACE(poly_cbd_eta1) | | ------------------ | | | | 21| 798|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 440| 798|} pqcrystals_kyber768_avx2_poly_ntt: 495| 1.99k|{ 496| 1.99k| ntt_avx(r->vec, qdata.vec); ------------------ | | 7| 1.99k|#define ntt_avx KYBER_NAMESPACE(ntt_avx) | | ------------------ | | | | 21| 1.99k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ ntt_avx(r->vec, qdata.vec); ------------------ | | 39| 1.99k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 21| 1.99k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 497| 1.99k|} pqcrystals_kyber768_avx2_poly_invntt_tomont: 512| 1.19k|{ 513| 1.19k| invntt_avx(r->vec, qdata.vec); ------------------ | | 9| 1.19k|#define invntt_avx KYBER_NAMESPACE(invntt_avx) | | ------------------ | | | | 21| 1.19k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ invntt_avx(r->vec, qdata.vec); ------------------ | | 39| 1.19k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 21| 1.19k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 514| 1.19k|} pqcrystals_kyber768_avx2_poly_nttunpack: 517| 3.59k|{ 518| 3.59k| nttunpack_avx(r->vec, qdata.vec); ------------------ | | 14| 3.59k|#define nttunpack_avx KYBER_NAMESPACE(nttunpack_avx) | | ------------------ | | | | 21| 3.59k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ nttunpack_avx(r->vec, qdata.vec); ------------------ | | 39| 3.59k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 21| 3.59k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 519| 3.59k|} pqcrystals_kyber768_avx2_poly_basemul_montgomery: 534| 4.78k|{ 535| 4.78k| basemul_avx(r->vec, a->vec, b->vec, qdata.vec); ------------------ | | 17| 4.78k|#define basemul_avx KYBER_NAMESPACE(basemul_avx) | | ------------------ | | | | 21| 4.78k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ basemul_avx(r->vec, a->vec, b->vec, qdata.vec); ------------------ | | 39| 4.78k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 21| 4.78k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 536| 4.78k|} pqcrystals_kyber768_avx2_poly_tomont: 547| 399|{ 548| 399| tomont_avx(r->vec, qdata.vec); ------------------ | | 9| 399|#define tomont_avx KYBER_NAMESPACE(tomont_avx) | | ------------------ | | | | 21| 399|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ tomont_avx(r->vec, qdata.vec); ------------------ | | 39| 399|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 21| 399|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 549| 399|} pqcrystals_kyber768_avx2_poly_reduce: 560| 1.99k|{ 561| 1.99k| reduce_avx(r->vec, qdata.vec); ------------------ | | 7| 1.99k|#define reduce_avx KYBER_NAMESPACE(reduce_avx) | | ------------------ | | | | 21| 1.99k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ reduce_avx(r->vec, qdata.vec); ------------------ | | 39| 1.99k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 21| 1.99k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 562| 1.99k|} pqcrystals_kyber768_avx2_poly_add: 575| 4.92k|{ 576| 4.92k| unsigned int i; 577| 4.92k| __m256i f0, f1; 578| | 579| 83.6k| for(i=0;ivec[i]); 581| 78.7k| f1 = _mm256_load_si256(&b->vec[i]); 582| 78.7k| f0 = _mm256_add_epi16(f0, f1); 583| 78.7k| _mm256_store_si256(&r->vec[i], f0); 584| 78.7k| } 585| 4.92k|} pqcrystals_kyber768_avx2_poly_sub: 598| 133|{ 599| 133| unsigned int i; 600| 133| __m256i f0, f1; 601| | 602| 2.26k| for(i=0;ivec[i]); 604| 2.12k| f1 = _mm256_load_si256(&b->vec[i]); 605| 2.12k| f0 = _mm256_sub_epi16(f0, f1); 606| 2.12k| _mm256_store_si256(&r->vec[i], f0); 607| 2.12k| } 608| 133|} pqcrystals_kyber768_avx2_polyvec_compress: 158| 266|{ 159| 266| unsigned int i; 160| | 161| 266|#if (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 320)) 162| 1.06k| for(i=0;ivec[i]); 164| |#elif (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 352)) 165| | for(i=0;ivec[i]); 167| |#endif 168| 266|} pqcrystals_kyber768_avx2_polyvec_decompress: 181| 133|{ 182| 133| unsigned int i; 183| | 184| 133|#if (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 320)) 185| 532| for(i=0;ivec[i],&a[320*i]); 187| |#elif (KYBER_POLYVECCOMPRESSEDBYTES == (KYBER_K * 352)) 188| | for(i=0;ivec[i],&a[352*i]); 190| |#endif 191| 133|} pqcrystals_kyber768_avx2_polyvec_tobytes: 203| 266|{ 204| 266| unsigned int i; 205| 1.06k| for(i=0;ivec[i]); ------------------ | | 15| 798|#define poly_tobytes KYBER_NAMESPACE(poly_tobytes) | | ------------------ | | | | 21| 798|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ poly_tobytes(r+i*KYBER_POLYBYTES, &a->vec[i]); ------------------ | | 39| 798|#define KYBER_POLYBYTES 384 ------------------ 207| 266|} pqcrystals_kyber768_avx2_polyvec_frombytes: 220| 399|{ 221| 399| unsigned int i; 222| 1.59k| for(i=0;ivec[i], a+i*KYBER_POLYBYTES); ------------------ | | 17| 1.19k|#define poly_frombytes KYBER_NAMESPACE(poly_frombytes) | | ------------------ | | | | 21| 1.19k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ poly_frombytes(&r->vec[i], a+i*KYBER_POLYBYTES); ------------------ | | 39| 1.19k|#define KYBER_POLYBYTES 384 ------------------ 224| 399|} pqcrystals_kyber768_avx2_polyvec_ntt: 234| 665|{ 235| 665| unsigned int i; 236| 2.66k| for(i=0;ivec[i]); ------------------ | | 58| 1.99k|#define poly_ntt KYBER_NAMESPACE(poly_ntt) | | ------------------ | | | | 21| 1.99k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 238| 665|} pqcrystals_kyber768_avx2_polyvec_invntt_tomont: 249| 266|{ 250| 266| unsigned int i; 251| 1.06k| for(i=0;ivec[i]); ------------------ | | 60| 798|#define poly_invntt_tomont KYBER_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 21| 798|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 253| 266|} pqcrystals_kyber768_avx2_polyvec_basemul_acc_montgomery: 266| 1.59k|{ 267| 1.59k| unsigned int i; 268| 1.59k| poly tmp; 269| | 270| 1.59k| poly_basemul_montgomery(r,&a->vec[0],&b->vec[0]); ------------------ | | 64| 1.59k|#define poly_basemul_montgomery KYBER_NAMESPACE(poly_basemul_montgomery) | | ------------------ | | | | 21| 1.59k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 271| 4.78k| for(i=1;ivec[i],&b->vec[i]); ------------------ | | 64| 3.19k|#define poly_basemul_montgomery KYBER_NAMESPACE(poly_basemul_montgomery) | | ------------------ | | | | 21| 3.19k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 273| 3.19k| poly_add(r,r,&tmp); ------------------ | | 72| 3.19k|#define poly_add KYBER_NAMESPACE(poly_add) | | ------------------ | | | | 21| 3.19k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 274| 3.19k| } 275| 1.59k|} pqcrystals_kyber768_avx2_polyvec_reduce: 287| 532|{ 288| 532| unsigned int i; 289| 2.12k| for(i=0;ivec[i]); ------------------ | | 69| 1.59k|#define poly_reduce KYBER_NAMESPACE(poly_reduce) | | ------------------ | | | | 21| 1.59k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 291| 532|} pqcrystals_kyber768_avx2_polyvec_add: 303| 399|{ 304| 399| unsigned int i; 305| 1.59k| for(i=0;ivec[i], &a->vec[i], &b->vec[i]); ------------------ | | 72| 1.19k|#define poly_add KYBER_NAMESPACE(poly_add) | | ------------------ | | | | 21| 1.19k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ 307| 399|} pqcrystals_kyber768_avx2_rej_uniform_avx: 275| 3.59k|{ 276| 3.59k| unsigned int ctr, pos; 277| 3.59k| uint16_t val0, val1; 278| 3.59k| uint32_t good; 279| |#ifdef BMI 280| | uint64_t idx0, idx1, idx2, idx3; 281| |#endif 282| 3.59k| const __m256i bound = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 39| 3.59k|#define qdata KYBER_NAMESPACE(qdata) | | ------------------ | | | | 21| 3.59k|#define KYBER_NAMESPACE(s) pqcrystals_kyber768_avx2_##s | | ------------------ ------------------ const __m256i bound = _mm256_load_si256(&qdata.vec[_16XQ/16]); ------------------ | | 6| 3.59k|#define _16XQ 0 ------------------ 283| 3.59k| const __m256i ones = _mm256_set1_epi8(1); 284| 3.59k| const __m256i mask = _mm256_set1_epi16(0xFFF); 285| 3.59k| const __m256i idx8 = _mm256_set_epi8(15,14,14,13,12,11,11,10, 286| 3.59k| 9, 8, 8, 7, 6, 5, 5, 4, 287| 3.59k| 11,10,10, 9, 8, 7, 7, 6, 288| 3.59k| 5, 4, 4, 3, 2, 1, 1, 0); 289| 3.59k| __m256i f0, f1, g0, g1, g2, g3; 290| 3.59k| __m128i f, t, pilo, pihi; 291| | 292| 3.59k| ctr = pos = 0; 293| 36.6k| while(ctr <= KYBER_N - 32 && pos <= REJ_UNIFORM_AVX_BUFLEN - 48) { ------------------ | | 33| 36.6k|#define KYBER_N 256 ------------------ while(ctr <= KYBER_N - 32 && pos <= REJ_UNIFORM_AVX_BUFLEN - 48) { ------------------ | | 9| 33.0k|#define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 8| 33.0k|#define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 33| 33.0k|#define KYBER_N 256 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 34| 33.0k|#define KYBER_Q 3329 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 33.0k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 33.0k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 33.0k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 33.0k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 33.0k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 33.0k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 50| 33.0k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | ------------------ | | | | | | 8| 33.0k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 33.0k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (293:9): [True: 33.0k, False: 3.58k] | Branch (293:32): [True: 33.0k, False: 9] ------------------ 294| 33.0k| f0 = _mm256_loadu_si256((__m256i *)&buf[pos]); 295| 33.0k| f1 = _mm256_loadu_si256((__m256i *)&buf[pos+24]); 296| 33.0k| f0 = _mm256_permute4x64_epi64(f0, 0x94); 297| 33.0k| f1 = _mm256_permute4x64_epi64(f1, 0x94); 298| 33.0k| f0 = _mm256_shuffle_epi8(f0, idx8); 299| 33.0k| f1 = _mm256_shuffle_epi8(f1, idx8); 300| 33.0k| g0 = _mm256_srli_epi16(f0, 4); 301| 33.0k| g1 = _mm256_srli_epi16(f1, 4); 302| 33.0k| f0 = _mm256_blend_epi16(f0, g0, 0xAA); 303| 33.0k| f1 = _mm256_blend_epi16(f1, g1, 0xAA); 304| 33.0k| f0 = _mm256_and_si256(f0, mask); 305| 33.0k| f1 = _mm256_and_si256(f1, mask); 306| 33.0k| pos += 48; 307| | 308| 33.0k| g0 = _mm256_cmpgt_epi16(bound, f0); 309| 33.0k| g1 = _mm256_cmpgt_epi16(bound, f1); 310| | 311| 33.0k| g0 = _mm256_packs_epi16(g0, g1); 312| 33.0k| good = _mm256_movemask_epi8(g0); 313| | 314| |#ifdef BMI 315| | idx0 = _pdep_u64(good >> 0, 0x0101010101010101); 316| | idx1 = _pdep_u64(good >> 8, 0x0101010101010101); 317| | idx2 = _pdep_u64(good >> 16, 0x0101010101010101); 318| | idx3 = _pdep_u64(good >> 24, 0x0101010101010101); 319| | idx0 = (idx0 << 8) - idx0; 320| | idx0 = _pext_u64(0x0E0C0A0806040200, idx0); 321| | idx1 = (idx1 << 8) - idx1; 322| | idx1 = _pext_u64(0x0E0C0A0806040200, idx1); 323| | idx2 = (idx2 << 8) - idx2; 324| | idx2 = _pext_u64(0x0E0C0A0806040200, idx2); 325| | idx3 = (idx3 << 8) - idx3; 326| | idx3 = _pext_u64(0x0E0C0A0806040200, idx3); 327| | 328| | g0 = _mm256_castsi128_si256(_mm_cvtsi64_si128(idx0)); 329| | g1 = _mm256_castsi128_si256(_mm_cvtsi64_si128(idx1)); 330| | g0 = _mm256_inserti128_si256(g0, _mm_cvtsi64_si128(idx2), 1); 331| | g1 = _mm256_inserti128_si256(g1, _mm_cvtsi64_si128(idx3), 1); 332| |#else 333| 33.0k| g0 = _mm256_castsi128_si256(_mm_loadl_epi64((__m128i *)&idx[(good >> 0) & 0xFF])); 334| 33.0k| g1 = _mm256_castsi128_si256(_mm_loadl_epi64((__m128i *)&idx[(good >> 8) & 0xFF])); 335| 33.0k| g0 = _mm256_inserti128_si256(g0, _mm_loadl_epi64((__m128i *)&idx[(good >> 16) & 0xFF]), 1); 336| 33.0k| g1 = _mm256_inserti128_si256(g1, _mm_loadl_epi64((__m128i *)&idx[(good >> 24) & 0xFF]), 1); 337| 33.0k|#endif 338| | 339| 33.0k| g2 = _mm256_add_epi8(g0, ones); 340| 33.0k| g3 = _mm256_add_epi8(g1, ones); 341| 33.0k| g0 = _mm256_unpacklo_epi8(g0, g2); 342| 33.0k| g1 = _mm256_unpacklo_epi8(g1, g3); 343| | 344| 33.0k| f0 = _mm256_shuffle_epi8(f0, g0); 345| 33.0k| f1 = _mm256_shuffle_epi8(f1, g1); 346| | 347| 33.0k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_castsi256_si128(f0)); 348| 33.0k| ctr += _mm_popcnt_u32((good >> 0) & 0xFF); 349| 33.0k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_extracti128_si256(f0, 1)); 350| 33.0k| ctr += _mm_popcnt_u32((good >> 16) & 0xFF); 351| 33.0k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_castsi256_si128(f1)); 352| 33.0k| ctr += _mm_popcnt_u32((good >> 8) & 0xFF); 353| 33.0k| _mm_storeu_si128((__m128i *)&r[ctr], _mm256_extracti128_si256(f1, 1)); 354| 33.0k| ctr += _mm_popcnt_u32((good >> 24) & 0xFF); 355| 33.0k| } 356| | 357| 12.0k| while(ctr <= KYBER_N - 8 && pos <= REJ_UNIFORM_AVX_BUFLEN - 12) { ------------------ | | 33| 12.0k|#define KYBER_N 256 ------------------ while(ctr <= KYBER_N - 8 && pos <= REJ_UNIFORM_AVX_BUFLEN - 12) { ------------------ | | 9| 8.51k|#define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 8| 8.51k|#define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 33| 8.51k|#define KYBER_N 256 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 34| 8.51k|#define KYBER_Q 3329 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 8.51k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 8.51k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 8.51k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 8.51k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 8.51k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 8.51k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 50| 8.51k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | ------------------ | | | | | | 8| 8.51k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 8.51k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (357:9): [True: 8.51k, False: 3.49k] | Branch (357:31): [True: 8.41k, False: 99] ------------------ 358| 8.41k| f = _mm_loadu_si128((__m128i *)&buf[pos]); 359| 8.41k| f = _mm_shuffle_epi8(f, _mm256_castsi256_si128(idx8)); 360| 8.41k| t = _mm_srli_epi16(f, 4); 361| 8.41k| f = _mm_blend_epi16(f, t, 0xAA); 362| 8.41k| f = _mm_and_si128(f, _mm256_castsi256_si128(mask)); 363| 8.41k| pos += 12; 364| | 365| 8.41k| t = _mm_cmpgt_epi16(_mm256_castsi256_si128(bound), f); 366| 8.41k| good = _mm_movemask_epi8(t); 367| | 368| |#ifdef BMI 369| | good &= 0x5555; 370| | idx0 = _pdep_u64(good, 0x1111111111111111); 371| | idx0 = (idx0 << 8) - idx0; 372| | idx0 = _pext_u64(0x0E0C0A0806040200, idx0); 373| | pilo = _mm_cvtsi64_si128(idx0); 374| |#else 375| 8.41k| good = _pext_u32(good, 0x5555); 376| 8.41k| pilo = _mm_loadl_epi64((__m128i *)&idx[good]); 377| 8.41k|#endif 378| | 379| 8.41k| pihi = _mm_add_epi8(pilo, _mm256_castsi256_si128(ones)); 380| 8.41k| pilo = _mm_unpacklo_epi8(pilo, pihi); 381| 8.41k| f = _mm_shuffle_epi8(f, pilo); 382| 8.41k| _mm_storeu_si128((__m128i *)&r[ctr], f); 383| 8.41k| ctr += _mm_popcnt_u32(good); 384| 8.41k| } 385| | 386| 12.3k| while(ctr < KYBER_N && pos <= REJ_UNIFORM_AVX_BUFLEN - 3) { ------------------ | | 33| 24.7k|#define KYBER_N 256 ------------------ while(ctr < KYBER_N && pos <= REJ_UNIFORM_AVX_BUFLEN - 3) { ------------------ | | 9| 9.22k|#define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 8| 9.22k|#define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 33| 9.22k|#define KYBER_N 256 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 34| 9.22k|#define KYBER_Q 3329 | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 9.22k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 9.22k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 9.22k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | #define REJ_UNIFORM_AVX_NBLOCKS ((12*KYBER_N/8*(1 << 12)/KYBER_Q + XOF_BLOCKBYTES)/XOF_BLOCKBYTES) | | | | ------------------ | | | | | | 50| 9.22k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 8| 9.22k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | | | ------------------ | | | | | | | | | | 239| 9.22k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define REJ_UNIFORM_AVX_BUFLEN (REJ_UNIFORM_AVX_NBLOCKS*XOF_BLOCKBYTES) | | ------------------ | | | | 50| 9.22k|#define XOF_BLOCKBYTES SHAKE128_RATE | | | | ------------------ | | | | | | 8| 9.22k|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 9.22k|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (386:9): [True: 9.22k, False: 3.17k] | Branch (386:26): [True: 8.80k, False: 420] ------------------ 387| 8.80k| val0 = ((buf[pos+0] >> 0) | ((uint16_t)buf[pos+1] << 8)) & 0xFFF; 388| 8.80k| val1 = ((buf[pos+1] >> 4) | ((uint16_t)buf[pos+2] << 4)); 389| 8.80k| pos += 3; 390| | 391| 8.80k| if(val0 < KYBER_Q) ------------------ | | 34| 8.80k|#define KYBER_Q 3329 ------------------ | Branch (391:8): [True: 7.06k, False: 1.73k] ------------------ 392| 7.06k| r[ctr++] = val0; 393| 8.80k| if(val1 < KYBER_Q && ctr < KYBER_N) ------------------ | | 34| 17.6k|#define KYBER_Q 3329 ------------------ if(val1 < KYBER_Q && ctr < KYBER_N) ------------------ | | 33| 7.01k|#define KYBER_N 256 ------------------ | Branch (393:8): [True: 7.01k, False: 1.79k] | Branch (393:26): [True: 5.79k, False: 1.21k] ------------------ 394| 5.79k| r[ctr++] = val1; 395| 8.80k| } 396| | 397| 3.59k| return ctr; 398| 3.59k|} pqcrystals_kyber768_avx2_verify: 18| 133|{ 19| 133| size_t i; 20| 133| uint64_t r; 21| 133| __m256i f, g, h; 22| | 23| 133| h = _mm256_setzero_si256(); 24| 4.65k| for(i=0;i> 63; 39| 133| return r; 40| 133|} pqcrystals_kyber768_avx2_cmov: 56| 133|{ 57| 133| size_t i; 58| 133| __m256i xvec, rvec, bvec; 59| | 60| 133|#if defined(__GNUC__) || defined(__clang__) 61| | // Prevent the compiler from 62| | // 1) inferring that b is 0/1-valued, and 63| | // 2) handling the two cases with a branch. 64| | // This is not necessary when verify.c and kem.c are separate translation 65| | // units, but we expect that downstream consumers will copy this code and/or 66| | // change how it is built. 67| 133| __asm__("" : "+r"(b) : /* no inputs */); 68| 133|#endif 69| | 70| 133| bvec = _mm256_set1_epi64x(-(uint64_t)b); 71| 266| for(i=0;imethod_name = OQS_KEM_alg_ml_kem_1024; ------------------ | | 78| 28|#define OQS_KEM_alg_ml_kem_1024 "ML-KEM-1024" ------------------ 16| 28| kem->alg_version = "FIPS203"; 17| | 18| 28| kem->claimed_nist_level = 5; 19| 28| kem->ind_cca = true; 20| | 21| 28| kem->length_public_key = OQS_KEM_ml_kem_1024_length_public_key; ------------------ | | 39| 28|#define OQS_KEM_ml_kem_1024_length_public_key 1568 ------------------ 22| 28| kem->length_secret_key = OQS_KEM_ml_kem_1024_length_secret_key; ------------------ | | 40| 28|#define OQS_KEM_ml_kem_1024_length_secret_key 3168 ------------------ 23| 28| kem->length_ciphertext = OQS_KEM_ml_kem_1024_length_ciphertext; ------------------ | | 41| 28|#define OQS_KEM_ml_kem_1024_length_ciphertext 1568 ------------------ 24| 28| kem->length_shared_secret = OQS_KEM_ml_kem_1024_length_shared_secret; ------------------ | | 42| 28|#define OQS_KEM_ml_kem_1024_length_shared_secret 32 ------------------ 25| 28| kem->length_keypair_seed = OQS_KEM_ml_kem_1024_length_keypair_seed; ------------------ | | 43| 28|#define OQS_KEM_ml_kem_1024_length_keypair_seed 64 ------------------ 26| 28| kem->length_encaps_seed = OQS_KEM_ml_kem_1024_length_encaps_seed; ------------------ | | 44| 28|#define OQS_KEM_ml_kem_1024_length_encaps_seed 32 ------------------ 27| | 28| 28| kem->keypair = OQS_KEM_ml_kem_1024_keypair; 29| 28| kem->keypair_derand = OQS_KEM_ml_kem_1024_keypair_derand; 30| 28| kem->encaps = OQS_KEM_ml_kem_1024_encaps; 31| 28| kem->encaps_derand = OQS_KEM_ml_kem_1024_encaps_derand; 32| 28| kem->decaps = OQS_KEM_ml_kem_1024_decaps; 33| | 34| 28| return kem; 35| 28|} OQS_KEM_ml_kem_1024_keypair: 102| 28|OQS_API OQS_STATUS OQS_KEM_ml_kem_1024_keypair(uint8_t *public_key, uint8_t *secret_key) { 103| |#if defined(OQS_USE_CUPQC) && defined(OQS_ENABLE_KEM_ml_kem_1024_cuda) 104| | return (OQS_STATUS) cupqc_ml_kem_1024_keypair(public_key, secret_key); 105| |#elif defined(OQS_USE_ICICLE) && defined(OQS_ENABLE_KEM_ml_kem_1024_icicle_cuda) 106| | return (OQS_STATUS) icicle_ml_kem_1024_keypair(public_key, secret_key); 107| |#elif defined(OQS_ENABLE_KEM_ml_kem_1024_x86_64) 108| |#if defined(OQS_DIST_BUILD) 109| 28| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (109:6): [True: 28, False: 0] | Branch (109:49): [True: 28, False: 0] | Branch (109:92): [True: 28, False: 0] ------------------ 110| 28|#endif /* OQS_DIST_BUILD */ 111| 28| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_keypair(public_key, secret_key); 112| 28|#if defined(OQS_DIST_BUILD) 113| 28| } else { 114| 0| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_C_keypair(public_key, secret_key); 115| 0| } 116| 28|#endif /* OQS_DIST_BUILD */ 117| |#elif defined(OQS_ENABLE_KEM_ml_kem_1024_aarch64) 118| |#if defined(OQS_DIST_BUILD) 119| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 120| |#endif /* OQS_DIST_BUILD */ 121| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_AARCH64_keypair(public_key, secret_key); 122| |#if defined(OQS_DIST_BUILD) 123| | } else { 124| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_C_keypair(public_key, secret_key); 125| | } 126| |#endif /* OQS_DIST_BUILD */ 127| |#else 128| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_C_keypair(public_key, secret_key); 129| |#endif 130| 28|} OQS_KEM_ml_kem_1024_encaps: 160| 28|OQS_API OQS_STATUS OQS_KEM_ml_kem_1024_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 161| |#if defined(OQS_USE_CUPQC) && defined(OQS_ENABLE_KEM_ml_kem_1024_cuda) 162| | return (OQS_STATUS) cupqc_ml_kem_1024_enc(ciphertext, shared_secret, public_key); 163| |#elif defined(OQS_USE_ICICLE) && defined(OQS_ENABLE_KEM_ml_kem_1024_icicle_cuda) 164| | return (OQS_STATUS) icicle_ml_kem_1024_enc(ciphertext, shared_secret, public_key); 165| |#elif defined(OQS_ENABLE_KEM_ml_kem_1024_x86_64) 166| |#if defined(OQS_DIST_BUILD) 167| 28| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (167:6): [True: 28, False: 0] | Branch (167:49): [True: 28, False: 0] | Branch (167:92): [True: 28, False: 0] ------------------ 168| 28|#endif /* OQS_DIST_BUILD */ 169| 28| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_enc(ciphertext, shared_secret, public_key); 170| 28|#if defined(OQS_DIST_BUILD) 171| 28| } else { 172| 0| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_C_enc(ciphertext, shared_secret, public_key); 173| 0| } 174| 28|#endif /* OQS_DIST_BUILD */ 175| |#elif defined(OQS_ENABLE_KEM_ml_kem_1024_aarch64) 176| |#if defined(OQS_DIST_BUILD) 177| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 178| |#endif /* OQS_DIST_BUILD */ 179| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_AARCH64_enc(ciphertext, shared_secret, public_key); 180| |#if defined(OQS_DIST_BUILD) 181| | } else { 182| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_C_enc(ciphertext, shared_secret, public_key); 183| | } 184| |#endif /* OQS_DIST_BUILD */ 185| |#else 186| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_C_enc(ciphertext, shared_secret, public_key); 187| |#endif 188| 28|} OQS_KEM_ml_kem_1024_decaps: 190| 28|OQS_API OQS_STATUS OQS_KEM_ml_kem_1024_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 191| |#if defined(OQS_USE_CUPQC) && defined(OQS_ENABLE_KEM_ml_kem_1024_cuda) 192| | return (OQS_STATUS) cupqc_ml_kem_1024_dec(shared_secret, ciphertext, secret_key); 193| |#elif defined(OQS_USE_ICICLE) && defined(OQS_ENABLE_KEM_ml_kem_1024_icicle_cuda) 194| | return (OQS_STATUS) icicle_ml_kem_1024_dec(shared_secret, ciphertext, secret_key); 195| |#elif defined(OQS_ENABLE_KEM_ml_kem_1024_x86_64) 196| |#if defined(OQS_DIST_BUILD) 197| 28| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (197:6): [True: 28, False: 0] | Branch (197:49): [True: 28, False: 0] | Branch (197:92): [True: 28, False: 0] ------------------ 198| 28|#endif /* OQS_DIST_BUILD */ 199| 28| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_dec(shared_secret, ciphertext, secret_key); 200| 28|#if defined(OQS_DIST_BUILD) 201| 28| } else { 202| 0| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_C_dec(shared_secret, ciphertext, secret_key); 203| 0| } 204| 28|#endif /* OQS_DIST_BUILD */ 205| |#elif defined(OQS_ENABLE_KEM_ml_kem_1024_aarch64) 206| |#if defined(OQS_DIST_BUILD) 207| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 208| |#endif /* OQS_DIST_BUILD */ 209| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_AARCH64_dec(shared_secret, ciphertext, secret_key); 210| |#if defined(OQS_DIST_BUILD) 211| | } else { 212| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_C_dec(shared_secret, ciphertext, secret_key); 213| | } 214| |#endif /* OQS_DIST_BUILD */ 215| |#else 216| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM1024_C_dec(shared_secret, ciphertext, secret_key); 217| |#endif 218| 28|} OQS_KEM_ml_kem_512_new: 9| 28|OQS_KEM *OQS_KEM_ml_kem_512_new(void) { 10| | 11| 28| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 28| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 28] ------------------ 13| 0| return NULL; 14| 0| } 15| 28| kem->method_name = OQS_KEM_alg_ml_kem_512; ------------------ | | 74| 28|#define OQS_KEM_alg_ml_kem_512 "ML-KEM-512" ------------------ 16| 28| kem->alg_version = "FIPS203"; 17| | 18| 28| kem->claimed_nist_level = 1; 19| 28| kem->ind_cca = true; 20| | 21| 28| kem->length_public_key = OQS_KEM_ml_kem_512_length_public_key; ------------------ | | 9| 28|#define OQS_KEM_ml_kem_512_length_public_key 800 ------------------ 22| 28| kem->length_secret_key = OQS_KEM_ml_kem_512_length_secret_key; ------------------ | | 10| 28|#define OQS_KEM_ml_kem_512_length_secret_key 1632 ------------------ 23| 28| kem->length_ciphertext = OQS_KEM_ml_kem_512_length_ciphertext; ------------------ | | 11| 28|#define OQS_KEM_ml_kem_512_length_ciphertext 768 ------------------ 24| 28| kem->length_shared_secret = OQS_KEM_ml_kem_512_length_shared_secret; ------------------ | | 12| 28|#define OQS_KEM_ml_kem_512_length_shared_secret 32 ------------------ 25| 28| kem->length_keypair_seed = OQS_KEM_ml_kem_512_length_keypair_seed; ------------------ | | 13| 28|#define OQS_KEM_ml_kem_512_length_keypair_seed 64 ------------------ 26| 28| kem->length_encaps_seed = OQS_KEM_ml_kem_512_length_encaps_seed; ------------------ | | 14| 28|#define OQS_KEM_ml_kem_512_length_encaps_seed 32 ------------------ 27| | 28| 28| kem->keypair = OQS_KEM_ml_kem_512_keypair; 29| 28| kem->keypair_derand = OQS_KEM_ml_kem_512_keypair_derand; 30| 28| kem->encaps = OQS_KEM_ml_kem_512_encaps; 31| 28| kem->encaps_derand = OQS_KEM_ml_kem_512_encaps_derand; 32| 28| kem->decaps = OQS_KEM_ml_kem_512_decaps; 33| | 34| 28| return kem; 35| 28|} OQS_KEM_ml_kem_512_keypair: 102| 28|OQS_API OQS_STATUS OQS_KEM_ml_kem_512_keypair(uint8_t *public_key, uint8_t *secret_key) { 103| |#if defined(OQS_USE_CUPQC) && defined(OQS_ENABLE_KEM_ml_kem_512_cuda) 104| | return (OQS_STATUS) cupqc_ml_kem_512_keypair(public_key, secret_key); 105| |#elif defined(OQS_USE_ICICLE) && defined(OQS_ENABLE_KEM_ml_kem_512_icicle_cuda) 106| | return (OQS_STATUS) icicle_ml_kem_512_keypair(public_key, secret_key); 107| |#elif defined(OQS_ENABLE_KEM_ml_kem_512_x86_64) 108| |#if defined(OQS_DIST_BUILD) 109| 28| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (109:6): [True: 28, False: 0] | Branch (109:49): [True: 28, False: 0] | Branch (109:92): [True: 28, False: 0] ------------------ 110| 28|#endif /* OQS_DIST_BUILD */ 111| 28| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_X86_64_keypair(public_key, secret_key); 112| 28|#if defined(OQS_DIST_BUILD) 113| 28| } else { 114| 0| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_C_keypair(public_key, secret_key); 115| 0| } 116| 28|#endif /* OQS_DIST_BUILD */ 117| |#elif defined(OQS_ENABLE_KEM_ml_kem_512_aarch64) 118| |#if defined(OQS_DIST_BUILD) 119| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 120| |#endif /* OQS_DIST_BUILD */ 121| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_AARCH64_keypair(public_key, secret_key); 122| |#if defined(OQS_DIST_BUILD) 123| | } else { 124| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_C_keypair(public_key, secret_key); 125| | } 126| |#endif /* OQS_DIST_BUILD */ 127| |#else 128| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_C_keypair(public_key, secret_key); 129| |#endif 130| 28|} OQS_KEM_ml_kem_512_encaps: 160| 28|OQS_API OQS_STATUS OQS_KEM_ml_kem_512_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 161| |#if defined(OQS_USE_CUPQC) && defined(OQS_ENABLE_KEM_ml_kem_512_cuda) 162| | return (OQS_STATUS) cupqc_ml_kem_512_enc(ciphertext, shared_secret, public_key); 163| |#elif defined(OQS_USE_ICICLE) && defined(OQS_ENABLE_KEM_ml_kem_512_icicle_cuda) 164| | return (OQS_STATUS) icicle_ml_kem_512_enc(ciphertext, shared_secret, public_key); 165| |#elif defined(OQS_ENABLE_KEM_ml_kem_512_x86_64) 166| |#if defined(OQS_DIST_BUILD) 167| 28| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (167:6): [True: 28, False: 0] | Branch (167:49): [True: 28, False: 0] | Branch (167:92): [True: 28, False: 0] ------------------ 168| 28|#endif /* OQS_DIST_BUILD */ 169| 28| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_X86_64_enc(ciphertext, shared_secret, public_key); 170| 28|#if defined(OQS_DIST_BUILD) 171| 28| } else { 172| 0| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_C_enc(ciphertext, shared_secret, public_key); 173| 0| } 174| 28|#endif /* OQS_DIST_BUILD */ 175| |#elif defined(OQS_ENABLE_KEM_ml_kem_512_aarch64) 176| |#if defined(OQS_DIST_BUILD) 177| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 178| |#endif /* OQS_DIST_BUILD */ 179| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_AARCH64_enc(ciphertext, shared_secret, public_key); 180| |#if defined(OQS_DIST_BUILD) 181| | } else { 182| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_C_enc(ciphertext, shared_secret, public_key); 183| | } 184| |#endif /* OQS_DIST_BUILD */ 185| |#else 186| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_C_enc(ciphertext, shared_secret, public_key); 187| |#endif 188| 28|} OQS_KEM_ml_kem_512_decaps: 190| 28|OQS_API OQS_STATUS OQS_KEM_ml_kem_512_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 191| |#if defined(OQS_USE_CUPQC) && defined(OQS_ENABLE_KEM_ml_kem_512_cuda) 192| | return (OQS_STATUS) cupqc_ml_kem_512_dec(shared_secret, ciphertext, secret_key); 193| |#elif defined(OQS_USE_ICICLE) && defined(OQS_ENABLE_KEM_ml_kem_512_icicle_cuda) 194| | return (OQS_STATUS) icicle_ml_kem_512_dec(shared_secret, ciphertext, secret_key); 195| |#elif defined(OQS_ENABLE_KEM_ml_kem_512_x86_64) 196| |#if defined(OQS_DIST_BUILD) 197| 28| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (197:6): [True: 28, False: 0] | Branch (197:49): [True: 28, False: 0] | Branch (197:92): [True: 28, False: 0] ------------------ 198| 28|#endif /* OQS_DIST_BUILD */ 199| 28| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_X86_64_dec(shared_secret, ciphertext, secret_key); 200| 28|#if defined(OQS_DIST_BUILD) 201| 28| } else { 202| 0| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_C_dec(shared_secret, ciphertext, secret_key); 203| 0| } 204| 28|#endif /* OQS_DIST_BUILD */ 205| |#elif defined(OQS_ENABLE_KEM_ml_kem_512_aarch64) 206| |#if defined(OQS_DIST_BUILD) 207| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 208| |#endif /* OQS_DIST_BUILD */ 209| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_AARCH64_dec(shared_secret, ciphertext, secret_key); 210| |#if defined(OQS_DIST_BUILD) 211| | } else { 212| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_C_dec(shared_secret, ciphertext, secret_key); 213| | } 214| |#endif /* OQS_DIST_BUILD */ 215| |#else 216| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM512_C_dec(shared_secret, ciphertext, secret_key); 217| |#endif 218| 28|} OQS_KEM_ml_kem_768_new: 9| 30|OQS_KEM *OQS_KEM_ml_kem_768_new(void) { 10| | 11| 30| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 30| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 30] ------------------ 13| 0| return NULL; 14| 0| } 15| 30| kem->method_name = OQS_KEM_alg_ml_kem_768; ------------------ | | 76| 30|#define OQS_KEM_alg_ml_kem_768 "ML-KEM-768" ------------------ 16| 30| kem->alg_version = "FIPS203"; 17| | 18| 30| kem->claimed_nist_level = 3; 19| 30| kem->ind_cca = true; 20| | 21| 30| kem->length_public_key = OQS_KEM_ml_kem_768_length_public_key; ------------------ | | 24| 30|#define OQS_KEM_ml_kem_768_length_public_key 1184 ------------------ 22| 30| kem->length_secret_key = OQS_KEM_ml_kem_768_length_secret_key; ------------------ | | 25| 30|#define OQS_KEM_ml_kem_768_length_secret_key 2400 ------------------ 23| 30| kem->length_ciphertext = OQS_KEM_ml_kem_768_length_ciphertext; ------------------ | | 26| 30|#define OQS_KEM_ml_kem_768_length_ciphertext 1088 ------------------ 24| 30| kem->length_shared_secret = OQS_KEM_ml_kem_768_length_shared_secret; ------------------ | | 27| 30|#define OQS_KEM_ml_kem_768_length_shared_secret 32 ------------------ 25| 30| kem->length_keypair_seed = OQS_KEM_ml_kem_768_length_keypair_seed; ------------------ | | 28| 30|#define OQS_KEM_ml_kem_768_length_keypair_seed 64 ------------------ 26| 30| kem->length_encaps_seed = OQS_KEM_ml_kem_768_length_encaps_seed; ------------------ | | 29| 30|#define OQS_KEM_ml_kem_768_length_encaps_seed 32 ------------------ 27| | 28| 30| kem->keypair = OQS_KEM_ml_kem_768_keypair; 29| 30| kem->keypair_derand = OQS_KEM_ml_kem_768_keypair_derand; 30| 30| kem->encaps = OQS_KEM_ml_kem_768_encaps; 31| 30| kem->encaps_derand = OQS_KEM_ml_kem_768_encaps_derand; 32| 30| kem->decaps = OQS_KEM_ml_kem_768_decaps; 33| | 34| 30| return kem; 35| 30|} OQS_KEM_ml_kem_768_keypair: 102| 30|OQS_API OQS_STATUS OQS_KEM_ml_kem_768_keypair(uint8_t *public_key, uint8_t *secret_key) { 103| |#if defined(OQS_USE_CUPQC) && defined(OQS_ENABLE_KEM_ml_kem_768_cuda) 104| | return (OQS_STATUS) cupqc_ml_kem_768_keypair(public_key, secret_key); 105| |#elif defined(OQS_USE_ICICLE) && defined(OQS_ENABLE_KEM_ml_kem_768_icicle_cuda) 106| | return (OQS_STATUS) icicle_ml_kem_768_keypair(public_key, secret_key); 107| |#elif defined(OQS_ENABLE_KEM_ml_kem_768_x86_64) 108| |#if defined(OQS_DIST_BUILD) 109| 30| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (109:6): [True: 30, False: 0] | Branch (109:49): [True: 30, False: 0] | Branch (109:92): [True: 30, False: 0] ------------------ 110| 30|#endif /* OQS_DIST_BUILD */ 111| 30| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_X86_64_keypair(public_key, secret_key); 112| 30|#if defined(OQS_DIST_BUILD) 113| 30| } else { 114| 0| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_C_keypair(public_key, secret_key); 115| 0| } 116| 30|#endif /* OQS_DIST_BUILD */ 117| |#elif defined(OQS_ENABLE_KEM_ml_kem_768_aarch64) 118| |#if defined(OQS_DIST_BUILD) 119| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 120| |#endif /* OQS_DIST_BUILD */ 121| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_AARCH64_keypair(public_key, secret_key); 122| |#if defined(OQS_DIST_BUILD) 123| | } else { 124| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_C_keypair(public_key, secret_key); 125| | } 126| |#endif /* OQS_DIST_BUILD */ 127| |#else 128| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_C_keypair(public_key, secret_key); 129| |#endif 130| 30|} OQS_KEM_ml_kem_768_encaps: 160| 30|OQS_API OQS_STATUS OQS_KEM_ml_kem_768_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 161| |#if defined(OQS_USE_CUPQC) && defined(OQS_ENABLE_KEM_ml_kem_768_cuda) 162| | return (OQS_STATUS) cupqc_ml_kem_768_enc(ciphertext, shared_secret, public_key); 163| |#elif defined(OQS_USE_ICICLE) && defined(OQS_ENABLE_KEM_ml_kem_768_icicle_cuda) 164| | return (OQS_STATUS) icicle_ml_kem_768_enc(ciphertext, shared_secret, public_key); 165| |#elif defined(OQS_ENABLE_KEM_ml_kem_768_x86_64) 166| |#if defined(OQS_DIST_BUILD) 167| 30| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (167:6): [True: 30, False: 0] | Branch (167:49): [True: 30, False: 0] | Branch (167:92): [True: 30, False: 0] ------------------ 168| 30|#endif /* OQS_DIST_BUILD */ 169| 30| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_X86_64_enc(ciphertext, shared_secret, public_key); 170| 30|#if defined(OQS_DIST_BUILD) 171| 30| } else { 172| 0| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_C_enc(ciphertext, shared_secret, public_key); 173| 0| } 174| 30|#endif /* OQS_DIST_BUILD */ 175| |#elif defined(OQS_ENABLE_KEM_ml_kem_768_aarch64) 176| |#if defined(OQS_DIST_BUILD) 177| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 178| |#endif /* OQS_DIST_BUILD */ 179| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_AARCH64_enc(ciphertext, shared_secret, public_key); 180| |#if defined(OQS_DIST_BUILD) 181| | } else { 182| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_C_enc(ciphertext, shared_secret, public_key); 183| | } 184| |#endif /* OQS_DIST_BUILD */ 185| |#else 186| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_C_enc(ciphertext, shared_secret, public_key); 187| |#endif 188| 30|} OQS_KEM_ml_kem_768_decaps: 190| 30|OQS_API OQS_STATUS OQS_KEM_ml_kem_768_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 191| |#if defined(OQS_USE_CUPQC) && defined(OQS_ENABLE_KEM_ml_kem_768_cuda) 192| | return (OQS_STATUS) cupqc_ml_kem_768_dec(shared_secret, ciphertext, secret_key); 193| |#elif defined(OQS_USE_ICICLE) && defined(OQS_ENABLE_KEM_ml_kem_768_icicle_cuda) 194| | return (OQS_STATUS) icicle_ml_kem_768_dec(shared_secret, ciphertext, secret_key); 195| |#elif defined(OQS_ENABLE_KEM_ml_kem_768_x86_64) 196| |#if defined(OQS_DIST_BUILD) 197| 30| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2) && OQS_CPU_has_extension(OQS_CPU_EXT_POPCNT)) { ------------------ | Branch (197:6): [True: 30, False: 0] | Branch (197:49): [True: 30, False: 0] | Branch (197:92): [True: 30, False: 0] ------------------ 198| 30|#endif /* OQS_DIST_BUILD */ 199| 30| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_X86_64_dec(shared_secret, ciphertext, secret_key); 200| 30|#if defined(OQS_DIST_BUILD) 201| 30| } else { 202| 0| return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_C_dec(shared_secret, ciphertext, secret_key); 203| 0| } 204| 30|#endif /* OQS_DIST_BUILD */ 205| |#elif defined(OQS_ENABLE_KEM_ml_kem_768_aarch64) 206| |#if defined(OQS_DIST_BUILD) 207| | if (OQS_CPU_has_extension(OQS_CPU_EXT_ARM_NEON)) { 208| |#endif /* OQS_DIST_BUILD */ 209| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_AARCH64_dec(shared_secret, ciphertext, secret_key); 210| |#if defined(OQS_DIST_BUILD) 211| | } else { 212| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_C_dec(shared_secret, ciphertext, secret_key); 213| | } 214| |#endif /* OQS_DIST_BUILD */ 215| |#else 216| | return (OQS_STATUS) PQCP_MLKEM_NATIVE_MLKEM768_C_dec(shared_secret, ciphertext, secret_key); 217| |#endif 218| 30|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_compress_d5: 324| 56|{ 325| 56|#if defined(MLK_USE_NATIVE_POLY_COMPRESS_D5) 326| 56| int ret; 327| 56| mlk_assert_bound(a, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 56| do \ | | 102| 56| { \ | | 103| 56| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 56] | | ------------------ ------------------ 328| 56| ret = mlk_poly_compress_d5_native(r, a->coeffs); 329| 56| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 56|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (329:7): [True: 56, False: 0] ------------------ 330| 56| { 331| 56| return; 332| 56| } 333| 0|#endif /* MLK_USE_NATIVE_POLY_COMPRESS_D5 */ 334| | 335| 0| mlk_poly_compress_d5_c(r, a); 336| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_compress_d11: 398| 224|{ 399| 224|#if defined(MLK_USE_NATIVE_POLY_COMPRESS_D11) 400| 224| int ret; 401| 224| mlk_assert_bound(a, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 224| do \ | | 102| 224| { \ | | 103| 224| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 224] | | ------------------ ------------------ 402| 224| ret = mlk_poly_compress_d11_native(r, a->coeffs); 403| 224| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 224|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (403:7): [True: 224, False: 0] ------------------ 404| 224| { 405| 224| return; 406| 224| } 407| 0|#endif /* MLK_USE_NATIVE_POLY_COMPRESS_D11 */ 408| | 409| 0| mlk_poly_compress_d11_c(r, a); 410| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_decompress_d5: 475| 28|{ 476| 28|#if defined(MLK_USE_NATIVE_POLY_DECOMPRESS_D5) 477| 28| int ret; 478| 28| ret = mlk_poly_decompress_d5_native(r->coeffs, a); 479| 28| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 28|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (479:7): [True: 28, False: 0] ------------------ 480| 28| { 481| 28| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 28| do \ | | 102| 28| { \ | | 103| 28| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 28] | | ------------------ ------------------ 482| 28| return; 483| 28| } 484| 0|#endif /* MLK_USE_NATIVE_POLY_DECOMPRESS_D5 */ 485| | 486| 0| mlk_poly_decompress_d5_c(r, a); 487| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_decompress_d11: 543| 112|{ 544| 112|#if defined(MLK_USE_NATIVE_POLY_DECOMPRESS_D11) 545| 112| int ret; 546| 112| ret = mlk_poly_decompress_d11_native(r->coeffs, a); 547| 112| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 112|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (547:7): [True: 112, False: 0] ------------------ 548| 112| { 549| 112| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 112| do \ | | 102| 112| { \ | | 103| 112| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 112] | | ------------------ ------------------ 550| 112| return; 551| 112| } 552| 0|#endif /* MLK_USE_NATIVE_POLY_DECOMPRESS_D11 */ 553| | 554| 0| mlk_poly_decompress_d11_c(r, a); 555| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_tobytes: 610| 336|{ 611| 336|#if defined(MLK_USE_NATIVE_POLY_TOBYTES) 612| 336| int ret; 613| 336| mlk_assert_bound(a, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 336| do \ | | 102| 336| { \ | | 103| 336| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 336] | | ------------------ ------------------ 614| 336| ret = mlk_poly_tobytes_native(r, a->coeffs); 615| 336| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 336|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (615:7): [True: 336, False: 0] ------------------ 616| 336| { 617| 336| return; 618| 336| } 619| 0|#endif /* MLK_USE_NATIVE_POLY_TOBYTES */ 620| | 621| 0| mlk_poly_tobytes_c(r, a); 622| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_frombytes: 659| 448|{ 660| 448|#if defined(MLK_USE_NATIVE_POLY_FROMBYTES) 661| 448| int ret; 662| 448| ret = mlk_poly_frombytes_native(r->coeffs, a); 663| 448| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 448|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (663:7): [True: 448, False: 0] ------------------ 664| 448| { 665| 448| return; 666| 448| } 667| 0|#endif /* MLK_USE_NATIVE_POLY_FROMBYTES */ 668| | 669| 0| mlk_poly_frombytes_c(r, a); 670| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_frommsg: 680| 56|{ 681| 56| unsigned i; 682| |#if (MLKEM_INDCPA_MSGBYTES != MLKEM_N / 8) 683| |#error "MLKEM_INDCPA_MSGBYTES must be equal to MLKEM_N/8 bytes!" 684| |#endif 685| | 686| 1.84k| for (i = 0; i < MLKEM_N / 8; i++) ------------------ | | 22| 1.84k|#define MLKEM_N 256 ------------------ | Branch (686:15): [True: 1.79k, False: 56] ------------------ 687| 1.79k| __loop__( 688| 1.79k| invariant(i <= MLKEM_N / 8) 689| 1.79k| invariant(array_bound(r->coeffs, 0, 8 * i, 0, MLKEM_Q)) 690| 1.79k| decreases(MLKEM_N / 8 - i)) 691| 1.79k| { 692| 1.79k| unsigned j; 693| 16.1k| for (j = 0; j < 8; j++) ------------------ | Branch (693:17): [True: 14.3k, False: 1.79k] ------------------ 694| 14.3k| __loop__( 695| 14.3k| invariant(i < MLKEM_N / 8 && j <= 8) 696| 14.3k| invariant(array_bound(r->coeffs, 0, 8 * i + j, 0, MLKEM_Q)) 697| 14.3k| decreases(8 - j)) 698| 14.3k| { 699| | /* mlk_ct_sel_int16(MLKEM_Q_HALF, 0, b) is `Decompress_1(b != 0)` 700| | * as per @[FIPS203, Eq (4.8)]. */ 701| | 702| | /* Prevent the compiler from recognizing this as a bit selection */ 703| 14.3k| uint8_t mask = mlk_value_barrier_u8((uint8_t)(1u << j)); 704| 14.3k| r->coeffs[8 * i + j] = mlk_ct_sel_int16(MLKEM_Q_HALF, 0, msg[i] & mask); ------------------ | | 24| 14.3k|#define MLKEM_Q_HALF ((MLKEM_Q + 1) / 2) /* 1665 */ | | ------------------ | | | | 23| 14.3k|#define MLKEM_Q 3329 | | ------------------ ------------------ 705| 14.3k| } 706| 1.79k| } 707| 56| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_Q); ------------------ | | 105| 56| do \ | | 106| 56| { \ | | 107| 56| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 56] | | ------------------ ------------------ 708| 56|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_tomsg: 718| 28|{ 719| 28| unsigned i; 720| 28| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 28| do \ | | 102| 28| { \ | | 103| 28| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 28] | | ------------------ ------------------ 721| | 722| 924| for (i = 0; i < MLKEM_N / 8; i++) ------------------ | | 22| 924|#define MLKEM_N 256 ------------------ | Branch (722:15): [True: 896, False: 28] ------------------ 723| 896| __loop__(invariant(i <= MLKEM_N / 8) 724| 896| decreases(MLKEM_N / 8 - i)) 725| 896| { 726| 896| unsigned j; 727| 896| msg[i] = 0; 728| 8.06k| for (j = 0; j < 8; j++) ------------------ | Branch (728:17): [True: 7.16k, False: 896] ------------------ 729| 7.16k| __loop__( 730| 7.16k| invariant(i <= MLKEM_N / 8 && j <= 8) 731| 7.16k| decreases(8 - j)) 732| 7.16k| { 733| 7.16k| uint32_t t = mlk_scalar_compress_d1(r->coeffs[8 * i + j]); 734| 7.16k| msg[i] |= (uint8_t)(t << j); 735| 7.16k| } 736| 896| } 737| 28|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_gen_matrix: 223| 84|{ 224| 84| unsigned i, j; 225| 84| MLK_ALIGN uint8_t seed_ext[4][MLK_ALIGN_UP(MLKEM_SYMBYTES + 2)]; ------------------ | | 190| 84|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 226| | 227| 420| for (j = 0; j < 4; j++) ------------------ | Branch (227:15): [True: 336, False: 84] ------------------ 228| 336| { 229| 336| mlk_memcpy(seed_ext[j], seed, MLKEM_SYMBYTES); ------------------ | | 168| 336|#define mlk_memcpy memcpy ------------------ mlk_memcpy(seed_ext[j], seed, MLKEM_SYMBYTES); ------------------ | | 27| 336|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 230| 336| } 231| | 232| 84|#if !defined(MLK_CONFIG_SERIAL_FIPS202_ONLY) 233| | /* Sample 4 matrix entries a time. */ 234| 420| for (i = 0; i < (MLKEM_K * MLKEM_K / 4) * 4; i += 4) ------------------ | | 17| 420|#define MLKEM_K 4 ------------------ for (i = 0; i < (MLKEM_K * MLKEM_K / 4) * 4; i += 4) ------------------ | | 17| 420|#define MLKEM_K 4 ------------------ | Branch (234:15): [True: 336, False: 84] ------------------ 235| 336| { 236| 1.68k| for (j = 0; j < 4; j++) ------------------ | Branch (236:17): [True: 1.34k, False: 336] ------------------ 237| 1.34k| { 238| 1.34k| uint8_t x, y; 239| | /* MLKEM_K <= 4, so the values fit in uint8_t. */ 240| 1.34k| x = (uint8_t)((i + j) / MLKEM_K); ------------------ | | 17| 1.34k|#define MLKEM_K 4 ------------------ 241| 1.34k| y = (uint8_t)((i + j) % MLKEM_K); ------------------ | | 17| 1.34k|#define MLKEM_K 4 ------------------ 242| 1.34k| if (transposed) ------------------ | Branch (242:11): [True: 896, False: 448] ------------------ 243| 896| { 244| 896| seed_ext[j][MLKEM_SYMBYTES + 0] = x; ------------------ | | 27| 896|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 245| 896| seed_ext[j][MLKEM_SYMBYTES + 1] = y; ------------------ | | 27| 896|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 246| 896| } 247| 448| else 248| 448| { 249| 448| seed_ext[j][MLKEM_SYMBYTES + 0] = y; ------------------ | | 27| 448|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 250| 448| seed_ext[j][MLKEM_SYMBYTES + 1] = x; ------------------ | | 27| 448|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 251| 448| } 252| 1.34k| } 253| | 254| 336| mlk_poly_rej_uniform_x4(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], ------------------ | | 55| 336|#define mlk_poly_rej_uniform_x4 MLK_NAMESPACE(poly_rej_uniform_x4) | | ------------------ | | | | 63| 336|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 336|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 336|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_rej_uniform_x4(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], ------------------ | | 17| 336|#define MLKEM_K 4 ------------------ mlk_poly_rej_uniform_x4(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], ------------------ | | 17| 336|#define MLKEM_K 4 ------------------ 255| 336| &a->vec[(i + 1) / MLKEM_K].vec[(i + 1) % MLKEM_K], ------------------ | | 17| 336|#define MLKEM_K 4 ------------------ &a->vec[(i + 1) / MLKEM_K].vec[(i + 1) % MLKEM_K], ------------------ | | 17| 336|#define MLKEM_K 4 ------------------ 256| 336| &a->vec[(i + 2) / MLKEM_K].vec[(i + 2) % MLKEM_K], ------------------ | | 17| 336|#define MLKEM_K 4 ------------------ &a->vec[(i + 2) / MLKEM_K].vec[(i + 2) % MLKEM_K], ------------------ | | 17| 336|#define MLKEM_K 4 ------------------ 257| 336| &a->vec[(i + 3) / MLKEM_K].vec[(i + 3) % MLKEM_K], ------------------ | | 17| 336|#define MLKEM_K 4 ------------------ &a->vec[(i + 3) / MLKEM_K].vec[(i + 3) % MLKEM_K], ------------------ | | 17| 336|#define MLKEM_K 4 ------------------ 258| 336| seed_ext); 259| 336| } 260| |#else /* !MLK_CONFIG_SERIAL_FIPS202_ONLY */ 261| | /* When using serial FIPS202, sample all entries individually. */ 262| | i = 0; 263| |#endif /* MLK_CONFIG_SERIAL_FIPS202_ONLY */ 264| | 265| | /* For MLKEM_K == 3, sample the last entry individually. 266| | * When MLK_CONFIG_SERIAL_FIPS202_ONLY is set, sample all entries 267| | * individually. */ 268| 84| for (; i < MLKEM_K * MLKEM_K; i++) ------------------ | | 17| 84|#define MLKEM_K 4 ------------------ for (; i < MLKEM_K * MLKEM_K; i++) ------------------ | | 17| 84|#define MLKEM_K 4 ------------------ | Branch (268:10): [True: 0, False: 84] ------------------ 269| 0| { 270| 0| uint8_t x, y; 271| | /* MLKEM_K <= 4, so the values fit in uint8_t. */ 272| 0| x = (uint8_t)(i / MLKEM_K); ------------------ | | 17| 0|#define MLKEM_K 4 ------------------ 273| 0| y = (uint8_t)(i % MLKEM_K); ------------------ | | 17| 0|#define MLKEM_K 4 ------------------ 274| | 275| 0| if (transposed) ------------------ | Branch (275:9): [True: 0, False: 0] ------------------ 276| 0| { 277| 0| seed_ext[0][MLKEM_SYMBYTES + 0] = x; ------------------ | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 278| 0| seed_ext[0][MLKEM_SYMBYTES + 1] = y; ------------------ | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 279| 0| } 280| 0| else 281| 0| { 282| 0| seed_ext[0][MLKEM_SYMBYTES + 0] = y; ------------------ | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 283| 0| seed_ext[0][MLKEM_SYMBYTES + 1] = x; ------------------ | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 284| 0| } 285| | 286| 0| mlk_poly_rej_uniform(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], seed_ext[0]); ------------------ | | 89| 0|#define mlk_poly_rej_uniform MLK_NAMESPACE(poly_rej_uniform) | | ------------------ | | | | 63| 0|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 0|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 0|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_rej_uniform(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], seed_ext[0]); ------------------ | | 17| 0|#define MLKEM_K 4 ------------------ mlk_poly_rej_uniform(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], seed_ext[0]); ------------------ | | 17| 0|#define MLKEM_K 4 ------------------ 287| 0| } 288| | 289| 84| mlk_assert(i == MLKEM_K * MLKEM_K); ------------------ | | 97| 84| do \ | | 98| 84| { \ | | 99| 84| } while (0) | | ------------------ | | | Branch (99:12): [Folded, False: 84] | | ------------------ ------------------ 290| | 291| | /* 292| | * The public matrix is generated in NTT domain. If the native backend 293| | * uses a custom order in NTT domain, permute A accordingly. 294| | */ 295| 84| mlk_polymat_permute_bitrev_to_custom(a); ------------------ | | 42| 84| MLK_ADD_PARAM_SET(mlk_polymat_permute_bitrev_to_custom) | | ------------------ | | | | 48| 84|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 296| | 297| | /* Specification: Partially implements 298| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 299| 84| mlk_zeroize(seed_ext, sizeof(seed_ext)); 300| 84|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_indcpa_keypair_derand: 445| 28|{ 446| 28| int ret = 0; 447| 28| const uint8_t *publicseed; 448| 28| const uint8_t *noiseseed; 449| 28| MLK_ALLOC(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 450| 28| MLK_ALLOC(coins_with_domain_separator, uint8_t, MLKEM_SYMBYTES + 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 451| 28| MLK_ALLOC(a, mlk_polymat, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 452| 28| MLK_ALLOC(e, mlk_polyvec, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 453| 28| MLK_ALLOC(pkpv, mlk_polyvec, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 454| 28| MLK_ALLOC(skpv, mlk_polyvec, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 455| 28| MLK_ALLOC(skpv_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 456| | 457| 28| if (buf == NULL || coins_with_domain_separator == NULL || a == NULL || ------------------ | Branch (457:7): [True: 0, False: 28] | Branch (457:22): [True: 0, False: 28] | Branch (457:61): [True: 0, False: 28] ------------------ 458| 28| e == NULL || pkpv == NULL || skpv == NULL || skpv_cache == NULL) ------------------ | Branch (458:7): [True: 0, False: 28] | Branch (458:20): [True: 0, False: 28] | Branch (458:36): [True: 0, False: 28] | Branch (458:52): [True: 0, False: 28] ------------------ 459| 0| { 460| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 461| 0| goto cleanup; 462| 0| } 463| | 464| 28| publicseed = buf; 465| 28| noiseseed = buf + MLKEM_SYMBYTES; ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 466| | 467| | /* Concatenate coins with MLKEM_K for domain separation of security levels */ 468| 28| mlk_memcpy(coins_with_domain_separator, coins, MLKEM_SYMBYTES); ------------------ | | 168| 28|#define mlk_memcpy memcpy ------------------ mlk_memcpy(coins_with_domain_separator, coins, MLKEM_SYMBYTES); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 469| 28| coins_with_domain_separator[MLKEM_SYMBYTES] = MLKEM_K; ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ coins_with_domain_separator[MLKEM_SYMBYTES] = MLKEM_K; ------------------ | | 17| 28|#define MLKEM_K 4 ------------------ 470| | 471| 28| mlk_hash_g(buf, coins_with_domain_separator, MLKEM_SYMBYTES + 1); ------------------ | | 32| 28|#define mlk_hash_g(OUT, IN, INBYTES) mlk_sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 20| 28|#define mlk_sha3_512 sha3_512 | | | | ------------------ | | | | | | 31| 28|#define sha3_512 OQS_SHA3_sha3_512 | | | | ------------------ | | ------------------ ------------------ 472| | 473| | /* 474| | * Declassify the public seed. 475| | * Required to use it in conditional-branches in rejection sampling. 476| | * This is needed because all output of randombytes is marked as secret 477| | * (=undefined) 478| | */ 479| 28| MLK_CT_TESTING_DECLASSIFY(publicseed, MLKEM_SYMBYTES); ------------------ | | 235| 28| do \ | | 236| 28| { \ | | 237| 28| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 28] | | ------------------ ------------------ 480| | 481| 28| mlk_gen_matrix(a, publicseed, 0 /* no transpose */); ------------------ | | 22| 28|#define mlk_gen_matrix MLK_NAMESPACE_K(gen_matrix) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 482| | 483| 28| mlk_keypair_getnoise_eta1(skpv, e, noiseseed); ------------------ | | 43| 28|#define mlk_keypair_getnoise_eta1 MLK_ADD_PARAM_SET(mlk_keypair_getnoise_eta1) | | ------------------ | | | | 48| 28|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 484| | 485| 28| mlk_polyvec_ntt(skpv); ------------------ | | 269| 28|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 486| 28| mlk_polyvec_ntt(e); ------------------ | | 269| 28|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 487| | 488| 28| mlk_polyvec_mulcache_compute(skpv_cache, skpv); ------------------ | | 353| 28|#define mlk_polyvec_mulcache_compute MLK_NAMESPACE_K(polyvec_mulcache_compute) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 489| 28| mlk_matvec_mul(pkpv, a, skpv, skpv_cache); ------------------ | | 38| 28|#define mlk_matvec_mul MLK_ADD_PARAM_SET(mlk_matvec_mul) | | ------------------ | | | | 48| 28|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 490| 28| mlk_polyvec_tomont(pkpv); ------------------ | | 445| 28|#define mlk_polyvec_tomont MLK_NAMESPACE_K(polyvec_tomont) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 491| | 492| 28| mlk_polyvec_add(pkpv, e); ------------------ | | 414| 28|#define mlk_polyvec_add MLK_NAMESPACE_K(polyvec_add) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 493| 28| mlk_polyvec_reduce(pkpv); ------------------ | | 387| 28|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 494| 28| mlk_polyvec_reduce(skpv); ------------------ | | 387| 28|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 495| | 496| 28| mlk_pack_sk(sk, skpv); ------------------ | | 34| 28|#define mlk_pack_sk MLK_ADD_PARAM_SET(mlk_pack_sk) | | ------------------ | | | | 48| 28|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 497| 28| mlk_pack_pk(pk, pkpv, publicseed); ------------------ | | 32| 28|#define mlk_pack_pk MLK_ADD_PARAM_SET(mlk_pack_pk) | | ------------------ | | | | 48| 28|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 498| | 499| 28|cleanup: 500| | /* Specification: Partially implements 501| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 502| 28| MLK_FREE(skpv_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 503| 28| MLK_FREE(skpv, mlk_polyvec, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 504| 28| MLK_FREE(pkpv, mlk_polyvec, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 505| 28| MLK_FREE(e, mlk_polyvec, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 506| 28| MLK_FREE(a, mlk_polymat, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 507| 28| MLK_FREE(coins_with_domain_separator, uint8_t, MLKEM_SYMBYTES + 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 508| | MLK_FREE(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 509| 28| return ret; 510| 28|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_indcpa_enc: 526| 56|{ 527| 56| int ret = 0; 528| 56| MLK_ALLOC(seed, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 229| 56| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 56| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 529| 56| MLK_ALLOC(at, mlk_polymat, 1, context); ------------------ | | 229| 56| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 56| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 530| 56| MLK_ALLOC(sp, mlk_polyvec, 1, context); ------------------ | | 229| 56| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 56| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 531| 56| MLK_ALLOC(pkpv, mlk_polyvec, 1, context); ------------------ | | 229| 56| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 56| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 532| 56| MLK_ALLOC(ep, mlk_polyvec, 1, context); ------------------ | | 229| 56| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 56| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 533| 56| MLK_ALLOC(b, mlk_polyvec, 1, context); ------------------ | | 229| 56| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 56| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 534| 56| MLK_ALLOC(v, mlk_poly, 1, context); ------------------ | | 229| 56| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 56| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 535| 56| MLK_ALLOC(k, mlk_poly, 1, context); ------------------ | | 229| 56| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 56| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 536| 56| MLK_ALLOC(epp, mlk_poly, 1, context); ------------------ | | 229| 56| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 56| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 537| 56| MLK_ALLOC(sp_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 229| 56| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 56| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 538| | 539| 56| if (seed == NULL || at == NULL || sp == NULL || pkpv == NULL || ep == NULL || ------------------ | Branch (539:7): [True: 0, False: 56] | Branch (539:23): [True: 0, False: 56] | Branch (539:37): [True: 0, False: 56] | Branch (539:51): [True: 0, False: 56] | Branch (539:67): [True: 0, False: 56] ------------------ 540| 56| b == NULL || v == NULL || k == NULL || epp == NULL || sp_cache == NULL) ------------------ | Branch (540:7): [True: 0, False: 56] | Branch (540:20): [True: 0, False: 56] | Branch (540:33): [True: 0, False: 56] | Branch (540:46): [True: 0, False: 56] | Branch (540:61): [True: 0, False: 56] ------------------ 541| 0| { 542| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 543| 0| goto cleanup; 544| 0| } 545| | 546| 56| mlk_unpack_pk(pkpv, seed, pk); ------------------ | | 33| 56|#define mlk_unpack_pk MLK_ADD_PARAM_SET(mlk_unpack_pk) | | ------------------ | | | | 48| 56|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 547| 56| mlk_poly_frommsg(k, m); ------------------ | | 555| 56|#define mlk_poly_frommsg MLK_NAMESPACE(poly_frommsg) | | ------------------ | | | | 63| 56|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 548| | 549| | /* 550| | * Declassify the public seed. 551| | * Required to use it in conditional-branches in rejection sampling. 552| | * This is needed because in re-encryption the publicseed originated from sk 553| | * which is marked undefined. 554| | */ 555| 56| MLK_CT_TESTING_DECLASSIFY(seed, MLKEM_SYMBYTES); ------------------ | | 235| 56| do \ | | 236| 56| { \ | | 237| 56| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 56] | | ------------------ ------------------ 556| | 557| 56| mlk_gen_matrix(at, seed, 1 /* transpose */); ------------------ | | 22| 56|#define mlk_gen_matrix MLK_NAMESPACE_K(gen_matrix) | | ------------------ | | | | 64| 56|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 558| | 559| 56| mlk_enc_getnoise_eta1_eta2(sp, ep, epp, coins); ------------------ | | 44| 56|#define mlk_enc_getnoise_eta1_eta2 MLK_ADD_PARAM_SET(mlk_enc_getnoise_eta1_eta2) | | ------------------ | | | | 48| 56|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 560| | 561| 56| mlk_polyvec_ntt(sp); ------------------ | | 269| 56|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 56|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 562| | 563| 56| mlk_polyvec_mulcache_compute(sp_cache, sp); ------------------ | | 353| 56|#define mlk_polyvec_mulcache_compute MLK_NAMESPACE_K(polyvec_mulcache_compute) | | ------------------ | | | | 64| 56|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 564| 56| mlk_matvec_mul(b, at, sp, sp_cache); ------------------ | | 38| 56|#define mlk_matvec_mul MLK_ADD_PARAM_SET(mlk_matvec_mul) | | ------------------ | | | | 48| 56|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 565| 56| mlk_polyvec_basemul_acc_montgomery_cached(v, pkpv, sp, sp_cache); ------------------ | | 321| 56| MLK_NAMESPACE_K(polyvec_basemul_acc_montgomery_cached) | | ------------------ | | | | 64| 56|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 566| | 567| 56| mlk_polyvec_invntt_tomont(b); ------------------ | | 295| 56|#define mlk_polyvec_invntt_tomont MLK_NAMESPACE_K(polyvec_invntt_tomont) | | ------------------ | | | | 64| 56|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 568| 56| mlk_poly_invntt_tomont(v); ------------------ | | 263| 56|#define mlk_poly_invntt_tomont MLK_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 63| 56|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 569| | 570| 56| mlk_polyvec_add(b, ep); ------------------ | | 414| 56|#define mlk_polyvec_add MLK_NAMESPACE_K(polyvec_add) | | ------------------ | | | | 64| 56|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 571| 56| mlk_poly_add(v, epp); ------------------ | | 181| 56|#define mlk_poly_add MLK_NAMESPACE(poly_add) | | ------------------ | | | | 63| 56|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 572| 56| mlk_poly_add(v, k); ------------------ | | 181| 56|#define mlk_poly_add MLK_NAMESPACE(poly_add) | | ------------------ | | | | 63| 56|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 573| | 574| 56| mlk_polyvec_reduce(b); ------------------ | | 387| 56|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 56|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 575| 56| mlk_poly_reduce(v); ------------------ | | 154| 56|#define mlk_poly_reduce MLK_NAMESPACE(poly_reduce) | | ------------------ | | | | 63| 56|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 576| | 577| 56| mlk_pack_ciphertext(c, b, v); ------------------ | | 36| 56|#define mlk_pack_ciphertext MLK_ADD_PARAM_SET(mlk_pack_ciphertext) | | ------------------ | | | | 48| 56|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 578| | 579| 56|cleanup: 580| | /* Specification: Partially implements 581| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 582| 56| MLK_FREE(sp_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 238| 56| do \ | | 239| 56| { \ | | 240| 56| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 56| (v) = NULL; \ | | 242| 56| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 56] | | ------------------ ------------------ 583| 56| MLK_FREE(epp, mlk_poly, 1, context); ------------------ | | 238| 56| do \ | | 239| 56| { \ | | 240| 56| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 56| (v) = NULL; \ | | 242| 56| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 56] | | ------------------ ------------------ 584| 56| MLK_FREE(k, mlk_poly, 1, context); ------------------ | | 238| 56| do \ | | 239| 56| { \ | | 240| 56| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 56| (v) = NULL; \ | | 242| 56| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 56] | | ------------------ ------------------ 585| 56| MLK_FREE(v, mlk_poly, 1, context); ------------------ | | 238| 56| do \ | | 239| 56| { \ | | 240| 56| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 56| (v) = NULL; \ | | 242| 56| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 56] | | ------------------ ------------------ 586| 56| MLK_FREE(b, mlk_polyvec, 1, context); ------------------ | | 238| 56| do \ | | 239| 56| { \ | | 240| 56| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 56| (v) = NULL; \ | | 242| 56| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 56] | | ------------------ ------------------ 587| 56| MLK_FREE(ep, mlk_polyvec, 1, context); ------------------ | | 238| 56| do \ | | 239| 56| { \ | | 240| 56| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 56| (v) = NULL; \ | | 242| 56| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 56] | | ------------------ ------------------ 588| 56| MLK_FREE(pkpv, mlk_polyvec, 1, context); ------------------ | | 238| 56| do \ | | 239| 56| { \ | | 240| 56| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 56| (v) = NULL; \ | | 242| 56| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 56] | | ------------------ ------------------ 589| 56| MLK_FREE(sp, mlk_polyvec, 1, context); ------------------ | | 238| 56| do \ | | 239| 56| { \ | | 240| 56| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 56| (v) = NULL; \ | | 242| 56| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 56] | | ------------------ ------------------ 590| 56| MLK_FREE(at, mlk_polymat, 1, context); ------------------ | | 238| 56| do \ | | 239| 56| { \ | | 240| 56| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 56| (v) = NULL; \ | | 242| 56| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 56] | | ------------------ ------------------ 591| | MLK_FREE(seed, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 238| 56| do \ | | 239| 56| { \ | | 240| 56| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 56| (v) = NULL; \ | | 242| 56| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 56] | | ------------------ ------------------ 592| 56| return ret; 593| 56|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_indcpa_dec: 603| 28|{ 604| 28| int ret = 0; 605| 28| MLK_ALLOC(b, mlk_polyvec, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 606| 28| MLK_ALLOC(skpv, mlk_polyvec, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 607| 28| MLK_ALLOC(v, mlk_poly, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 608| 28| MLK_ALLOC(sb, mlk_poly, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 609| 28| MLK_ALLOC(b_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 610| | 611| 28| if (b == NULL || skpv == NULL || v == NULL || sb == NULL || b_cache == NULL) ------------------ | Branch (611:7): [True: 0, False: 28] | Branch (611:20): [True: 0, False: 28] | Branch (611:36): [True: 0, False: 28] | Branch (611:49): [True: 0, False: 28] | Branch (611:63): [True: 0, False: 28] ------------------ 612| 0| { 613| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 614| 0| goto cleanup; 615| 0| } 616| | 617| 28| mlk_unpack_ciphertext(b, v, c); ------------------ | | 37| 28|#define mlk_unpack_ciphertext MLK_ADD_PARAM_SET(mlk_unpack_ciphertext) | | ------------------ | | | | 48| 28|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 618| 28| mlk_unpack_sk(skpv, sk); ------------------ | | 35| 28|#define mlk_unpack_sk MLK_ADD_PARAM_SET(mlk_unpack_sk) | | ------------------ | | | | 48| 28|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 619| | 620| 28| mlk_polyvec_ntt(b); ------------------ | | 269| 28|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 621| 28| mlk_polyvec_mulcache_compute(b_cache, b); ------------------ | | 353| 28|#define mlk_polyvec_mulcache_compute MLK_NAMESPACE_K(polyvec_mulcache_compute) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 622| 28| mlk_polyvec_basemul_acc_montgomery_cached(sb, skpv, b, b_cache); ------------------ | | 321| 28| MLK_NAMESPACE_K(polyvec_basemul_acc_montgomery_cached) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 623| 28| mlk_poly_invntt_tomont(sb); ------------------ | | 263| 28|#define mlk_poly_invntt_tomont MLK_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 63| 28|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 624| | 625| 28| mlk_poly_sub(v, sb); ------------------ | | 210| 28|#define mlk_poly_sub MLK_NAMESPACE(poly_sub) | | ------------------ | | | | 63| 28|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 626| 28| mlk_poly_reduce(v); ------------------ | | 154| 28|#define mlk_poly_reduce MLK_NAMESPACE(poly_reduce) | | ------------------ | | | | 63| 28|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 627| | 628| 28| mlk_poly_tomsg(m, v); ------------------ | | 577| 28|#define mlk_poly_tomsg MLK_NAMESPACE(poly_tomsg) | | ------------------ | | | | 63| 28|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 629| | 630| 28|cleanup: 631| | /* Specification: Partially implements 632| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 633| 28| MLK_FREE(b_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 634| 28| MLK_FREE(sb, mlk_poly, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 635| 28| MLK_FREE(v, mlk_poly, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 636| 28| MLK_FREE(skpv, mlk_polyvec, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 637| | MLK_FREE(b, mlk_polyvec, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 638| 28| return ret; 639| 28|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_check_pk: 45| 28|{ 46| 28| int ret = 0; 47| 28| MLK_ALLOC(p, mlk_polyvec, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 48| 28| MLK_ALLOC(p_reencoded, uint8_t, MLKEM_POLYVECBYTES, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 49| | 50| 28| if (p == NULL || p_reencoded == NULL) ------------------ | Branch (50:7): [True: 0, False: 28] | Branch (50:20): [True: 0, False: 28] ------------------ 51| 0| { 52| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 53| 0| goto cleanup; 54| 0| } 55| | 56| 28| mlk_polyvec_frombytes(p, pk); ------------------ | | 247| 28|#define mlk_polyvec_frombytes MLK_NAMESPACE_K(polyvec_frombytes) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 57| 28| mlk_polyvec_reduce(p); ------------------ | | 387| 28|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 58| 28| mlk_polyvec_tobytes(p_reencoded, p); ------------------ | | 225| 28|#define mlk_polyvec_tobytes MLK_NAMESPACE_K(polyvec_tobytes) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 59| | 60| | /* We use a constant-time memcmp here to avoid having to 61| | * declassify the PK before the PCT has succeeded. */ 62| 28| ret = mlk_ct_memcmp(pk, p_reencoded, MLKEM_POLYVECBYTES) ? MLK_ERR_FAIL : 0; ------------------ | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | ------------------ | | | | 17| 28|#define MLKEM_K 4 | | ------------------ | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | ------------------ | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | ------------------ ------------------ ret = mlk_ct_memcmp(pk, p_reencoded, MLKEM_POLYVECBYTES) ? MLK_ERR_FAIL : 0; ------------------ | | 272| 0|#define MLK_ERR_FAIL (-1) ------------------ | Branch (62:9): [True: 0, False: 28] ------------------ 63| | 64| 28|cleanup: 65| | /* Specification: Partially implements 66| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 67| 28| MLK_FREE(p_reencoded, uint8_t, MLKEM_POLYVECBYTES, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 68| | MLK_FREE(p, mlk_polyvec, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 69| 28| return ret; 70| 28|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_check_sk: 78| 28|{ 79| 28| int ret = 0; 80| 28| MLK_ALLOC(test, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 81| | 82| 28| if (test == NULL) ------------------ | Branch (82:7): [True: 0, False: 28] ------------------ 83| 0| { 84| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 85| 0| goto cleanup; 86| 0| } 87| | 88| | /* 89| | * The parts of `sk` being hashed and compared here are public, so 90| | * no public information is leaked through the runtime or the return value 91| | * of this function. 92| | */ 93| | 94| | /* Declassify the public part of the secret key */ 95| 28| MLK_CT_TESTING_DECLASSIFY(sk + MLKEM_INDCPA_SECRETKEYBYTES, ------------------ | | 235| 28| do \ | | 236| 28| { \ | | 237| 28| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 28] | | ------------------ ------------------ 96| 28| MLKEM_INDCCA_PUBLICKEYBYTES); 97| 28| MLK_CT_TESTING_DECLASSIFY( ------------------ | | 235| 28| do \ | | 236| 28| { \ | | 237| 28| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 28] | | ------------------ ------------------ 98| 28| sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, MLKEM_SYMBYTES); 99| | 100| 28| mlk_hash_h(test, sk + MLKEM_INDCPA_SECRETKEYBYTES, ------------------ | | 29| 28|#define mlk_hash_h(OUT, IN, INBYTES) mlk_sha3_256(OUT, IN, INBYTES) | | ------------------ | | | | 19| 28|#define mlk_sha3_256 sha3_256 | | | | ------------------ | | | | | | 15| 28|#define sha3_256 OQS_SHA3_sha3_256 | | | | ------------------ | | ------------------ ------------------ 101| 28| MLKEM_INDCCA_PUBLICKEYBYTES); 102| | /* This doesn't have to be a constant-time memcmp, but it's the only place 103| | * in the library where a normal memcmp would be used otherwise, so for sake 104| | * of minimizing stdlib dependency, we use our constant-time one anyway. */ 105| 28| ret = mlk_ct_memcmp(sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 72| 28| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 28|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 28|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 28|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 28|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 28| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ ret = mlk_ct_memcmp(sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ | Branch (105:9): [True: 0, False: 28] ------------------ 106| 28| test, MLKEM_SYMBYTES) ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 107| 28| ? MLK_ERR_FAIL ------------------ | | 272| 0|#define MLK_ERR_FAIL (-1) ------------------ 108| 28| : 0; 109| | 110| 28|cleanup: 111| | /* Specification: Partially implements 112| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 113| | MLK_FREE(test, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 114| 28| return ret; 115| 28|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_keypair_derand: 214| 28|{ 215| 28| int ret; 216| | 217| 28| ret = mlk_indcpa_keypair_derand(pk, sk, coins, context); ------------------ | | 49| 28| MLK_NAMESPACE_K(indcpa_keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | MLK_NAMESPACE_K(indcpa_keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 212| 28|#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2) | | ------------------ ------------------ 218| 28| if (ret != 0) ------------------ | Branch (218:7): [True: 0, False: 28] ------------------ 219| 0| { 220| 0| goto cleanup; 221| 0| } 222| | 223| 28| mlk_memcpy(sk + MLKEM_INDCPA_SECRETKEYBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 168| 28|#define mlk_memcpy memcpy ------------------ mlk_memcpy(sk + MLKEM_INDCPA_SECRETKEYBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 65| 28|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | ------------------ | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 17| 28|#define MLKEM_K 4 | | | | ------------------ | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | ------------------ | | ------------------ ------------------ mlk_memcpy(sk + MLKEM_INDCPA_SECRETKEYBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 69| 28|#define MLKEM_INDCCA_PUBLICKEYBYTES (MLKEM_INDCPA_PUBLICKEYBYTES) | | ------------------ | | | | 64| 28|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 28|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ ------------------ 224| 28| mlk_hash_h(sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, pk, ------------------ | | 29| 28|#define mlk_hash_h(OUT, IN, INBYTES) mlk_sha3_256(OUT, IN, INBYTES) | | ------------------ | | | | 19| 28|#define mlk_sha3_256 sha3_256 | | | | ------------------ | | | | | | 15| 28|#define sha3_256 OQS_SHA3_sha3_256 | | | | ------------------ | | ------------------ ------------------ 225| 28| MLKEM_INDCCA_PUBLICKEYBYTES); 226| | /* Value z for pseudo-random output on reject */ 227| 28| mlk_memcpy(sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 168| 28|#define mlk_memcpy memcpy ------------------ mlk_memcpy(sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 72| 28| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 28|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 28|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 28|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 28|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 28| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ mlk_memcpy(sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 228| 28| coins + MLKEM_SYMBYTES, MLKEM_SYMBYTES); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ coins + MLKEM_SYMBYTES, MLKEM_SYMBYTES); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 229| | 230| | /* Declassify public key */ 231| 28| MLK_CT_TESTING_DECLASSIFY(pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 235| 28| do \ | | 236| 28| { \ | | 237| 28| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 28] | | ------------------ ------------------ 232| | 233| | /* Pairwise Consistency Test (PCT) @[FIPS140_3_IG, p.87] */ 234| 28| ret = mlk_check_pct(pk, sk, context); ------------------ | | 37| 28|#define mlk_check_pct MLK_ADD_PARAM_SET(mlk_check_pct) MLK_CONTEXT_PARAMETERS_2 | | ------------------ | | | | 48| 28|#define MLK_ADD_PARAM_SET(s) s | | ------------------ | | #define mlk_check_pct MLK_ADD_PARAM_SET(mlk_check_pct) MLK_CONTEXT_PARAMETERS_2 | | ------------------ | | | | 211| 28|#define MLK_CONTEXT_PARAMETERS_2(arg0, arg1, context) (arg0, arg1) | | ------------------ ------------------ 235| 28| if (ret != 0) ------------------ | Branch (235:7): [True: 0, False: 28] ------------------ 236| 0| { 237| 0| goto cleanup; 238| 0| } 239| | 240| 28|cleanup: 241| 28| if (ret != 0) ------------------ | Branch (241:7): [True: 0, False: 28] ------------------ 242| 0| { 243| 0| mlk_zeroize(pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 69| 0|#define MLKEM_INDCCA_PUBLICKEYBYTES (MLKEM_INDCPA_PUBLICKEYBYTES) | | ------------------ | | | | 64| 0|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 0|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 0|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 0|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ ------------------ 244| 0| mlk_zeroize(sk, MLKEM_INDCCA_SECRETKEYBYTES); ------------------ | | 72| 0| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 0|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 0|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 0|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 0|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 0|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 0|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 0|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 0|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 0| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ 245| 0| } 246| | 247| 28| return ret; 248| 28|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_keypair: 257| 28|{ 258| 28| int ret = 0; 259| 28| MLK_ALLOC(coins, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 260| | 261| 28| if (coins == NULL) ------------------ | Branch (261:7): [True: 0, False: 28] ------------------ 262| 0| { 263| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 264| 0| goto cleanup; 265| 0| } 266| | 267| | /* Acquire necessary randomness, and mark it as secret. */ 268| 28| if (mlk_randombytes(coins, 2 * MLKEM_SYMBYTES) != 0) ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ | Branch (268:7): [True: 0, False: 28] ------------------ 269| 0| { 270| 0| ret = MLK_ERR_RNG_FAIL; ------------------ | | 278| 0|#define MLK_ERR_RNG_FAIL (-3) ------------------ 271| 0| goto cleanup; 272| 0| } 273| | 274| 28| MLK_CT_TESTING_SECRET(coins, 2 * MLKEM_SYMBYTES); ------------------ | | 231| 28| do \ | | 232| 28| { \ | | 233| 28| } while (0) | | ------------------ | | | Branch (233:12): [Folded, False: 28] | | ------------------ ------------------ 275| | 276| 28| ret = mlk_kem_keypair_derand(pk, sk, coins, context); ------------------ | | 50| 28| MLK_NAMESPACE_K(keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | MLK_NAMESPACE_K(keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 212| 28|#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2) | | ------------------ ------------------ 277| | 278| 28|cleanup: 279| | /* Specification: Partially implements 280| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 281| | MLK_FREE(coins, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 282| 28| return ret; 283| 28|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_enc_derand: 295| 28|{ 296| 28| int ret = 0; 297| 28| MLK_ALLOC(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 298| 28| MLK_ALLOC(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 299| | 300| 28| if (buf == NULL || kr == NULL) ------------------ | Branch (300:7): [True: 0, False: 28] | Branch (300:22): [True: 0, False: 28] ------------------ 301| 0| { 302| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 303| 0| goto cleanup; 304| 0| } 305| | 306| | /* Specification: Implements @[FIPS203, Section 7.2, Modulus check] */ 307| 28| ret = mlk_kem_check_pk(pk, context); ------------------ | | 55| 28|#define mlk_kem_check_pk MLK_NAMESPACE_K(check_pk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_kem_check_pk MLK_NAMESPACE_K(check_pk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 210| 28|#define MLK_CONTEXT_PARAMETERS_1(arg0, context) (arg0) | | ------------------ ------------------ 308| 28| if (ret != 0) ------------------ | Branch (308:7): [True: 0, False: 28] ------------------ 309| 0| { 310| 0| goto cleanup; 311| 0| } 312| | 313| 28| mlk_memcpy(buf, coins, MLKEM_SYMBYTES); ------------------ | | 168| 28|#define mlk_memcpy memcpy ------------------ mlk_memcpy(buf, coins, MLKEM_SYMBYTES); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 314| | 315| | /* Multitarget countermeasure for coins + contributory KEM */ 316| 28| mlk_hash_h(buf + MLKEM_SYMBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 29| 28|#define mlk_hash_h(OUT, IN, INBYTES) mlk_sha3_256(OUT, IN, INBYTES) | | ------------------ | | | | 19| 28|#define mlk_sha3_256 sha3_256 | | | | ------------------ | | | | | | 15| 28|#define sha3_256 OQS_SHA3_sha3_256 | | | | ------------------ | | ------------------ ------------------ 317| 28| mlk_hash_g(kr, buf, 2 * MLKEM_SYMBYTES); ------------------ | | 32| 28|#define mlk_hash_g(OUT, IN, INBYTES) mlk_sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 20| 28|#define mlk_sha3_512 sha3_512 | | | | ------------------ | | | | | | 31| 28|#define sha3_512 OQS_SHA3_sha3_512 | | | | ------------------ | | ------------------ ------------------ 318| | 319| | /* coins are in kr+MLKEM_SYMBYTES */ 320| 28| ret = mlk_indcpa_enc(ct, buf, pk, kr + MLKEM_SYMBYTES, context); ------------------ | | 88| 28|#define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 214| 28| (arg0, arg1, arg2, arg3) | | ------------------ ------------------ 321| 28| if (ret != 0) ------------------ | Branch (321:7): [True: 0, False: 28] ------------------ 322| 0| { 323| 0| goto cleanup; 324| 0| } 325| | 326| 28| mlk_memcpy(ss, kr, MLKEM_SYMBYTES); ------------------ | | 168| 28|#define mlk_memcpy memcpy ------------------ mlk_memcpy(ss, kr, MLKEM_SYMBYTES); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 327| | 328| 28|cleanup: 329| | /* Specification: Partially implements 330| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 331| 28| MLK_FREE(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 332| | MLK_FREE(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 333| 28| return ret; 334| 28|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_enc: 344| 28|{ 345| 28| int ret = 0; 346| 28| MLK_ALLOC(coins, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 347| | 348| 28| if (coins == NULL) ------------------ | Branch (348:7): [True: 0, False: 28] ------------------ 349| 0| { 350| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 351| 0| goto cleanup; 352| 0| } 353| | 354| 28| if (mlk_randombytes(coins, MLKEM_SYMBYTES) != 0) ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ | Branch (354:7): [True: 0, False: 28] ------------------ 355| 0| { 356| 0| ret = MLK_ERR_RNG_FAIL; ------------------ | | 278| 0|#define MLK_ERR_RNG_FAIL (-3) ------------------ 357| 0| goto cleanup; 358| 0| } 359| | 360| 28| MLK_CT_TESTING_SECRET(coins, MLKEM_SYMBYTES); ------------------ | | 231| 28| do \ | | 232| 28| { \ | | 233| 28| } while (0) | | ------------------ | | | Branch (233:12): [Folded, False: 28] | | ------------------ ------------------ 361| | 362| 28| ret = mlk_kem_enc_derand(ct, ss, pk, coins, context); ------------------ | | 52| 28|#define mlk_kem_enc_derand MLK_NAMESPACE_K(enc_derand) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_kem_enc_derand MLK_NAMESPACE_K(enc_derand) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 214| 28| (arg0, arg1, arg2, arg3) | | ------------------ ------------------ 363| | 364| 28|cleanup: 365| | /* Specification: Partially implements 366| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 367| | MLK_FREE(coins, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 368| 28| return ret; 369| 28|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_dec: 380| 28|{ 381| 28| int ret = 0; 382| 28| uint8_t fail; 383| 28| const uint8_t *pk = sk + MLKEM_INDCPA_SECRETKEYBYTES; ------------------ | | 65| 28|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | ------------------ | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 17| 28|#define MLKEM_K 4 | | | | ------------------ | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | ------------------ | | ------------------ ------------------ 384| 28| MLK_ALLOC(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 385| 28| MLK_ALLOC(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 386| 28| MLK_ALLOC(tmp, uint8_t, MLKEM_SYMBYTES + MLKEM_INDCCA_CIPHERTEXTBYTES, ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 387| 28| context); 388| | 389| 28| if (buf == NULL || kr == NULL || tmp == NULL) ------------------ | Branch (389:7): [True: 0, False: 28] | Branch (389:22): [True: 0, False: 28] | Branch (389:36): [True: 0, False: 28] ------------------ 390| 0| { 391| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 392| 0| goto cleanup; 393| 0| } 394| | 395| | /* Specification: Implements @[FIPS203, Section 7.3, Hash check] */ 396| 28| ret = mlk_kem_check_sk(sk, context); ------------------ | | 56| 28|#define mlk_kem_check_sk MLK_NAMESPACE_K(check_sk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_kem_check_sk MLK_NAMESPACE_K(check_sk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 210| 28|#define MLK_CONTEXT_PARAMETERS_1(arg0, context) (arg0) | | ------------------ ------------------ 397| 28| if (ret != 0) ------------------ | Branch (397:7): [True: 0, False: 28] ------------------ 398| 0| { 399| 0| goto cleanup; 400| 0| } 401| | 402| 28| ret = mlk_indcpa_dec(buf, ct, sk, context); ------------------ | | 127| 28|#define mlk_indcpa_dec MLK_NAMESPACE_K(indcpa_dec) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_indcpa_dec MLK_NAMESPACE_K(indcpa_dec) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 212| 28|#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2) | | ------------------ ------------------ 403| 28| if (ret != 0) ------------------ | Branch (403:7): [True: 0, False: 28] ------------------ 404| 0| { 405| 0| goto cleanup; 406| 0| } 407| | 408| | /* Multitarget countermeasure for coins + contributory KEM */ 409| 28| mlk_memcpy(buf + MLKEM_SYMBYTES, ------------------ | | 168| 28|#define mlk_memcpy memcpy ------------------ mlk_memcpy(buf + MLKEM_SYMBYTES, ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 410| 28| sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 72| 28| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 28|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 28|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 28|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 28|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 28| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 411| 28| MLKEM_SYMBYTES); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 412| 28| mlk_hash_g(kr, buf, 2 * MLKEM_SYMBYTES); ------------------ | | 32| 28|#define mlk_hash_g(OUT, IN, INBYTES) mlk_sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 20| 28|#define mlk_sha3_512 sha3_512 | | | | ------------------ | | | | | | 31| 28|#define sha3_512 OQS_SHA3_sha3_512 | | | | ------------------ | | ------------------ ------------------ 413| | 414| | /* Recompute and compare ciphertext */ 415| | /* coins are in kr+MLKEM_SYMBYTES */ 416| 28| ret = mlk_indcpa_enc(tmp, buf, pk, kr + MLKEM_SYMBYTES, context); ------------------ | | 88| 28|#define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 214| 28| (arg0, arg1, arg2, arg3) | | ------------------ ------------------ 417| 28| if (ret != 0) ------------------ | Branch (417:7): [True: 0, False: 28] ------------------ 418| 0| { 419| 0| goto cleanup; 420| 0| } 421| | 422| 28| fail = mlk_ct_memcmp(ct, tmp, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 74| 28|#define MLKEM_INDCCA_CIPHERTEXTBYTES (MLKEM_INDCPA_BYTES) | | ------------------ | | | | 67| 28| (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 58| 28|#define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 17| 28|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 57| 28|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D11 | | | | | | | | ------------------ | | | | | | | | | | 36| 28|#define MLKEM_POLYCOMPRESSEDBYTES_D11 352 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 56| 28|#define MLKEM_POLYCOMPRESSEDBYTES_DV MLKEM_POLYCOMPRESSEDBYTES_D5 | | | | | | ------------------ | | | | | | | | 34| 28|#define MLKEM_POLYCOMPRESSEDBYTES_D5 160 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 423| | 424| | /* Compute rejection key */ 425| 28| mlk_memcpy(tmp, sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 168| 28|#define mlk_memcpy memcpy ------------------ mlk_memcpy(tmp, sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 72| 28| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 28|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 28|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 28|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 17| 28|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 28| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ mlk_memcpy(tmp, sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 426| 28| MLKEM_SYMBYTES); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 427| 28| mlk_memcpy(tmp + MLKEM_SYMBYTES, ct, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 168| 28|#define mlk_memcpy memcpy ------------------ mlk_memcpy(tmp + MLKEM_SYMBYTES, ct, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ mlk_memcpy(tmp + MLKEM_SYMBYTES, ct, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 74| 28|#define MLKEM_INDCCA_CIPHERTEXTBYTES (MLKEM_INDCPA_BYTES) | | ------------------ | | | | 67| 28| (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 58| 28|#define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 17| 28|#define MLKEM_K 4 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 57| 28|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D11 | | | | | | | | ------------------ | | | | | | | | | | 36| 28|#define MLKEM_POLYCOMPRESSEDBYTES_D11 352 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 56| 28|#define MLKEM_POLYCOMPRESSEDBYTES_DV MLKEM_POLYCOMPRESSEDBYTES_D5 | | | | | | ------------------ | | | | | | | | 34| 28|#define MLKEM_POLYCOMPRESSEDBYTES_D5 160 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 428| 28| mlk_hash_j(ss, tmp, MLKEM_SYMBYTES + MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 36| 28| mlk_shake256(OUT, MLKEM_SYMBYTES, IN, INBYTES) | | ------------------ | | | | 18| 28|#define mlk_shake256 shake256 | | | | ------------------ | | | | | | 12| 28|#define shake256 OQS_SHA3_shake256 | | | | ------------------ | | ------------------ | | mlk_shake256(OUT, MLKEM_SYMBYTES, IN, INBYTES) | | ------------------ | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ 429| | 430| | /* Copy true key to return buffer if fail is 0 */ 431| 28| mlk_ct_cmov_zero(ss, kr, MLKEM_SYMBYTES, fail); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 432| | 433| 28|cleanup: 434| | /* Specification: Partially implements 435| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 436| 28| MLK_FREE(tmp, uint8_t, MLKEM_SYMBYTES + MLKEM_INDCCA_CIPHERTEXTBYTES, ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 437| 28| context); 438| 28| MLK_FREE(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 439| 28| MLK_FREE(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 440| | 441| 28| return ret; 442| 28|} poly_k.c:mlk_polyvec_basemul_acc_montgomery_cached_k4_native: 157| 420|{ 158| 420| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (158:7): [True: 0, False: 420] ------------------ 159| 0| { 160| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 161| 0| } 162| | 163| 420| mlk_polyvec_basemul_acc_montgomery_cached_k4_avx2_asm(r, a, b, b_cache); ------------------ | | 141| 420| MLK_NAMESPACE(polyvec_basemul_acc_montgomery_cached_k4_avx2_asm) | | ------------------ | | | | 63| 420|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 420|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 420|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 164| 420| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 420|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 165| 420|} compress.c:mlk_poly_compress_d5_native: 252| 56|{ 253| 56| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (253:7): [True: 0, False: 56] ------------------ 254| 0| { 255| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 256| 0| } 257| | 258| 56| mlk_poly_compress_d5_avx2_asm(r, a, mlk_compress_d5_data); ------------------ | | 261| 56|#define mlk_poly_compress_d5_avx2_asm MLK_NAMESPACE(poly_compress_d5_avx2_asm) | | ------------------ | | | | 63| 56|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_compress_d5_avx2_asm(r, a, mlk_compress_d5_data); ------------------ | | 31| 56|#define mlk_compress_d5_data MLK_NAMESPACE(compress_d5_data) | | ------------------ | | | | 63| 56|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 259| 56| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 56|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 260| 56|} compress.c:mlk_poly_compress_d11_native: 265| 224|{ 266| 224| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (266:7): [True: 0, False: 224] ------------------ 267| 0| { 268| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 269| 0| } 270| | 271| 224| mlk_poly_compress_d11_avx2_asm(r, a, mlk_compress_d11_data); ------------------ | | 294| 224|#define mlk_poly_compress_d11_avx2_asm MLK_NAMESPACE(poly_compress_d11_avx2_asm) | | ------------------ | | | | 63| 224|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 224|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 224|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_compress_d11_avx2_asm(r, a, mlk_compress_d11_data); ------------------ | | 37| 224|#define mlk_compress_d11_data MLK_NAMESPACE(compress_d11_data) | | ------------------ | | | | 63| 224|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 224|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 224|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 272| 224| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 224|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 273| 224|} compress.c:mlk_poly_decompress_d5_native: 278| 28|{ 279| 28| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (279:7): [True: 0, False: 28] ------------------ 280| 0| { 281| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 282| 0| } 283| | 284| 28| mlk_poly_decompress_d5_avx2_asm(r, a, mlk_decompress_d5_data); ------------------ | | 278| 28| MLK_NAMESPACE(poly_decompress_d5_avx2_asm) | | ------------------ | | | | 63| 28|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_decompress_d5_avx2_asm(r, a, mlk_decompress_d5_data); ------------------ | | 34| 28|#define mlk_decompress_d5_data MLK_NAMESPACE(decompress_d5_data) | | ------------------ | | | | 63| 28|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 285| 28| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 28|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 286| 28|} compress.c:mlk_poly_decompress_d11_native: 291| 112|{ 292| 112| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (292:7): [True: 0, False: 112] ------------------ 293| 0| { 294| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 295| 0| } 296| | 297| 112| mlk_poly_decompress_d11_avx2_asm(r, a, mlk_decompress_d11_data); ------------------ | | 311| 112| MLK_NAMESPACE(poly_decompress_d11_avx2_asm) | | ------------------ | | | | 63| 112|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 112|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 112|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_decompress_d11_avx2_asm(r, a, mlk_decompress_d11_data); ------------------ | | 40| 112|#define mlk_decompress_d11_data MLK_NAMESPACE(decompress_d11_data) | | ------------------ | | | | 63| 112|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 112|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 112|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 298| 112| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 112|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 299| 112|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_tomont: 132| 112|{ 133| 112|#if defined(MLK_USE_NATIVE_POLY_TOMONT) 134| 112| int ret; 135| 112| ret = mlk_poly_tomont_native(r->coeffs); 136| 112| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 112|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (136:7): [True: 112, False: 0] ------------------ 137| 112| { 138| 112| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_Q); ------------------ | | 105| 112| do \ | | 106| 112| { \ | | 107| 112| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 112] | | ------------------ ------------------ 139| 112| return; 140| 112| } 141| 0|#endif /* MLK_USE_NATIVE_POLY_TOMONT */ 142| | 143| 0| mlk_poly_tomont_c(r); 144| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_reduce: 211| 644|{ 212| 644|#if defined(MLK_USE_NATIVE_POLY_REDUCE) 213| 644| int ret; 214| 644| ret = mlk_poly_reduce_native(r->coeffs); 215| 644| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 644|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (215:7): [True: 644, False: 0] ------------------ 216| 644| { 217| 644| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 644| do \ | | 102| 644| { \ | | 103| 644| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 644] | | ------------------ ------------------ 218| 644| return; 219| 644| } 220| 0|#endif /* MLK_USE_NATIVE_POLY_REDUCE */ 221| | 222| 0| mlk_poly_reduce_c(r); 223| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_add: 230| 448|{ 231| 448| unsigned i; 232| 115k| for (i = 0; i < MLKEM_N; i++) ------------------ | | 22| 115k|#define MLKEM_N 256 ------------------ | Branch (232:15): [True: 114k, False: 448] ------------------ 233| 114k| __loop__( 234| 114k| invariant(i <= MLKEM_N) 235| 114k| invariant(forall(k0, i, MLKEM_N, r->coeffs[k0] == loop_entry(*r).coeffs[k0])) 236| 114k| invariant(forall(k1, 0, i, r->coeffs[k1] == loop_entry(*r).coeffs[k1] + b->coeffs[k1])) 237| 114k| decreases(MLKEM_N - i)) 238| 114k| { 239| | /* The preconditions imply that the addition stays within int16_t. */ 240| 114k| r->coeffs[i] = (int16_t)(r->coeffs[i] + b->coeffs[i]); 241| 114k| } 242| 448|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_sub: 249| 28|{ 250| 28| unsigned i; 251| 7.19k| for (i = 0; i < MLKEM_N; i++) ------------------ | | 22| 7.19k|#define MLKEM_N 256 ------------------ | Branch (251:15): [True: 7.16k, False: 28] ------------------ 252| 7.16k| __loop__( 253| 7.16k| invariant(i <= MLKEM_N) 254| 7.16k| invariant(forall(k0, i, MLKEM_N, r->coeffs[k0] == loop_entry(*r).coeffs[k0])) 255| 7.16k| invariant(forall(k1, 0, i, r->coeffs[k1] == loop_entry(*r).coeffs[k1] - b->coeffs[k1])) 256| 7.16k| decreases(MLKEM_N - i)) 257| 7.16k| { 258| | /* The preconditions imply that the subtraction stays within int16_t. */ 259| 7.16k| r->coeffs[i] = (int16_t)(r->coeffs[i] - b->coeffs[i]); 260| 7.16k| } 261| 28|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_mulcache_compute: 302| 448|{ 303| 448|#if defined(MLK_USE_NATIVE_POLY_MULCACHE_COMPUTE) 304| 448| int ret; 305| 448| ret = mlk_poly_mulcache_compute_native(x->coeffs, a->coeffs); 306| 448| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 448|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (306:7): [True: 448, False: 0] ------------------ 307| 448| { 308| 448| return; 309| 448| } 310| 0|#endif /* MLK_USE_NATIVE_POLY_MULCACHE_COMPUTE */ 311| | 312| 0| mlk_poly_mulcache_compute_c(x, a); 313| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_ntt: 457| 560|{ 458| 560|#if defined(MLK_USE_NATIVE_NTT) 459| 560| int ret; 460| 560| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_Q); ------------------ | | 105| 560| do \ | | 106| 560| { \ | | 107| 560| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 560] | | ------------------ ------------------ 461| 560| ret = mlk_ntt_native(r->coeffs); 462| 560| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 560|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (462:7): [True: 560, False: 0] ------------------ 463| 560| { 464| 560| mlk_assert_abs_bound(r, MLKEM_N, MLK_NTT_BOUND); ------------------ | | 105| 560| do \ | | 106| 560| { \ | | 107| 560| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 560] | | ------------------ ------------------ 465| 560| return; 466| 560| } 467| 0|#endif /* MLK_USE_NATIVE_NTT */ 468| | 469| 0| mlk_poly_ntt_c(r); 470| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_invntt_tomont: 558| 308|{ 559| 308|#if defined(MLK_USE_NATIVE_INTT) 560| 308| int ret; 561| 308| ret = mlk_intt_native(r->coeffs); 562| 308| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 308|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (562:7): [True: 308, False: 0] ------------------ 563| 308| { 564| 308| mlk_assert_abs_bound(r, MLKEM_N, MLK_INVNTT_BOUND); ------------------ | | 105| 308| do \ | | 106| 308| { \ | | 107| 308| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 308] | | ------------------ ------------------ 565| 308| return; 566| 308| } 567| 0|#endif /* MLK_USE_NATIVE_INTT */ 568| | 569| 0| mlk_poly_invntt_tomont_c(r); 570| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_compress_du: 50| 56|{ 51| 56| unsigned i; 52| 56| mlk_assert_bound_2d(a->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 56| do \ | | 111| 56| { \ | | 112| 56| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 56] | | ------------------ ------------------ 53| | 54| 280| for (i = 0; i < MLKEM_K; i++) ------------------ | | 17| 280|#define MLKEM_K 4 ------------------ | Branch (54:15): [True: 224, False: 56] ------------------ 55| 224| { 56| 224| mlk_poly_compress_du(r + i * MLKEM_POLYCOMPRESSEDBYTES_DU, &a->vec[i]); ------------------ | | 49| 224|#define mlk_poly_compress_du MLK_NAMESPACE_K(poly_compress_du) | | ------------------ | | | | 64| 224|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 224|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 224|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_compress_du(r + i * MLKEM_POLYCOMPRESSEDBYTES_DU, &a->vec[i]); ------------------ | | 57| 224|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D11 | | ------------------ | | | | 36| 224|#define MLKEM_POLYCOMPRESSEDBYTES_D11 352 | | ------------------ ------------------ 57| 224| } 58| 56|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_decompress_du: 64| 28|{ 65| 28| unsigned i; 66| 140| for (i = 0; i < MLKEM_K; i++) ------------------ | | 17| 140|#define MLKEM_K 4 ------------------ | Branch (66:15): [True: 112, False: 28] ------------------ 67| 112| { 68| 112| mlk_poly_decompress_du(&r->vec[i], a + i * MLKEM_POLYCOMPRESSEDBYTES_DU); ------------------ | | 79| 112|#define mlk_poly_decompress_du MLK_NAMESPACE_K(poly_decompress_du) | | ------------------ | | | | 64| 112|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 112|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 112|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_decompress_du(&r->vec[i], a + i * MLKEM_POLYCOMPRESSEDBYTES_DU); ------------------ | | 57| 112|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D11 | | ------------------ | | | | 36| 112|#define MLKEM_POLYCOMPRESSEDBYTES_D11 352 | | ------------------ ------------------ 69| 112| } 70| | 71| 28| mlk_assert_bound_2d(r->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 28| do \ | | 111| 28| { \ | | 112| 28| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 28] | | ------------------ ------------------ 72| 28|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_tobytes: 81| 84|{ 82| 84| unsigned i; 83| 84| mlk_assert_bound_2d(a->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 84| do \ | | 111| 84| { \ | | 112| 84| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 84] | | ------------------ ------------------ 84| | 85| 420| for (i = 0; i < MLKEM_K; i++) ------------------ | | 17| 420|#define MLKEM_K 4 ------------------ | Branch (85:15): [True: 336, False: 84] ------------------ 86| 336| __loop__( 87| 336| assigns(i, memory_slice(r, MLKEM_POLYVECBYTES)) 88| 336| invariant(i <= MLKEM_K) 89| 336| decreases(MLKEM_K - i) 90| 336| ) 91| 336| { 92| 336| mlk_poly_tobytes(&r[i * MLKEM_POLYBYTES], &a->vec[i]); ------------------ | | 512| 336|#define mlk_poly_tobytes MLK_NAMESPACE(poly_tobytes) | | ------------------ | | | | 63| 336|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 336|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 336|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_tobytes(&r[i * MLKEM_POLYBYTES], &a->vec[i]); ------------------ | | 30| 336|#define MLKEM_POLYBYTES 384 ------------------ 93| 336| } 94| 84|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_frombytes: 99| 112|{ 100| 112| unsigned i; 101| 560| for (i = 0; i < MLKEM_K; i++) ------------------ | | 17| 560|#define MLKEM_K 4 ------------------ | Branch (101:15): [True: 448, False: 112] ------------------ 102| 448| { 103| 448| mlk_poly_frombytes(&r->vec[i], a + i * MLKEM_POLYBYTES); ------------------ | | 534| 448|#define mlk_poly_frombytes MLK_NAMESPACE(poly_frombytes) | | ------------------ | | | | 63| 448|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 448|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 448|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_frombytes(&r->vec[i], a + i * MLKEM_POLYBYTES); ------------------ | | 30| 448|#define MLKEM_POLYBYTES 384 ------------------ 104| 448| } 105| | 106| 112| mlk_assert_bound_2d(r->vec, MLKEM_K, MLKEM_N, 0, MLKEM_UINT12_LIMIT); ------------------ | | 110| 112| do \ | | 111| 112| { \ | | 112| 112| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 112] | | ------------------ ------------------ 107| 112|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_ntt: 112| 140|{ 113| 140| unsigned i; 114| 700| for (i = 0; i < MLKEM_K; i++) ------------------ | | 17| 700|#define MLKEM_K 4 ------------------ | Branch (114:15): [True: 560, False: 140] ------------------ 115| 560| { 116| 560| mlk_poly_ntt(&r->vec[i]); ------------------ | | 235| 560|#define mlk_poly_ntt MLK_NAMESPACE(poly_ntt) | | ------------------ | | | | 63| 560|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 560|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 560|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 117| 560| } 118| | 119| 140| mlk_assert_abs_bound_2d(r->vec, MLKEM_K, MLKEM_N, MLK_NTT_BOUND); ------------------ | | 115| 140| do \ | | 116| 140| { \ | | 117| 140| } while (0) | | ------------------ | | | Branch (117:12): [Folded, False: 140] | | ------------------ ------------------ 120| 140|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_invntt_tomont: 129| 56|{ 130| 56| unsigned i; 131| 280| for (i = 0; i < MLKEM_K; i++) ------------------ | | 17| 280|#define MLKEM_K 4 ------------------ | Branch (131:15): [True: 224, False: 56] ------------------ 132| 224| { 133| 224| mlk_poly_invntt_tomont(&r->vec[i]); ------------------ | | 263| 224|#define mlk_poly_invntt_tomont MLK_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 63| 224|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 224|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 224|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 134| 224| } 135| | 136| 56| mlk_assert_abs_bound_2d(r->vec, MLKEM_K, MLKEM_N, MLK_INVNTT_BOUND); ------------------ | | 115| 56| do \ | | 116| 56| { \ | | 117| 56| } while (0) | | ------------------ | | | Branch (117:12): [Folded, False: 56] | | ------------------ ------------------ 137| 56|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_basemul_acc_montgomery_cached: 195| 420|{ 196| 420|#if defined(MLK_USE_NATIVE_POLYVEC_BASEMUL_ACC_MONTGOMERY_CACHED) 197| 420| { 198| 420| int ret; 199| 420| mlk_assert_bound_2d(a->vec, MLKEM_K, MLKEM_N, 0, MLKEM_UINT12_LIMIT); ------------------ | | 110| 420| do \ | | 111| 420| { \ | | 112| 420| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 420] | | ------------------ ------------------ 200| |#if MLKEM_K == 2 201| | ret = mlk_polyvec_basemul_acc_montgomery_cached_k2_native( 202| | r->coeffs, (const int16_t *)a, (const int16_t *)b, 203| | (const int16_t *)b_cache); 204| |#elif MLKEM_K == 3 205| | ret = mlk_polyvec_basemul_acc_montgomery_cached_k3_native( 206| | r->coeffs, (const int16_t *)a, (const int16_t *)b, 207| | (const int16_t *)b_cache); 208| |#elif MLKEM_K == 4 209| | ret = mlk_polyvec_basemul_acc_montgomery_cached_k4_native( 210| 420| r->coeffs, (const int16_t *)a, (const int16_t *)b, 211| 420| (const int16_t *)b_cache); 212| 420|#endif 213| 420| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 420|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (213:9): [True: 420, False: 0] ------------------ 214| 420| { 215| 420| return; 216| 420| } 217| 420| } 218| 0|#endif /* MLK_USE_NATIVE_POLYVEC_BASEMUL_ACC_MONTGOMERY_CACHED */ 219| | 220| 0| mlk_polyvec_basemul_acc_montgomery_cached_c(r, a, b, b_cache); ------------------ | | 39| 0| MLK_ADD_PARAM_SET(mlk_polyvec_basemul_acc_montgomery_cached_c) | | ------------------ | | | | 48| 0|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 221| 0|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_mulcache_compute: 229| 112|{ 230| 112| unsigned i; 231| 560| for (i = 0; i < MLKEM_K; i++) ------------------ | | 17| 560|#define MLKEM_K 4 ------------------ | Branch (231:15): [True: 448, False: 112] ------------------ 232| 448| { 233| 448| mlk_poly_mulcache_compute(&x->vec[i], &a->vec[i]); ------------------ | | 123| 448|#define mlk_poly_mulcache_compute MLK_NAMESPACE(poly_mulcache_compute) | | ------------------ | | | | 63| 448|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 448|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 448|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 234| 448| } 235| 112|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_reduce: 246| 140|{ 247| 140| unsigned i; 248| 700| for (i = 0; i < MLKEM_K; i++) ------------------ | | 17| 700|#define MLKEM_K 4 ------------------ | Branch (248:15): [True: 560, False: 140] ------------------ 249| 560| { 250| 560| mlk_poly_reduce(&r->vec[i]); ------------------ | | 154| 560|#define mlk_poly_reduce MLK_NAMESPACE(poly_reduce) | | ------------------ | | | | 63| 560|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 560|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 560|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 251| 560| } 252| | 253| 140| mlk_assert_bound_2d(r->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 140| do \ | | 111| 140| { \ | | 112| 140| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 140] | | ------------------ ------------------ 254| 140|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_add: 261| 84|{ 262| 84| unsigned i; 263| 420| for (i = 0; i < MLKEM_K; i++) ------------------ | | 17| 420|#define MLKEM_K 4 ------------------ | Branch (263:15): [True: 336, False: 84] ------------------ 264| 336| __loop__( 265| 336| assigns(i, memory_slice(r, sizeof(mlk_polyvec))) 266| 336| invariant(i <= MLKEM_K) 267| 336| invariant(forall(j0, i, MLKEM_K, 268| 336| forall(k0, 0, MLKEM_N, 269| 336| ((int32_t)r->vec[j0].coeffs[k0] + b->vec[j0].coeffs[k0] <= INT16_MAX) && 270| 336| ((int32_t)r->vec[j0].coeffs[k0] + b->vec[j0].coeffs[k0] >= INT16_MIN)))) 271| 336| invariant(forall(j2, 0, i, 272| 336| forall(k2, 0, MLKEM_N, 273| 336| (r->vec[j2].coeffs[k2] <= INT16_MAX) && 274| 336| (r->vec[j2].coeffs[k2] >= INT16_MIN)))) 275| 336| decreases(MLKEM_K - i) 276| 336| ) 277| 336| { 278| 336| mlk_poly_add(&r->vec[i], &b->vec[i]); ------------------ | | 181| 336|#define mlk_poly_add MLK_NAMESPACE(poly_add) | | ------------------ | | | | 63| 336|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 336|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 336|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 279| 336| } 280| 84|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_polyvec_tomont: 285| 28|{ 286| 28| unsigned i; 287| 140| for (i = 0; i < MLKEM_K; i++) ------------------ | | 17| 140|#define MLKEM_K 4 ------------------ | Branch (287:15): [True: 112, False: 28] ------------------ 288| 112| { 289| 112| mlk_poly_tomont(&r->vec[i]); ------------------ | | 102| 112|#define mlk_poly_tomont MLK_NAMESPACE(poly_tomont) | | ------------------ | | | | 63| 112|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 112|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 112|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 290| 112| } 291| | 292| 28| mlk_assert_abs_bound_2d(r->vec, MLKEM_K, MLKEM_N, MLKEM_Q); ------------------ | | 115| 28| do \ | | 116| 28| { \ | | 117| 28| } while (0) | | ------------------ | | | Branch (117:12): [Folded, False: 28] | | ------------------ ------------------ 293| 28|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_getnoise_eta1_4x: 337| 168|{ 338| 168| MLK_ALIGN uint8_t buf[4][MLK_ALIGN_UP(MLKEM_ETA1 * MLKEM_N / 4)]; ------------------ | | 190| 168|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 339| 168| MLK_ALIGN uint8_t extkey[4][MLK_ALIGN_UP(MLKEM_SYMBYTES + 1)]; ------------------ | | 190| 168|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 340| 168| mlk_memcpy(extkey[0], seed, MLKEM_SYMBYTES); ------------------ | | 168| 168|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[0], seed, MLKEM_SYMBYTES); ------------------ | | 27| 168|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 341| 168| mlk_memcpy(extkey[1], seed, MLKEM_SYMBYTES); ------------------ | | 168| 168|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[1], seed, MLKEM_SYMBYTES); ------------------ | | 27| 168|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 342| 168| mlk_memcpy(extkey[2], seed, MLKEM_SYMBYTES); ------------------ | | 168| 168|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[2], seed, MLKEM_SYMBYTES); ------------------ | | 27| 168|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 343| 168| mlk_memcpy(extkey[3], seed, MLKEM_SYMBYTES); ------------------ | | 168| 168|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[3], seed, MLKEM_SYMBYTES); ------------------ | | 27| 168|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 344| 168| extkey[0][MLKEM_SYMBYTES] = nonce0; ------------------ | | 27| 168|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 345| 168| extkey[1][MLKEM_SYMBYTES] = nonce1; ------------------ | | 27| 168|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 346| 168| extkey[2][MLKEM_SYMBYTES] = nonce2; ------------------ | | 27| 168|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 347| 168| extkey[3][MLKEM_SYMBYTES] = nonce3; ------------------ | | 27| 168|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 348| | 349| 168|#if !defined(FIPS202_X4_DEFAULT_IMPLEMENTATION) && \ 350| 168| !defined(MLK_CONFIG_SERIAL_FIPS202_ONLY) 351| 168| mlk_prf_eta1_x4(buf, extkey); ------------------ | | 45| 168| mlk_shake256x4((OUT)[0], (OUT)[1], (OUT)[2], (OUT)[3], \ | | ------------------ | | | | 18| 168|#define mlk_shake256x4 shake256x4 | | | | ------------------ | | | | | | 36| 168|#define shake256x4 OQS_SHA3_shake256_x4 | | | | ------------------ | | ------------------ | | 46| 168| (MLKEM_ETA1 * MLKEM_N / 4), (IN)[0], (IN)[1], (IN)[2], \ | | ------------------ | | | | 53| 168|#define MLKEM_ETA1 2 | | ------------------ | | (MLKEM_ETA1 * MLKEM_N / 4), (IN)[0], (IN)[1], (IN)[2], \ | | ------------------ | | | | 22| 168|#define MLKEM_N 256 | | ------------------ | | 47| 168| (IN)[3], MLKEM_SYMBYTES + 1) | | ------------------ | | | | 27| 168|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ 352| |#else 353| | mlk_prf_eta1(buf[0], extkey[0]); 354| | mlk_prf_eta1(buf[1], extkey[1]); 355| | mlk_prf_eta1(buf[2], extkey[2]); 356| | if (r3 != NULL) 357| | { 358| | mlk_prf_eta1(buf[3], extkey[3]); 359| | } 360| |#endif /* !(!FIPS202_X4_DEFAULT_IMPLEMENTATION && \ 361| | !MLK_CONFIG_SERIAL_FIPS202_ONLY) */ 362| | 363| 168| mlk_poly_cbd_eta1(r0, buf[0]); ------------------ | | 36| 168|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 168|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 364| 168| mlk_poly_cbd_eta1(r1, buf[1]); ------------------ | | 36| 168|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 168|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 365| 168| mlk_poly_cbd_eta1(r2, buf[2]); ------------------ | | 36| 168|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 168|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 366| 168| if (r3 != NULL) ------------------ | Branch (366:7): [True: 168, False: 0] ------------------ 367| 168| { 368| 168| mlk_poly_cbd_eta1(r3, buf[3]); ------------------ | | 36| 168|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 168|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 369| 168| mlk_assert_abs_bound(r3, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 168| do \ | | 106| 168| { \ | | 107| 168| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 168] | | ------------------ ------------------ 370| 168| } 371| | 372| 168| mlk_assert_abs_bound(r0, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 168| do \ | | 106| 168| { \ | | 107| 168| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 168] | | ------------------ ------------------ 373| 168| mlk_assert_abs_bound(r1, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 168| do \ | | 106| 168| { \ | | 107| 168| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 168] | | ------------------ ------------------ 374| 168| mlk_assert_abs_bound(r2, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 168| do \ | | 106| 168| { \ | | 107| 168| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 168] | | ------------------ ------------------ 375| | 376| | /* Specification: Partially implements 377| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 378| 168| mlk_zeroize(buf, sizeof(buf)); 379| 168| mlk_zeroize(extkey, sizeof(extkey)); 380| 168|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_getnoise_eta2: 417| 56|{ 418| 56| MLK_ALIGN uint8_t buf[MLKEM_ETA2 * MLKEM_N / 4]; ------------------ | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 419| 56| MLK_ALIGN uint8_t extkey[MLKEM_SYMBYTES + 1]; ------------------ | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 420| | 421| 56| mlk_memcpy(extkey, seed, MLKEM_SYMBYTES); ------------------ | | 168| 56|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey, seed, MLKEM_SYMBYTES); ------------------ | | 27| 56|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 422| 56| extkey[MLKEM_SYMBYTES] = nonce; ------------------ | | 27| 56|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 423| 56| mlk_prf_eta2(buf, extkey); ------------------ | | 43| 56|#define mlk_prf_eta2(OUT, IN) mlk_prf_eta(MLKEM_ETA2, OUT, IN) | | ------------------ | | | | 41| 56| mlk_shake256(OUT, (ETA) * MLKEM_N / 4, IN, MLKEM_SYMBYTES + 1) | | | | ------------------ | | | | | | 18| 56|#define mlk_shake256 shake256 | | | | | | ------------------ | | | | | | | | 12| 56|#define shake256 OQS_SHA3_shake256 | | | | | | ------------------ | | | | ------------------ | | | | mlk_shake256(OUT, (ETA) * MLKEM_N / 4, IN, MLKEM_SYMBYTES + 1) | | | | ------------------ | | | | | | 22| 56|#define MLKEM_N 256 | | | | ------------------ | | | | mlk_shake256(OUT, (ETA) * MLKEM_N / 4, IN, MLKEM_SYMBYTES + 1) | | | | ------------------ | | | | | | 27| 56|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ ------------------ 424| | 425| 56| mlk_poly_cbd_eta2(r, buf); ------------------ | | 37| 56|#define mlk_poly_cbd_eta2 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta2) | | ------------------ | | | | 48| 56|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 426| | 427| 56| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_ETA2 + 1); ------------------ | | 105| 56| do \ | | 106| 56| { \ | | 107| 56| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 56] | | ------------------ ------------------ 428| | 429| | /* Specification: Partially implements 430| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 431| 56| mlk_zeroize(buf, sizeof(buf)); 432| 56| mlk_zeroize(extkey, sizeof(extkey)); 433| 56|} poly_k.c:PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_compress_du: 69| 224|{ 70| |#if MLKEM_DU == 10 71| | mlk_poly_compress_d10(r, a); 72| |#elif MLKEM_DU == 11 73| 224| mlk_poly_compress_d11(r, a); ------------------ | | 445| 224|#define mlk_poly_compress_d11 MLK_NAMESPACE(poly_compress_d11) | | ------------------ | | | | 63| 224|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 224|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 224|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 74| |#else 75| |#error "Invalid value of MLKEM_DU" 76| |#endif 77| 224|} poly_k.c:PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_decompress_du: 102| 112|{ 103| |#if MLKEM_DU == 10 104| | mlk_poly_decompress_d10(r, a); 105| |#elif MLKEM_DU == 11 106| 112| mlk_poly_decompress_d11(r, a); ------------------ | | 488| 112|#define mlk_poly_decompress_d11 MLK_NAMESPACE(poly_decompress_d11) | | ------------------ | | | | 63| 112|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 112|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 112|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 107| |#else 108| |#error "Invalid value of MLKEM_DU" 109| |#endif 110| 112|} indcpa.c:PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_compress_dv: 132| 56|{ 133| |#if MLKEM_DV == 4 134| | mlk_poly_compress_d4(r, a); 135| |#elif MLKEM_DV == 5 136| 56| mlk_poly_compress_d5(r, a); ------------------ | | 425| 56|#define mlk_poly_compress_d5 MLK_NAMESPACE(poly_compress_d5) | | ------------------ | | | | 63| 56|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 137| |#else 138| |#error "Invalid value of MLKEM_DV" 139| |#endif 140| 56|} indcpa.c:PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_decompress_dv: 166| 28|{ 167| |#if MLKEM_DV == 4 168| | mlk_poly_decompress_d4(r, a); 169| |#elif MLKEM_DV == 5 170| 28| mlk_poly_decompress_d5(r, a); ------------------ | | 465| 28|#define mlk_poly_decompress_d5 MLK_NAMESPACE(poly_decompress_d5) | | ------------------ | | | | 63| 28|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 171| |#else 172| |#error "Invalid value of MLKEM_DV" 173| |#endif 174| 28|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_rej_uniform_x4: 158| 336|{ 159| | /* Temporary buffers for XOF output before rejection sampling */ 160| 336| MLK_ALIGN uint8_t ------------------ | | 190| 336|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 161| 336| buf[4][MLK_ALIGN_UP(MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE)]; 162| | 163| | /* Tracks the number of coefficients we have already sampled */ 164| 336| unsigned ctr[4]; 165| 336| mlk_xof_x4_ctx statex; ------------------ | | 51| 336|#define mlk_xof_x4_ctx mlk_shake128x4ctx | | ------------------ | | | | 13| 336|#define mlk_shake128x4ctx shake128x4ctx | | | | ------------------ | | | | | | 51| 336|#define shake128x4ctx shake128x4incctx | | | | | | ------------------ | | | | | | | | 18| 336|#define shake128x4incctx OQS_SHA3_shake128_x4_inc_ctx | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 166| 336| unsigned buflen; 167| | 168| 336| mlk_xof_x4_init(&statex); ------------------ | | 59| 336|#define mlk_xof_x4_init(CTX) mlk_shake128x4_init((CTX)) | | ------------------ | | | | 16| 336|#define mlk_shake128x4_init shake128x4_init | | | | ------------------ | | | | | | 52| 336|#define shake128x4_init shake128x4_inc_init | | | | | | ------------------ | | | | | | | | 19| 336|#define shake128x4_inc_init OQS_SHA3_shake128_x4_inc_init | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 169| 336| mlk_xof_x4_absorb(&statex, seed, MLKEM_SYMBYTES + 2); ------------------ | | 61| 336| mlk_shake128x4_absorb_once((CTX), (IN)[0], (IN)[1], (IN)[2], (IN)[3], \ | | ------------------ | | | | 14| 336|#define mlk_shake128x4_absorb_once shake128x4_absorb_once | | | | ------------------ | | | | | | 39| 336|#define shake128x4_absorb_once OQS_SHA3_shake128_x4_absorb_once | | | | ------------------ | | ------------------ | | 62| 336| (INBYTES)) ------------------ 170| | 171| | /* 172| | * Initially, squeeze heuristic number of MLKEM_GEN_MATRIX_NBLOCKS. 173| | * This should generate the matrix entries with high probability. 174| | */ 175| 336| mlk_xof_x4_squeezeblocks(buf, MLKEM_GEN_MATRIX_NBLOCKS, &statex); ------------------ | | 64| 336| mlk_shake128x4_squeezeblocks((BUF)[0], (BUF)[1], (BUF)[2], (BUF)[3], \ | | ------------------ | | | | 15| 336|#define mlk_shake128x4_squeezeblocks shake128x4_squeezeblocks | | | | ------------------ | | | | | | 46| 336| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | | | | | ------------------ | | | | | | | | 239| 336|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 65| 336| (NBLOCKS), (CTX)) ------------------ 176| 336| buflen = MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE; ------------------ | | 146| 336| ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 22| 336|#define MLKEM_N 256 | | ------------------ | | ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 23| 336|#define MLKEM_Q 3329 | | ------------------ | | ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 68| 336|#define MLK_XOF_RATE SHAKE128_RATE | | | | ------------------ | | | | | | 8| 336|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 336|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 147| 336| MLK_XOF_RATE) | | ------------------ | | | | 68| 336|#define MLK_XOF_RATE SHAKE128_RATE | | | | ------------------ | | | | | | 8| 336|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 336|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ buflen = MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE; ------------------ | | 68| 336|#define MLK_XOF_RATE SHAKE128_RATE | | ------------------ | | | | 8| 336|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | ------------------ | | | | | | 239| 336|#define OQS_SHA3_SHAKE128_RATE 168 | | | | ------------------ | | ------------------ ------------------ 177| 336| ctr[0] = mlk_rej_uniform(vec0->coeffs, MLKEM_N, 0, buf[0], buflen); ------------------ | | 22| 336|#define MLKEM_N 256 ------------------ 178| 336| ctr[1] = mlk_rej_uniform(vec1->coeffs, MLKEM_N, 0, buf[1], buflen); ------------------ | | 22| 336|#define MLKEM_N 256 ------------------ 179| 336| ctr[2] = mlk_rej_uniform(vec2->coeffs, MLKEM_N, 0, buf[2], buflen); ------------------ | | 22| 336|#define MLKEM_N 256 ------------------ 180| 336| ctr[3] = mlk_rej_uniform(vec3->coeffs, MLKEM_N, 0, buf[3], buflen); ------------------ | | 22| 336|#define MLKEM_N 256 ------------------ 181| | 182| | /* 183| | * So long as not all matrix entries have been generated, squeeze 184| | * one more block a time until we're done. 185| | */ 186| 336| buflen = MLK_XOF_RATE; ------------------ | | 68| 336|#define MLK_XOF_RATE SHAKE128_RATE | | ------------------ | | | | 8| 336|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | ------------------ | | | | | | 239| 336|#define OQS_SHA3_SHAKE128_RATE 168 | | | | ------------------ | | ------------------ ------------------ 187| 462| while (ctr[0] < MLKEM_N || ctr[1] < MLKEM_N || ctr[2] < MLKEM_N || ------------------ | | 22| 924|#define MLKEM_N 256 ------------------ while (ctr[0] < MLKEM_N || ctr[1] < MLKEM_N || ctr[2] < MLKEM_N || ------------------ | | 22| 883|#define MLKEM_N 256 ------------------ while (ctr[0] < MLKEM_N || ctr[1] < MLKEM_N || ctr[2] < MLKEM_N || ------------------ | | 22| 849|#define MLKEM_N 256 ------------------ | Branch (187:10): [True: 41, False: 421] | Branch (187:30): [True: 34, False: 387] | Branch (187:50): [True: 29, False: 358] ------------------ 188| 358| ctr[3] < MLKEM_N) ------------------ | | 22| 358|#define MLKEM_N 256 ------------------ | Branch (188:10): [True: 22, False: 336] ------------------ 189| 126| __loop__( 190| 126| assigns(ctr, statex, 191| 126| memory_slice(vec0, sizeof(mlk_poly)), 192| 126| memory_slice(vec1, sizeof(mlk_poly)), 193| 126| memory_slice(vec2, sizeof(mlk_poly)), 194| 126| memory_slice(vec3, sizeof(mlk_poly)), 195| 126| object_whole(buf)) 196| 126| invariant(ctr[0] <= MLKEM_N && ctr[1] <= MLKEM_N) 197| 126| invariant(ctr[2] <= MLKEM_N && ctr[3] <= MLKEM_N) 198| 126| invariant(array_bound(vec0->coeffs, 0, ctr[0], 0, MLKEM_Q)) 199| 126| invariant(array_bound(vec1->coeffs, 0, ctr[1], 0, MLKEM_Q)) 200| 126| invariant(array_bound(vec2->coeffs, 0, ctr[2], 0, MLKEM_Q)) 201| 126| invariant(array_bound(vec3->coeffs, 0, ctr[3], 0, MLKEM_Q))) 202| 126| { 203| 126| mlk_xof_x4_squeezeblocks(buf, 1, &statex); ------------------ | | 64| 126| mlk_shake128x4_squeezeblocks((BUF)[0], (BUF)[1], (BUF)[2], (BUF)[3], \ | | ------------------ | | | | 15| 126|#define mlk_shake128x4_squeezeblocks shake128x4_squeezeblocks | | | | ------------------ | | | | | | 46| 126| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | | | | | ------------------ | | | | | | | | 239| 126|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 65| 126| (NBLOCKS), (CTX)) ------------------ 204| 126| ctr[0] = mlk_rej_uniform(vec0->coeffs, MLKEM_N, ctr[0], buf[0], buflen); ------------------ | | 22| 126|#define MLKEM_N 256 ------------------ 205| 126| ctr[1] = mlk_rej_uniform(vec1->coeffs, MLKEM_N, ctr[1], buf[1], buflen); ------------------ | | 22| 126|#define MLKEM_N 256 ------------------ 206| 126| ctr[2] = mlk_rej_uniform(vec2->coeffs, MLKEM_N, ctr[2], buf[2], buflen); ------------------ | | 22| 126|#define MLKEM_N 256 ------------------ 207| 126| ctr[3] = mlk_rej_uniform(vec3->coeffs, MLKEM_N, ctr[3], buf[3], buflen); ------------------ | | 22| 126|#define MLKEM_N 256 ------------------ 208| 126| } 209| | 210| 336| mlk_xof_x4_release(&statex); ------------------ | | 66| 336|#define mlk_xof_x4_release(CTX) mlk_shake128x4_release((CTX)) | | ------------------ | | | | 17| 336|#define mlk_shake128x4_release shake128x4_release | | | | ------------------ | | | | | | 53| 336|#define shake128x4_release shake128x4_inc_ctx_release | | | | | | ------------------ | | | | | | | | 23| 336|#define shake128x4_inc_ctx_release OQS_SHA3_shake128_x4_inc_ctx_release | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 211| | 212| | /* Specification: Partially implements 213| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 214| 336| mlk_zeroize(buf, sizeof(buf)); 215| 336|} PQCP_MLKEM_NATIVE_MLKEM1024_X86_64_poly_cbd2: 276| 728|{ 277| 728| unsigned i; 278| 24.0k| for (i = 0; i < MLKEM_N / 8; i++) ------------------ | | 22| 24.0k|#define MLKEM_N 256 ------------------ | Branch (278:15): [True: 23.2k, False: 728] ------------------ 279| 23.2k| __loop__( 280| 23.2k| invariant(i <= MLKEM_N / 8) 281| 23.2k| invariant(array_abs_bound(r->coeffs, 0, 8 * i, 3)) 282| 23.2k| decreases(MLKEM_N / 8 - i)) 283| 23.2k| { 284| 23.2k| unsigned j; 285| 23.2k| uint32_t t = mlk_load32_littleendian(buf + 4 * i); 286| 23.2k| uint32_t d = t & 0x55555555; 287| 23.2k| d += (t >> 1) & 0x55555555; 288| | 289| 209k| for (j = 0; j < 8; j++) ------------------ | Branch (289:17): [True: 186k, False: 23.2k] ------------------ 290| 186k| __loop__( 291| 186k| invariant(i <= MLKEM_N / 8 && j <= 8) 292| 186k| invariant(array_abs_bound(r->coeffs, 0, 8 * i + j, 3)) 293| 186k| decreases(8 - j)) 294| 186k| { 295| | /* Safety: The & 0x3 masks each value to 2 bits (range [0, 3]), so the 296| | * truncation and subsequent subtraction in int16_t is lossless. */ 297| 186k| const int16_t a = (int16_t)((d >> (4 * j + 0)) & 0x3); 298| 186k| const int16_t b = (int16_t)((d >> (4 * j + 2)) & 0x3); 299| 186k| r->coeffs[8 * i + j] = (int16_t)(a - b); 300| 186k| } 301| 23.2k| } 302| 728|} kem.c:mlk_randombytes: 178| 172|{ 179| 172| OQS_randombytes(ptr, len); 180| 172| return 0; 181| 172|} compress.c:mlk_scalar_compress_d1: 55| 22.0k|{ 56| | /* Compute as follows: 57| | * ``` 58| | * round(u * 2 / MLKEM_Q) 59| | * = round(u * 2 * (2^31 / MLKEM_Q) / 2^31) 60| | * ~= round(u * 2 * round(2^31 / MLKEM_Q) / 2^31) 61| | * ``` 62| | */ 63| | /* check-magic: 1290168 == 2*round(2^31 / MLKEM_Q) */ 64| 22.0k| uint32_t d0 = (uint32_t)u * 1290168; 65| | /* Unsigned shifting by 31 positions leaves only the top bit. */ 66| 22.0k| return (uint8_t)((d0 + ((uint32_t)1u << 30)) >> 31); 67| 22.0k|} indcpa.c:mlk_polymat_permute_bitrev_to_custom: 199| 258|{ 200| 258| unsigned i; 201| 1.03k| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 1.03k|#define MLKEM_K 2 ------------------ | Branch (201:15): [True: 774, False: 258] ------------------ 202| 774| __loop__( 203| 774| assigns(i, memory_slice(a, sizeof(mlk_polymat))) 204| 774| invariant(i <= MLKEM_K) 205| 774| invariant(forall(x, 0, MLKEM_K, forall(y, 0, MLKEM_K, 206| 774| array_bound(a->vec[x].vec[y].coeffs, 0, MLKEM_N, 0, MLKEM_Q)))) 207| 774| decreases(MLKEM_K - i)) 208| 774| { 209| 774| mlk_polyvec_permute_bitrev_to_custom(&a->vec[i]); ------------------ | | 40| 774| MLK_ADD_PARAM_SET(mlk_polyvec_permute_bitrev_to_custom) | | ------------------ | | | | 48| 774|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 210| 774| } 211| 258|} indcpa.c:mlk_keypair_getnoise_eta1: 359| 86|{ 360| 86|#if MLKEM_K == 2 361| 86| mlk_poly_getnoise_eta1_4x(&pv->vec[0], &pv->vec[1], /* Fill elements of pv */ ------------------ | | 467| 86|#define mlk_poly_getnoise_eta1_4x MLK_NAMESPACE_K(poly_getnoise_eta1_4x) | | ------------------ | | | | 64| 86|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 86|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 86|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 362| 86| &e->vec[0], &e->vec[1], /* and two elements of e */ 363| 86| seed, 0, 1, 2, 3); 364| |#elif MLKEM_K == 3 365| | /* 366| | * Only the first three output buffers are needed, so we pass NULL as 367| | * the fourth parameter, and 0xFF as its dummy nonce. 368| | */ 369| | mlk_poly_getnoise_eta1_4x(&pv->vec[0], &pv->vec[1], &pv->vec[2], NULL, seed, 370| | 0, 1, 2, 0xFF); 371| | /* Same here */ 372| | mlk_poly_getnoise_eta1_4x(&e->vec[0], &e->vec[1], &e->vec[2], NULL, seed, 3, 373| | 4, 5, 0xFF); 374| |#elif MLKEM_K == 4 375| | mlk_poly_getnoise_eta1_4x(&pv->vec[0], &pv->vec[1], &pv->vec[2], &pv->vec[3], 376| | seed, 0, 1, 2, 3); 377| | mlk_poly_getnoise_eta1_4x(&e->vec[0], &e->vec[1], &e->vec[2], &e->vec[3], 378| | seed, 4, 5, 6, 7); 379| |#endif /* MLKEM_K == 4 */ 380| 86|} indcpa.c:mlk_matvec_mul: 325| 258|{ 326| 258| unsigned i; 327| 1.03k| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 1.03k|#define MLKEM_K 2 ------------------ | Branch (327:15): [True: 774, False: 258] ------------------ 328| 774| __loop__( 329| 774| assigns(i, memory_slice(out, sizeof(mlk_polyvec))) 330| 774| invariant(i <= MLKEM_K) 331| 774| decreases(MLKEM_K - i)) 332| 774| { 333| 774| mlk_polyvec_basemul_acc_montgomery_cached(&out->vec[i], &a->vec[i], v, vc); ------------------ | | 321| 774| MLK_NAMESPACE_K(polyvec_basemul_acc_montgomery_cached) | | ------------------ | | | | 64| 774|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 774|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 774|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 334| 774| } 335| 258|} indcpa.c:mlk_pack_sk: 100| 86|{ 101| 86| mlk_assert_bound_2d(sk->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 86| do \ | | 111| 86| { \ | | 112| 86| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 86] | | ------------------ ------------------ 102| 86| mlk_polyvec_tobytes(r, sk); ------------------ | | 225| 86|#define mlk_polyvec_tobytes MLK_NAMESPACE_K(polyvec_tobytes) | | ------------------ | | | | 64| 86|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 86|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 86|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 103| 86|} indcpa.c:mlk_pack_pk: 61| 86|{ 62| 86| mlk_assert_bound_2d(pk->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 86| do \ | | 111| 86| { \ | | 112| 86| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 86] | | ------------------ ------------------ 63| 86| mlk_polyvec_tobytes(r, pk); ------------------ | | 225| 86|#define mlk_polyvec_tobytes MLK_NAMESPACE_K(polyvec_tobytes) | | ------------------ | | | | 64| 86|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 86|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 86|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 64| 86| mlk_memcpy(r + MLKEM_POLYVECBYTES, seed, MLKEM_SYMBYTES); ------------------ | | 168| 86|#define mlk_memcpy memcpy ------------------ mlk_memcpy(r + MLKEM_POLYVECBYTES, seed, MLKEM_SYMBYTES); ------------------ | | 31| 86|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | ------------------ | | | | 13| 86|#define MLKEM_K 2 | | ------------------ | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | ------------------ | | | | 30| 86|#define MLKEM_POLYBYTES 384 | | ------------------ ------------------ mlk_memcpy(r + MLKEM_POLYVECBYTES, seed, MLKEM_SYMBYTES); ------------------ | | 27| 86|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 65| 86|} indcpa.c:mlk_unpack_pk: 80| 172|{ 81| 172| mlk_polyvec_frombytes(pk, packedpk); ------------------ | | 247| 172|#define mlk_polyvec_frombytes MLK_NAMESPACE_K(polyvec_frombytes) | | ------------------ | | | | 64| 172|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 172|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 172|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 82| 172| mlk_memcpy(seed, packedpk + MLKEM_POLYVECBYTES, MLKEM_SYMBYTES); ------------------ | | 168| 172|#define mlk_memcpy memcpy ------------------ mlk_memcpy(seed, packedpk + MLKEM_POLYVECBYTES, MLKEM_SYMBYTES); ------------------ | | 31| 172|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | ------------------ | | | | 13| 172|#define MLKEM_K 2 | | ------------------ | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | ------------------ | | | | 30| 172|#define MLKEM_POLYBYTES 384 | | ------------------ ------------------ mlk_memcpy(seed, packedpk + MLKEM_POLYVECBYTES, MLKEM_SYMBYTES); ------------------ | | 27| 172|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 83| | 84| | /* NOTE: If a modulus check was conducted on the PK, we know at this 85| | * point that the coefficients of `pk` are unsigned canonical. The 86| | * specifications and proofs, however, do _not_ assume this, and instead 87| | * work with the easily provable bound by MLKEM_UINT12_LIMIT. */ 88| 172|} indcpa.c:mlk_enc_getnoise_eta1_eta2: 409| 172|{ 410| 172|#if MLKEM_K == 2 411| 172| mlk_poly_getnoise_eta1122_4x(&sp->vec[0], &sp->vec[1], &ep->vec[0], ------------------ | | 547| 172|#define mlk_poly_getnoise_eta1122_4x MLK_NAMESPACE_K(poly_getnoise_eta1122_4x) | | ------------------ | | | | 64| 172|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 172|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 172|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 412| 172| &ep->vec[1], coins, 0, 1, 2, 3); 413| 172| mlk_poly_getnoise_eta2(epp, coins, 4); ------------------ | | 520| 172|#define mlk_poly_getnoise_eta2 MLK_NAMESPACE_K(poly_getnoise_eta2) | | ------------------ | | | | 64| 172|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 172|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 172|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 414| |#elif MLKEM_K == 3 415| | /* 416| | * In this call, only the first three output buffers are needed, 417| | * so we pass NULL as the fourth parameter, and 0xFF as its dummy nonce. 418| | */ 419| | mlk_poly_getnoise_eta1_4x(&sp->vec[0], &sp->vec[1], &sp->vec[2], NULL, coins, 420| | 0, 1, 2, 0xFF /* irrelevant */); 421| | /* The fourth output buffer in this call _is_ used. */ 422| | mlk_poly_getnoise_eta2_4x(&ep->vec[0], &ep->vec[1], &ep->vec[2], epp, coins, 423| | 3, 4, 5, 6); 424| |#elif MLKEM_K == 4 425| | mlk_poly_getnoise_eta1_4x(&sp->vec[0], &sp->vec[1], &sp->vec[2], &sp->vec[3], 426| | coins, 0, 1, 2, 3); 427| | mlk_poly_getnoise_eta2_4x(&ep->vec[0], &ep->vec[1], &ep->vec[2], &ep->vec[3], 428| | coins, 4, 5, 6, 7); 429| | mlk_poly_getnoise_eta2(epp, coins, 8); 430| |#endif /* MLKEM_K == 4 */ 431| 172|} indcpa.c:mlk_pack_ciphertext: 132| 172|{ 133| 172| mlk_polyvec_compress_du(r, b); ------------------ | | 176| 172|#define mlk_polyvec_compress_du MLK_NAMESPACE_K(polyvec_compress_du) | | ------------------ | | | | 64| 172|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 172|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 172|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 134| 172| mlk_poly_compress_dv(r + MLKEM_POLYVECCOMPRESSEDBYTES_DU, v); ------------------ | | 112| 172|#define mlk_poly_compress_dv MLK_NAMESPACE_K(poly_compress_dv) | | ------------------ | | | | 64| 172|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 172|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 172|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_compress_dv(r + MLKEM_POLYVECCOMPRESSEDBYTES_DU, v); ------------------ | | 44| 172|#define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | ------------------ | | | | 13| 172|#define MLKEM_K 2 | | ------------------ | | #define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | ------------------ | | | | 43| 172|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D10 | | | | ------------------ | | | | | | 35| 172|#define MLKEM_POLYCOMPRESSEDBYTES_D10 320 | | | | ------------------ | | ------------------ ------------------ 135| 172|} indcpa.c:mlk_unpack_ciphertext: 149| 86|{ 150| 86| mlk_polyvec_decompress_du(b, c); ------------------ | | 200| 86|#define mlk_polyvec_decompress_du MLK_NAMESPACE_K(polyvec_decompress_du) | | ------------------ | | | | 64| 86|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 86|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 86|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 151| 86| mlk_poly_decompress_dv(v, c + MLKEM_POLYVECCOMPRESSEDBYTES_DU); ------------------ | | 143| 86|#define mlk_poly_decompress_dv MLK_NAMESPACE_K(poly_decompress_dv) | | ------------------ | | | | 64| 86|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 86|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 86|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_decompress_dv(v, c + MLKEM_POLYVECCOMPRESSEDBYTES_DU); ------------------ | | 44| 86|#define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | ------------------ | | | | 13| 86|#define MLKEM_K 2 | | ------------------ | | #define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | ------------------ | | | | 43| 86|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D10 | | | | ------------------ | | | | | | 35| 86|#define MLKEM_POLYCOMPRESSEDBYTES_D10 320 | | | | ------------------ | | ------------------ ------------------ 152| 86|} indcpa.c:mlk_unpack_sk: 115| 86|{ 116| 86| mlk_polyvec_frombytes(sk, packedsk); ------------------ | | 247| 86|#define mlk_polyvec_frombytes MLK_NAMESPACE_K(polyvec_frombytes) | | ------------------ | | | | 64| 86|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 86|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 86|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 117| 86|} kem.c:mlk_check_pct: 194| 86|{ 195| | /* Skip PCT */ 196| 86| ((void)pk); 197| 86| ((void)sk); 198| |#if defined(MLK_CONFIG_CONTEXT_PARAMETER) 199| | ((void)context); 200| |#endif 201| 86| return 0; 202| 86|} poly_k.c:mlk_poly_cbd_eta1: 318| 1.49k|{ 319| |#if MLKEM_ETA1 == 2 320| | mlk_poly_cbd2(r, buf); 321| |#elif MLKEM_ETA1 == 3 322| 1.49k| mlk_poly_cbd3(r, buf); ------------------ | | 37| 1.49k|#define mlk_poly_cbd3 MLK_NAMESPACE(poly_cbd3) | | ------------------ | | | | 63| 1.49k|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 1.49k|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 1.49k|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 323| |#else 324| |#error "Invalid value of MLKEM_ETA1" 325| |#endif 326| 1.49k|} poly_k.c:mlk_poly_cbd_eta2: 404| 224|{ 405| 224|#if MLKEM_ETA2 == 2 406| 224| mlk_poly_cbd2(r, buf); ------------------ | | 22| 224|#define mlk_poly_cbd2 MLK_NAMESPACE(poly_cbd2) | | ------------------ | | | | 63| 224|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 224|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 224|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 407| |#else 408| |#error "Invalid value of MLKEM_ETA2" 409| |#endif 410| 224|} sampling.c:mlk_rej_uniform_c: 45| 1.20k|{ 46| 1.20k| unsigned ctr, pos; 47| 1.20k| int16_t val0, val1; 48| | 49| 1.20k| mlk_assert_bound(r, offset, 0, MLKEM_Q); ------------------ | | 101| 1.20k| do \ | | 102| 1.20k| { \ | | 103| 1.20k| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 1.20k] | | ------------------ ------------------ 50| | 51| 1.20k| ctr = offset; 52| 1.20k| pos = 0; 53| | /* pos + 3 cannot overflow due to the assumption buflen <= 4096 */ 54| 2.63k| while (ctr < target && pos + 3 <= buflen) ------------------ | Branch (54:10): [True: 1.42k, False: 1.20k] | Branch (54:26): [True: 1.42k, False: 0] ------------------ 55| 1.42k| __loop__( 56| 1.42k| invariant(offset <= ctr && ctr <= target && pos <= buflen) 57| 1.42k| invariant(array_bound(r, 0, ctr, 0, MLKEM_Q)) 58| 1.42k| decreases(buflen - pos)) 59| 1.42k| { 60| | /* Safety: 61| | * - The explicit cast to uint16_t ensures that << 8 does 62| | * not signed-overflow even on a 16-bit system. 63| | * - The conversion to int16_t is safe due to the explicit 0xFFF 64| | * truncation. 65| | */ 66| 1.42k| val0 = (int16_t)(((buf[pos + 0] >> 0) | ((uint16_t)buf[pos + 1] << 8)) & 67| 1.42k| 0xFFF); 68| 1.42k| val1 = (int16_t)(((buf[pos + 1] >> 4) | (buf[pos + 2] << 4)) & 0xFFF); 69| 1.42k| pos += 3; 70| | 71| 1.42k| if (val0 < MLKEM_Q) ------------------ | | 23| 1.42k|#define MLKEM_Q 3329 ------------------ | Branch (71:9): [True: 1.11k, False: 312] ------------------ 72| 1.11k| { 73| 1.11k| r[ctr++] = val0; 74| 1.11k| } 75| 1.42k| if (ctr < target && val1 < MLKEM_Q) ------------------ | | 23| 1.23k|#define MLKEM_Q 3329 ------------------ | Branch (75:9): [True: 1.23k, False: 192] | Branch (75:25): [True: 969, False: 267] ------------------ 76| 969| { 77| 969| r[ctr++] = val1; 78| 969| } 79| 1.42k| } 80| | 81| 1.20k| mlk_assert_bound(r, ctr, 0, MLKEM_Q); ------------------ | | 101| 1.20k| do \ | | 102| 1.20k| { \ | | 103| 1.20k| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 1.20k] | | ------------------ ------------------ 82| 1.20k| return ctr; 83| 1.20k|} sampling.c:mlk_load32_littleendian: 264| 47.8k|{ 265| 47.8k| uint32_t r; 266| 47.8k| r = (uint32_t)x[0]; 267| 47.8k| r |= (uint32_t)x[1] << 8; 268| 47.8k| r |= (uint32_t)x[2] << 16; 269| 47.8k| r |= (uint32_t)x[3] << 24; 270| 47.8k| return r; 271| 47.8k|} sampling.c:mlk_load24_littleendian: 318| 14.3k|{ 319| 14.3k| uint32_t r; 320| 14.3k| r = (uint32_t)x[0]; 321| 14.3k| r |= (uint32_t)x[1] << 8; 322| 14.3k| r |= (uint32_t)x[2] << 16; 323| 14.3k| return r; 324| 14.3k|} kem.c:mlk_ct_memcmp: 346| 258|{ 347| 258| uint8_t r = 0, s = 0; 348| 258| unsigned i; 349| | 350| 200k| for (i = 0; i < len; i++) ------------------ | Branch (350:15): [True: 199k, False: 258] ------------------ 351| 199k| __loop__( 352| 199k| invariant(i <= len) 353| 199k| invariant((r == 0) == (forall(k, 0, i, (a[k] == b[k])))) 354| 199k| decreases(len - i)) 355| 199k| { 356| 199k| r |= a[i] ^ b[i]; 357| | /* s is useless, but prevents the loop from being aborted once r=0xff. */ 358| 199k| s ^= a[i] ^ b[i]; 359| 199k| } 360| | 361| | /* 362| | * - Convert r into a mask; this may not be necessary, but is an additional 363| | * safeguard 364| | * towards leaking information about a and b. 365| | * - XOR twice with s, separated by a value barrier, to prevent the compile 366| | * from dropping the s computation in the loop. 367| | */ 368| 258| return (mlk_value_barrier_u8(mlk_ct_cmask_nonzero_u8(r) ^ s) ^ s); 369| 258|} kem.c:mlk_value_barrier_u8: 129| 258|{ 130| 258| __asm__ volatile("" : "+r"(b)); 131| 258| return b; 132| 258|} kem.c:mlk_ct_cmask_nonzero_u8: 257| 3.01k|{ 258| 3.01k| uint16_t mask = mlk_ct_cmask_nonzero_u16((uint16_t)x); 259| 3.01k| return (uint8_t)(mask & 0xFF); 260| 3.01k|} kem.c:mlk_ct_cmask_nonzero_u16: 231| 3.01k|{ 232| 3.01k| int32_t tmp = mlk_value_barrier_i32(-((int32_t)x)); 233| | /* 234| | * PORTABILITY: Right-shift on a signed integer is 235| | * implementation-defined for negative left argument. 236| | * Here, we assume it's sign-preserving "arithmetic" shift right. 237| | * See (C99 6.5.7 (5)) 238| | */ 239| 3.01k| tmp >>= 16; 240| 3.01k| return mlk_cast_int32_to_uint16(tmp); 241| 3.01k|} kem.c:mlk_value_barrier_i32: 122| 3.01k|{ 123| 3.01k| __asm__ volatile("" : "+r"(b)); 124| 3.01k| return b; 125| 3.01k|} kem.c:mlk_cast_int32_to_uint16: 173| 3.01k|{ 174| | return (uint16_t)(x & (int32_t)UINT16_MAX); 175| 3.01k|} kem.c:mlk_zeroize: 432| 860|{ 433| 860| mlk_memset(ptr, 0, len); ------------------ | | 173| 860|#define mlk_memset memset ------------------ 434| | /* This follows OpenSSL and seems sufficient to prevent the compiler 435| | * from optimizing away the memset. 436| | * 437| | * If there was a reliable way to detect availability of memset_s(), 438| | * that would be preferred. */ 439| 860| __asm__ volatile("" : : "r"(ptr) : "memory"); 440| 860|} kem.c:mlk_ct_cmov_zero: 396| 86|{ 397| 86| size_t i; 398| 2.83k| for (i = 0; i < len; i++) ------------------ | Branch (398:15): [True: 2.75k, False: 86] ------------------ 399| 2.75k| __loop__( 400| 2.75k| invariant(i <= len) 401| 2.75k| invariant(forall(k, 0, i, r[k] == (b == 0 ? x[k] : loop_entry(r)[k]))) 402| 2.75k| decreases(len - i)) 403| 2.75k| { 404| 2.75k| r[i] = mlk_ct_sel_uint8(r[i], x[i], b); 405| 2.75k| } 406| 86|} kem.c:mlk_ct_sel_uint8: 313| 2.75k|{ 314| 2.75k| return b ^ (mlk_ct_cmask_nonzero_u8(cond) & (a ^ b)); 315| 2.75k|} poly_k.c:mlk_zeroize: 432| 1.08k|{ 433| 1.08k| mlk_memset(ptr, 0, len); ------------------ | | 173| 1.08k|#define mlk_memset memset ------------------ 434| | /* This follows OpenSSL and seems sufficient to prevent the compiler 435| | * from optimizing away the memset. 436| | * 437| | * If there was a reliable way to detect availability of memset_s(), 438| | * that would be preferred. */ 439| 1.08k| __asm__ volatile("" : : "r"(ptr) : "memory"); 440| 1.08k|} sampling.c:mlk_zeroize: 432| 690|{ 433| 690| mlk_memset(ptr, 0, len); ------------------ | | 173| 690|#define mlk_memset memset ------------------ 434| | /* This follows OpenSSL and seems sufficient to prevent the compiler 435| | * from optimizing away the memset. 436| | * 437| | * If there was a reliable way to detect availability of memset_s(), 438| | * that would be preferred. */ 439| 690| __asm__ volatile("" : : "r"(ptr) : "memory"); 440| 690|} compress.c:mlk_value_barrier_u8: 129| 44.0k|{ 130| 44.0k| __asm__ volatile("" : "+r"(b)); 131| 44.0k| return b; 132| 44.0k|} compress.c:mlk_ct_sel_int16: 291| 44.0k|{ 292| 44.0k| uint16_t au = mlk_cast_int16_to_uint16(a); 293| 44.0k| uint16_t bu = mlk_cast_int16_to_uint16(b); 294| 44.0k| uint16_t res = bu ^ (mlk_ct_cmask_nonzero_u16(cond) & (au ^ bu)); 295| 44.0k| return mlk_cast_uint16_to_int16(res); 296| 44.0k|} compress.c:mlk_cast_int16_to_uint16: 185| 88.0k|{ 186| 88.0k| return mlk_cast_int32_to_uint16(x); 187| 88.0k|} compress.c:mlk_cast_int32_to_uint16: 173| 132k|{ 174| | return (uint16_t)(x & (int32_t)UINT16_MAX); 175| 132k|} compress.c:mlk_ct_cmask_nonzero_u16: 231| 44.0k|{ 232| 44.0k| int32_t tmp = mlk_value_barrier_i32(-((int32_t)x)); 233| | /* 234| | * PORTABILITY: Right-shift on a signed integer is 235| | * implementation-defined for negative left argument. 236| | * Here, we assume it's sign-preserving "arithmetic" shift right. 237| | * See (C99 6.5.7 (5)) 238| | */ 239| 44.0k| tmp >>= 16; 240| 44.0k| return mlk_cast_int32_to_uint16(tmp); 241| 44.0k|} compress.c:mlk_value_barrier_i32: 122| 44.0k|{ 123| 44.0k| __asm__ volatile("" : "+r"(b)); 124| 44.0k| return b; 125| 44.0k|} compress.c:mlk_cast_uint16_to_int16: 151| 44.0k|{ 152| | /* 153| | * PORTABILITY: This relies on uint16_t -> int16_t 154| | * being implemented as the inverse of int16_t -> uint16_t, 155| | * which is implementation-defined (C99 6.3.1.3 (3)) 156| | * CBMC (correctly) fails to prove this conversion is OK, 157| | * so we have to suppress that check here 158| | */ 159| 44.0k| return (int16_t)x; 160| 44.0k|} indcpa.c:mlk_zeroize: 432| 3.01k|{ 433| 3.01k| mlk_memset(ptr, 0, len); ------------------ | | 173| 3.01k|#define mlk_memset memset ------------------ 434| | /* This follows OpenSSL and seems sufficient to prevent the compiler 435| | * from optimizing away the memset. 436| | * 437| | * If there was a reliable way to detect availability of memset_s(), 438| | * that would be preferred. */ 439| 3.01k| __asm__ volatile("" : : "r"(ptr) : "memory"); 440| 3.01k|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_compress_d4: 80| 56|{ 81| 56|#if defined(MLK_USE_NATIVE_POLY_COMPRESS_D4) 82| 56| int ret; 83| 56| mlk_assert_bound(a, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 56| do \ | | 102| 56| { \ | | 103| 56| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 56] | | ------------------ ------------------ 84| 56| ret = mlk_poly_compress_d4_native(r, a->coeffs); 85| 56| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 56|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (85:7): [True: 56, False: 0] ------------------ 86| 56| { 87| 56| return; 88| 56| } 89| 0|#endif /* MLK_USE_NATIVE_POLY_COMPRESS_D4 */ 90| | 91| 0| mlk_poly_compress_d4_c(r, a); 92| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_compress_d10: 147| 112|{ 148| 112|#if defined(MLK_USE_NATIVE_POLY_COMPRESS_D10) 149| 112| int ret; 150| 112| mlk_assert_bound(a, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 112| do \ | | 102| 112| { \ | | 103| 112| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 112] | | ------------------ ------------------ 151| 112| ret = mlk_poly_compress_d10_native(r, a->coeffs); 152| 112| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 112|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (152:7): [True: 112, False: 0] ------------------ 153| 112| { 154| 112| return; 155| 112| } 156| 0|#endif /* MLK_USE_NATIVE_POLY_COMPRESS_D10 */ 157| | 158| 0| mlk_poly_compress_d10_c(r, a); 159| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_decompress_d4: 195| 28|{ 196| 28|#if defined(MLK_USE_NATIVE_POLY_DECOMPRESS_D4) 197| 28| int ret; 198| 28| ret = mlk_poly_decompress_d4_native(r->coeffs, a); 199| 28| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 28|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (199:7): [True: 28, False: 0] ------------------ 200| 28| { 201| 28| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 28| do \ | | 102| 28| { \ | | 103| 28| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 28] | | ------------------ ------------------ 202| 28| return; 203| 28| } 204| 0|#endif /* MLK_USE_NATIVE_POLY_DECOMPRESS_D4 */ 205| | 206| 0| mlk_poly_decompress_d4_c(r, a); 207| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_decompress_d10: 258| 56|{ 259| 56|#if defined(MLK_USE_NATIVE_POLY_DECOMPRESS_D10) 260| 56| int ret; 261| 56| ret = mlk_poly_decompress_d10_native(r->coeffs, a); 262| 56| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 56|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (262:7): [True: 56, False: 0] ------------------ 263| 56| { 264| 56| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 56| do \ | | 102| 56| { \ | | 103| 56| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 56] | | ------------------ ------------------ 265| 56| return; 266| 56| } 267| 0|#endif /* MLK_USE_NATIVE_POLY_DECOMPRESS_D10 */ 268| | 269| 0| mlk_poly_decompress_d10_c(r, a); 270| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_tobytes: 610| 168|{ 611| 168|#if defined(MLK_USE_NATIVE_POLY_TOBYTES) 612| 168| int ret; 613| 168| mlk_assert_bound(a, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 168| do \ | | 102| 168| { \ | | 103| 168| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 168] | | ------------------ ------------------ 614| 168| ret = mlk_poly_tobytes_native(r, a->coeffs); 615| 168| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 168|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (615:7): [True: 168, False: 0] ------------------ 616| 168| { 617| 168| return; 618| 168| } 619| 0|#endif /* MLK_USE_NATIVE_POLY_TOBYTES */ 620| | 621| 0| mlk_poly_tobytes_c(r, a); 622| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_frombytes: 659| 224|{ 660| 224|#if defined(MLK_USE_NATIVE_POLY_FROMBYTES) 661| 224| int ret; 662| 224| ret = mlk_poly_frombytes_native(r->coeffs, a); 663| 224| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 224|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (663:7): [True: 224, False: 0] ------------------ 664| 224| { 665| 224| return; 666| 224| } 667| 0|#endif /* MLK_USE_NATIVE_POLY_FROMBYTES */ 668| | 669| 0| mlk_poly_frombytes_c(r, a); 670| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_frommsg: 680| 56|{ 681| 56| unsigned i; 682| |#if (MLKEM_INDCPA_MSGBYTES != MLKEM_N / 8) 683| |#error "MLKEM_INDCPA_MSGBYTES must be equal to MLKEM_N/8 bytes!" 684| |#endif 685| | 686| 1.84k| for (i = 0; i < MLKEM_N / 8; i++) ------------------ | | 22| 1.84k|#define MLKEM_N 256 ------------------ | Branch (686:15): [True: 1.79k, False: 56] ------------------ 687| 1.79k| __loop__( 688| 1.79k| invariant(i <= MLKEM_N / 8) 689| 1.79k| invariant(array_bound(r->coeffs, 0, 8 * i, 0, MLKEM_Q)) 690| 1.79k| decreases(MLKEM_N / 8 - i)) 691| 1.79k| { 692| 1.79k| unsigned j; 693| 16.1k| for (j = 0; j < 8; j++) ------------------ | Branch (693:17): [True: 14.3k, False: 1.79k] ------------------ 694| 14.3k| __loop__( 695| 14.3k| invariant(i < MLKEM_N / 8 && j <= 8) 696| 14.3k| invariant(array_bound(r->coeffs, 0, 8 * i + j, 0, MLKEM_Q)) 697| 14.3k| decreases(8 - j)) 698| 14.3k| { 699| | /* mlk_ct_sel_int16(MLKEM_Q_HALF, 0, b) is `Decompress_1(b != 0)` 700| | * as per @[FIPS203, Eq (4.8)]. */ 701| | 702| | /* Prevent the compiler from recognizing this as a bit selection */ 703| 14.3k| uint8_t mask = mlk_value_barrier_u8((uint8_t)(1u << j)); 704| 14.3k| r->coeffs[8 * i + j] = mlk_ct_sel_int16(MLKEM_Q_HALF, 0, msg[i] & mask); ------------------ | | 24| 14.3k|#define MLKEM_Q_HALF ((MLKEM_Q + 1) / 2) /* 1665 */ | | ------------------ | | | | 23| 14.3k|#define MLKEM_Q 3329 | | ------------------ ------------------ 705| 14.3k| } 706| 1.79k| } 707| 56| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_Q); ------------------ | | 105| 56| do \ | | 106| 56| { \ | | 107| 56| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 56] | | ------------------ ------------------ 708| 56|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_tomsg: 718| 28|{ 719| 28| unsigned i; 720| 28| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 28| do \ | | 102| 28| { \ | | 103| 28| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 28] | | ------------------ ------------------ 721| | 722| 924| for (i = 0; i < MLKEM_N / 8; i++) ------------------ | | 22| 924|#define MLKEM_N 256 ------------------ | Branch (722:15): [True: 896, False: 28] ------------------ 723| 896| __loop__(invariant(i <= MLKEM_N / 8) 724| 896| decreases(MLKEM_N / 8 - i)) 725| 896| { 726| 896| unsigned j; 727| 896| msg[i] = 0; 728| 8.06k| for (j = 0; j < 8; j++) ------------------ | Branch (728:17): [True: 7.16k, False: 896] ------------------ 729| 7.16k| __loop__( 730| 7.16k| invariant(i <= MLKEM_N / 8 && j <= 8) 731| 7.16k| decreases(8 - j)) 732| 7.16k| { 733| 7.16k| uint32_t t = mlk_scalar_compress_d1(r->coeffs[8 * i + j]); 734| 7.16k| msg[i] |= (uint8_t)(t << j); 735| 7.16k| } 736| 896| } 737| 28|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_gen_matrix: 223| 84|{ 224| 84| unsigned i, j; 225| 84| MLK_ALIGN uint8_t seed_ext[4][MLK_ALIGN_UP(MLKEM_SYMBYTES + 2)]; ------------------ | | 190| 84|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 226| | 227| 420| for (j = 0; j < 4; j++) ------------------ | Branch (227:15): [True: 336, False: 84] ------------------ 228| 336| { 229| 336| mlk_memcpy(seed_ext[j], seed, MLKEM_SYMBYTES); ------------------ | | 168| 336|#define mlk_memcpy memcpy ------------------ mlk_memcpy(seed_ext[j], seed, MLKEM_SYMBYTES); ------------------ | | 27| 336|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 230| 336| } 231| | 232| 84|#if !defined(MLK_CONFIG_SERIAL_FIPS202_ONLY) 233| | /* Sample 4 matrix entries a time. */ 234| 168| for (i = 0; i < (MLKEM_K * MLKEM_K / 4) * 4; i += 4) ------------------ | | 13| 168|#define MLKEM_K 2 ------------------ for (i = 0; i < (MLKEM_K * MLKEM_K / 4) * 4; i += 4) ------------------ | | 13| 168|#define MLKEM_K 2 ------------------ | Branch (234:15): [True: 84, False: 84] ------------------ 235| 84| { 236| 420| for (j = 0; j < 4; j++) ------------------ | Branch (236:17): [True: 336, False: 84] ------------------ 237| 336| { 238| 336| uint8_t x, y; 239| | /* MLKEM_K <= 4, so the values fit in uint8_t. */ 240| 336| x = (uint8_t)((i + j) / MLKEM_K); ------------------ | | 13| 336|#define MLKEM_K 2 ------------------ 241| 336| y = (uint8_t)((i + j) % MLKEM_K); ------------------ | | 13| 336|#define MLKEM_K 2 ------------------ 242| 336| if (transposed) ------------------ | Branch (242:11): [True: 224, False: 112] ------------------ 243| 224| { 244| 224| seed_ext[j][MLKEM_SYMBYTES + 0] = x; ------------------ | | 27| 224|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 245| 224| seed_ext[j][MLKEM_SYMBYTES + 1] = y; ------------------ | | 27| 224|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 246| 224| } 247| 112| else 248| 112| { 249| 112| seed_ext[j][MLKEM_SYMBYTES + 0] = y; ------------------ | | 27| 112|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 250| 112| seed_ext[j][MLKEM_SYMBYTES + 1] = x; ------------------ | | 27| 112|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 251| 112| } 252| 336| } 253| | 254| 84| mlk_poly_rej_uniform_x4(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], ------------------ | | 55| 84|#define mlk_poly_rej_uniform_x4 MLK_NAMESPACE(poly_rej_uniform_x4) | | ------------------ | | | | 63| 84|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 84|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 84|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_rej_uniform_x4(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], ------------------ | | 13| 84|#define MLKEM_K 2 ------------------ mlk_poly_rej_uniform_x4(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], ------------------ | | 13| 84|#define MLKEM_K 2 ------------------ 255| 84| &a->vec[(i + 1) / MLKEM_K].vec[(i + 1) % MLKEM_K], ------------------ | | 13| 84|#define MLKEM_K 2 ------------------ &a->vec[(i + 1) / MLKEM_K].vec[(i + 1) % MLKEM_K], ------------------ | | 13| 84|#define MLKEM_K 2 ------------------ 256| 84| &a->vec[(i + 2) / MLKEM_K].vec[(i + 2) % MLKEM_K], ------------------ | | 13| 84|#define MLKEM_K 2 ------------------ &a->vec[(i + 2) / MLKEM_K].vec[(i + 2) % MLKEM_K], ------------------ | | 13| 84|#define MLKEM_K 2 ------------------ 257| 84| &a->vec[(i + 3) / MLKEM_K].vec[(i + 3) % MLKEM_K], ------------------ | | 13| 84|#define MLKEM_K 2 ------------------ &a->vec[(i + 3) / MLKEM_K].vec[(i + 3) % MLKEM_K], ------------------ | | 13| 84|#define MLKEM_K 2 ------------------ 258| 84| seed_ext); 259| 84| } 260| |#else /* !MLK_CONFIG_SERIAL_FIPS202_ONLY */ 261| | /* When using serial FIPS202, sample all entries individually. */ 262| | i = 0; 263| |#endif /* MLK_CONFIG_SERIAL_FIPS202_ONLY */ 264| | 265| | /* For MLKEM_K == 3, sample the last entry individually. 266| | * When MLK_CONFIG_SERIAL_FIPS202_ONLY is set, sample all entries 267| | * individually. */ 268| 84| for (; i < MLKEM_K * MLKEM_K; i++) ------------------ | | 13| 84|#define MLKEM_K 2 ------------------ for (; i < MLKEM_K * MLKEM_K; i++) ------------------ | | 13| 84|#define MLKEM_K 2 ------------------ | Branch (268:10): [True: 0, False: 84] ------------------ 269| 0| { 270| 0| uint8_t x, y; 271| | /* MLKEM_K <= 4, so the values fit in uint8_t. */ 272| 0| x = (uint8_t)(i / MLKEM_K); ------------------ | | 13| 0|#define MLKEM_K 2 ------------------ 273| 0| y = (uint8_t)(i % MLKEM_K); ------------------ | | 13| 0|#define MLKEM_K 2 ------------------ 274| | 275| 0| if (transposed) ------------------ | Branch (275:9): [True: 0, False: 0] ------------------ 276| 0| { 277| 0| seed_ext[0][MLKEM_SYMBYTES + 0] = x; ------------------ | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 278| 0| seed_ext[0][MLKEM_SYMBYTES + 1] = y; ------------------ | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 279| 0| } 280| 0| else 281| 0| { 282| 0| seed_ext[0][MLKEM_SYMBYTES + 0] = y; ------------------ | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 283| 0| seed_ext[0][MLKEM_SYMBYTES + 1] = x; ------------------ | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 284| 0| } 285| | 286| 0| mlk_poly_rej_uniform(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], seed_ext[0]); ------------------ | | 89| 0|#define mlk_poly_rej_uniform MLK_NAMESPACE(poly_rej_uniform) | | ------------------ | | | | 63| 0|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 0|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 0|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_rej_uniform(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], seed_ext[0]); ------------------ | | 13| 0|#define MLKEM_K 2 ------------------ mlk_poly_rej_uniform(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], seed_ext[0]); ------------------ | | 13| 0|#define MLKEM_K 2 ------------------ 287| 0| } 288| | 289| 84| mlk_assert(i == MLKEM_K * MLKEM_K); ------------------ | | 97| 84| do \ | | 98| 84| { \ | | 99| 84| } while (0) | | ------------------ | | | Branch (99:12): [Folded, False: 84] | | ------------------ ------------------ 290| | 291| | /* 292| | * The public matrix is generated in NTT domain. If the native backend 293| | * uses a custom order in NTT domain, permute A accordingly. 294| | */ 295| 84| mlk_polymat_permute_bitrev_to_custom(a); ------------------ | | 42| 84| MLK_ADD_PARAM_SET(mlk_polymat_permute_bitrev_to_custom) | | ------------------ | | | | 48| 84|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 296| | 297| | /* Specification: Partially implements 298| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 299| 84| mlk_zeroize(seed_ext, sizeof(seed_ext)); 300| 84|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_indcpa_keypair_derand: 445| 28|{ 446| 28| int ret = 0; 447| 28| const uint8_t *publicseed; 448| 28| const uint8_t *noiseseed; 449| 28| MLK_ALLOC(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 450| 28| MLK_ALLOC(coins_with_domain_separator, uint8_t, MLKEM_SYMBYTES + 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 451| 28| MLK_ALLOC(a, mlk_polymat, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 452| 28| MLK_ALLOC(e, mlk_polyvec, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 453| 28| MLK_ALLOC(pkpv, mlk_polyvec, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 454| 28| MLK_ALLOC(skpv, mlk_polyvec, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 455| 28| MLK_ALLOC(skpv_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 456| | 457| 28| if (buf == NULL || coins_with_domain_separator == NULL || a == NULL || ------------------ | Branch (457:7): [True: 0, False: 28] | Branch (457:22): [True: 0, False: 28] | Branch (457:61): [True: 0, False: 28] ------------------ 458| 28| e == NULL || pkpv == NULL || skpv == NULL || skpv_cache == NULL) ------------------ | Branch (458:7): [True: 0, False: 28] | Branch (458:20): [True: 0, False: 28] | Branch (458:36): [True: 0, False: 28] | Branch (458:52): [True: 0, False: 28] ------------------ 459| 0| { 460| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 461| 0| goto cleanup; 462| 0| } 463| | 464| 28| publicseed = buf; 465| 28| noiseseed = buf + MLKEM_SYMBYTES; ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 466| | 467| | /* Concatenate coins with MLKEM_K for domain separation of security levels */ 468| 28| mlk_memcpy(coins_with_domain_separator, coins, MLKEM_SYMBYTES); ------------------ | | 168| 28|#define mlk_memcpy memcpy ------------------ mlk_memcpy(coins_with_domain_separator, coins, MLKEM_SYMBYTES); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 469| 28| coins_with_domain_separator[MLKEM_SYMBYTES] = MLKEM_K; ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ coins_with_domain_separator[MLKEM_SYMBYTES] = MLKEM_K; ------------------ | | 13| 28|#define MLKEM_K 2 ------------------ 470| | 471| 28| mlk_hash_g(buf, coins_with_domain_separator, MLKEM_SYMBYTES + 1); ------------------ | | 32| 28|#define mlk_hash_g(OUT, IN, INBYTES) mlk_sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 20| 28|#define mlk_sha3_512 sha3_512 | | | | ------------------ | | | | | | 31| 28|#define sha3_512 OQS_SHA3_sha3_512 | | | | ------------------ | | ------------------ ------------------ 472| | 473| | /* 474| | * Declassify the public seed. 475| | * Required to use it in conditional-branches in rejection sampling. 476| | * This is needed because all output of randombytes is marked as secret 477| | * (=undefined) 478| | */ 479| 28| MLK_CT_TESTING_DECLASSIFY(publicseed, MLKEM_SYMBYTES); ------------------ | | 235| 28| do \ | | 236| 28| { \ | | 237| 28| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 28] | | ------------------ ------------------ 480| | 481| 28| mlk_gen_matrix(a, publicseed, 0 /* no transpose */); ------------------ | | 22| 28|#define mlk_gen_matrix MLK_NAMESPACE_K(gen_matrix) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 482| | 483| 28| mlk_keypair_getnoise_eta1(skpv, e, noiseseed); ------------------ | | 43| 28|#define mlk_keypair_getnoise_eta1 MLK_ADD_PARAM_SET(mlk_keypair_getnoise_eta1) | | ------------------ | | | | 48| 28|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 484| | 485| 28| mlk_polyvec_ntt(skpv); ------------------ | | 269| 28|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 486| 28| mlk_polyvec_ntt(e); ------------------ | | 269| 28|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 487| | 488| 28| mlk_polyvec_mulcache_compute(skpv_cache, skpv); ------------------ | | 353| 28|#define mlk_polyvec_mulcache_compute MLK_NAMESPACE_K(polyvec_mulcache_compute) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 489| 28| mlk_matvec_mul(pkpv, a, skpv, skpv_cache); ------------------ | | 38| 28|#define mlk_matvec_mul MLK_ADD_PARAM_SET(mlk_matvec_mul) | | ------------------ | | | | 48| 28|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 490| 28| mlk_polyvec_tomont(pkpv); ------------------ | | 445| 28|#define mlk_polyvec_tomont MLK_NAMESPACE_K(polyvec_tomont) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 491| | 492| 28| mlk_polyvec_add(pkpv, e); ------------------ | | 414| 28|#define mlk_polyvec_add MLK_NAMESPACE_K(polyvec_add) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 493| 28| mlk_polyvec_reduce(pkpv); ------------------ | | 387| 28|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 494| 28| mlk_polyvec_reduce(skpv); ------------------ | | 387| 28|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 495| | 496| 28| mlk_pack_sk(sk, skpv); ------------------ | | 34| 28|#define mlk_pack_sk MLK_ADD_PARAM_SET(mlk_pack_sk) | | ------------------ | | | | 48| 28|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 497| 28| mlk_pack_pk(pk, pkpv, publicseed); ------------------ | | 32| 28|#define mlk_pack_pk MLK_ADD_PARAM_SET(mlk_pack_pk) | | ------------------ | | | | 48| 28|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 498| | 499| 28|cleanup: 500| | /* Specification: Partially implements 501| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 502| 28| MLK_FREE(skpv_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 503| 28| MLK_FREE(skpv, mlk_polyvec, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 504| 28| MLK_FREE(pkpv, mlk_polyvec, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 505| 28| MLK_FREE(e, mlk_polyvec, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 506| 28| MLK_FREE(a, mlk_polymat, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 507| 28| MLK_FREE(coins_with_domain_separator, uint8_t, MLKEM_SYMBYTES + 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 508| | MLK_FREE(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 509| 28| return ret; 510| 28|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_indcpa_enc: 526| 56|{ 527| 56| int ret = 0; 528| 56| MLK_ALLOC(seed, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 229| 56| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 56| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 529| 56| MLK_ALLOC(at, mlk_polymat, 1, context); ------------------ | | 229| 56| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 56| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 530| 56| MLK_ALLOC(sp, mlk_polyvec, 1, context); ------------------ | | 229| 56| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 56| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 531| 56| MLK_ALLOC(pkpv, mlk_polyvec, 1, context); ------------------ | | 229| 56| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 56| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 532| 56| MLK_ALLOC(ep, mlk_polyvec, 1, context); ------------------ | | 229| 56| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 56| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 533| 56| MLK_ALLOC(b, mlk_polyvec, 1, context); ------------------ | | 229| 56| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 56| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 534| 56| MLK_ALLOC(v, mlk_poly, 1, context); ------------------ | | 229| 56| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 56| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 535| 56| MLK_ALLOC(k, mlk_poly, 1, context); ------------------ | | 229| 56| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 56| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 536| 56| MLK_ALLOC(epp, mlk_poly, 1, context); ------------------ | | 229| 56| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 56| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 537| 56| MLK_ALLOC(sp_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 229| 56| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 56| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 538| | 539| 56| if (seed == NULL || at == NULL || sp == NULL || pkpv == NULL || ep == NULL || ------------------ | Branch (539:7): [True: 0, False: 56] | Branch (539:23): [True: 0, False: 56] | Branch (539:37): [True: 0, False: 56] | Branch (539:51): [True: 0, False: 56] | Branch (539:67): [True: 0, False: 56] ------------------ 540| 56| b == NULL || v == NULL || k == NULL || epp == NULL || sp_cache == NULL) ------------------ | Branch (540:7): [True: 0, False: 56] | Branch (540:20): [True: 0, False: 56] | Branch (540:33): [True: 0, False: 56] | Branch (540:46): [True: 0, False: 56] | Branch (540:61): [True: 0, False: 56] ------------------ 541| 0| { 542| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 543| 0| goto cleanup; 544| 0| } 545| | 546| 56| mlk_unpack_pk(pkpv, seed, pk); ------------------ | | 33| 56|#define mlk_unpack_pk MLK_ADD_PARAM_SET(mlk_unpack_pk) | | ------------------ | | | | 48| 56|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 547| 56| mlk_poly_frommsg(k, m); ------------------ | | 555| 56|#define mlk_poly_frommsg MLK_NAMESPACE(poly_frommsg) | | ------------------ | | | | 63| 56|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 548| | 549| | /* 550| | * Declassify the public seed. 551| | * Required to use it in conditional-branches in rejection sampling. 552| | * This is needed because in re-encryption the publicseed originated from sk 553| | * which is marked undefined. 554| | */ 555| 56| MLK_CT_TESTING_DECLASSIFY(seed, MLKEM_SYMBYTES); ------------------ | | 235| 56| do \ | | 236| 56| { \ | | 237| 56| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 56] | | ------------------ ------------------ 556| | 557| 56| mlk_gen_matrix(at, seed, 1 /* transpose */); ------------------ | | 22| 56|#define mlk_gen_matrix MLK_NAMESPACE_K(gen_matrix) | | ------------------ | | | | 64| 56|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 558| | 559| 56| mlk_enc_getnoise_eta1_eta2(sp, ep, epp, coins); ------------------ | | 44| 56|#define mlk_enc_getnoise_eta1_eta2 MLK_ADD_PARAM_SET(mlk_enc_getnoise_eta1_eta2) | | ------------------ | | | | 48| 56|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 560| | 561| 56| mlk_polyvec_ntt(sp); ------------------ | | 269| 56|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 56|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 562| | 563| 56| mlk_polyvec_mulcache_compute(sp_cache, sp); ------------------ | | 353| 56|#define mlk_polyvec_mulcache_compute MLK_NAMESPACE_K(polyvec_mulcache_compute) | | ------------------ | | | | 64| 56|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 564| 56| mlk_matvec_mul(b, at, sp, sp_cache); ------------------ | | 38| 56|#define mlk_matvec_mul MLK_ADD_PARAM_SET(mlk_matvec_mul) | | ------------------ | | | | 48| 56|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 565| 56| mlk_polyvec_basemul_acc_montgomery_cached(v, pkpv, sp, sp_cache); ------------------ | | 321| 56| MLK_NAMESPACE_K(polyvec_basemul_acc_montgomery_cached) | | ------------------ | | | | 64| 56|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 566| | 567| 56| mlk_polyvec_invntt_tomont(b); ------------------ | | 295| 56|#define mlk_polyvec_invntt_tomont MLK_NAMESPACE_K(polyvec_invntt_tomont) | | ------------------ | | | | 64| 56|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 568| 56| mlk_poly_invntt_tomont(v); ------------------ | | 263| 56|#define mlk_poly_invntt_tomont MLK_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 63| 56|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 569| | 570| 56| mlk_polyvec_add(b, ep); ------------------ | | 414| 56|#define mlk_polyvec_add MLK_NAMESPACE_K(polyvec_add) | | ------------------ | | | | 64| 56|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 571| 56| mlk_poly_add(v, epp); ------------------ | | 181| 56|#define mlk_poly_add MLK_NAMESPACE(poly_add) | | ------------------ | | | | 63| 56|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 572| 56| mlk_poly_add(v, k); ------------------ | | 181| 56|#define mlk_poly_add MLK_NAMESPACE(poly_add) | | ------------------ | | | | 63| 56|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 573| | 574| 56| mlk_polyvec_reduce(b); ------------------ | | 387| 56|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 56|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 575| 56| mlk_poly_reduce(v); ------------------ | | 154| 56|#define mlk_poly_reduce MLK_NAMESPACE(poly_reduce) | | ------------------ | | | | 63| 56|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 576| | 577| 56| mlk_pack_ciphertext(c, b, v); ------------------ | | 36| 56|#define mlk_pack_ciphertext MLK_ADD_PARAM_SET(mlk_pack_ciphertext) | | ------------------ | | | | 48| 56|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 578| | 579| 56|cleanup: 580| | /* Specification: Partially implements 581| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 582| 56| MLK_FREE(sp_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 238| 56| do \ | | 239| 56| { \ | | 240| 56| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 56| (v) = NULL; \ | | 242| 56| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 56] | | ------------------ ------------------ 583| 56| MLK_FREE(epp, mlk_poly, 1, context); ------------------ | | 238| 56| do \ | | 239| 56| { \ | | 240| 56| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 56| (v) = NULL; \ | | 242| 56| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 56] | | ------------------ ------------------ 584| 56| MLK_FREE(k, mlk_poly, 1, context); ------------------ | | 238| 56| do \ | | 239| 56| { \ | | 240| 56| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 56| (v) = NULL; \ | | 242| 56| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 56] | | ------------------ ------------------ 585| 56| MLK_FREE(v, mlk_poly, 1, context); ------------------ | | 238| 56| do \ | | 239| 56| { \ | | 240| 56| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 56| (v) = NULL; \ | | 242| 56| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 56] | | ------------------ ------------------ 586| 56| MLK_FREE(b, mlk_polyvec, 1, context); ------------------ | | 238| 56| do \ | | 239| 56| { \ | | 240| 56| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 56| (v) = NULL; \ | | 242| 56| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 56] | | ------------------ ------------------ 587| 56| MLK_FREE(ep, mlk_polyvec, 1, context); ------------------ | | 238| 56| do \ | | 239| 56| { \ | | 240| 56| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 56| (v) = NULL; \ | | 242| 56| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 56] | | ------------------ ------------------ 588| 56| MLK_FREE(pkpv, mlk_polyvec, 1, context); ------------------ | | 238| 56| do \ | | 239| 56| { \ | | 240| 56| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 56| (v) = NULL; \ | | 242| 56| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 56] | | ------------------ ------------------ 589| 56| MLK_FREE(sp, mlk_polyvec, 1, context); ------------------ | | 238| 56| do \ | | 239| 56| { \ | | 240| 56| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 56| (v) = NULL; \ | | 242| 56| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 56] | | ------------------ ------------------ 590| 56| MLK_FREE(at, mlk_polymat, 1, context); ------------------ | | 238| 56| do \ | | 239| 56| { \ | | 240| 56| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 56| (v) = NULL; \ | | 242| 56| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 56] | | ------------------ ------------------ 591| | MLK_FREE(seed, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 238| 56| do \ | | 239| 56| { \ | | 240| 56| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 56| (v) = NULL; \ | | 242| 56| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 56] | | ------------------ ------------------ 592| 56| return ret; 593| 56|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_indcpa_dec: 603| 28|{ 604| 28| int ret = 0; 605| 28| MLK_ALLOC(b, mlk_polyvec, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 606| 28| MLK_ALLOC(skpv, mlk_polyvec, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 607| 28| MLK_ALLOC(v, mlk_poly, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 608| 28| MLK_ALLOC(sb, mlk_poly, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 609| 28| MLK_ALLOC(b_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 610| | 611| 28| if (b == NULL || skpv == NULL || v == NULL || sb == NULL || b_cache == NULL) ------------------ | Branch (611:7): [True: 0, False: 28] | Branch (611:20): [True: 0, False: 28] | Branch (611:36): [True: 0, False: 28] | Branch (611:49): [True: 0, False: 28] | Branch (611:63): [True: 0, False: 28] ------------------ 612| 0| { 613| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 614| 0| goto cleanup; 615| 0| } 616| | 617| 28| mlk_unpack_ciphertext(b, v, c); ------------------ | | 37| 28|#define mlk_unpack_ciphertext MLK_ADD_PARAM_SET(mlk_unpack_ciphertext) | | ------------------ | | | | 48| 28|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 618| 28| mlk_unpack_sk(skpv, sk); ------------------ | | 35| 28|#define mlk_unpack_sk MLK_ADD_PARAM_SET(mlk_unpack_sk) | | ------------------ | | | | 48| 28|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 619| | 620| 28| mlk_polyvec_ntt(b); ------------------ | | 269| 28|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 621| 28| mlk_polyvec_mulcache_compute(b_cache, b); ------------------ | | 353| 28|#define mlk_polyvec_mulcache_compute MLK_NAMESPACE_K(polyvec_mulcache_compute) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 622| 28| mlk_polyvec_basemul_acc_montgomery_cached(sb, skpv, b, b_cache); ------------------ | | 321| 28| MLK_NAMESPACE_K(polyvec_basemul_acc_montgomery_cached) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 623| 28| mlk_poly_invntt_tomont(sb); ------------------ | | 263| 28|#define mlk_poly_invntt_tomont MLK_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 63| 28|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 624| | 625| 28| mlk_poly_sub(v, sb); ------------------ | | 210| 28|#define mlk_poly_sub MLK_NAMESPACE(poly_sub) | | ------------------ | | | | 63| 28|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 626| 28| mlk_poly_reduce(v); ------------------ | | 154| 28|#define mlk_poly_reduce MLK_NAMESPACE(poly_reduce) | | ------------------ | | | | 63| 28|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 627| | 628| 28| mlk_poly_tomsg(m, v); ------------------ | | 577| 28|#define mlk_poly_tomsg MLK_NAMESPACE(poly_tomsg) | | ------------------ | | | | 63| 28|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 629| | 630| 28|cleanup: 631| | /* Specification: Partially implements 632| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 633| 28| MLK_FREE(b_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 634| 28| MLK_FREE(sb, mlk_poly, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 635| 28| MLK_FREE(v, mlk_poly, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 636| 28| MLK_FREE(skpv, mlk_polyvec, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 637| | MLK_FREE(b, mlk_polyvec, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 638| 28| return ret; 639| 28|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_check_pk: 45| 28|{ 46| 28| int ret = 0; 47| 28| MLK_ALLOC(p, mlk_polyvec, 1, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 48| 28| MLK_ALLOC(p_reencoded, uint8_t, MLKEM_POLYVECBYTES, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 49| | 50| 28| if (p == NULL || p_reencoded == NULL) ------------------ | Branch (50:7): [True: 0, False: 28] | Branch (50:20): [True: 0, False: 28] ------------------ 51| 0| { 52| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 53| 0| goto cleanup; 54| 0| } 55| | 56| 28| mlk_polyvec_frombytes(p, pk); ------------------ | | 247| 28|#define mlk_polyvec_frombytes MLK_NAMESPACE_K(polyvec_frombytes) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 57| 28| mlk_polyvec_reduce(p); ------------------ | | 387| 28|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 58| 28| mlk_polyvec_tobytes(p_reencoded, p); ------------------ | | 225| 28|#define mlk_polyvec_tobytes MLK_NAMESPACE_K(polyvec_tobytes) | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 59| | 60| | /* We use a constant-time memcmp here to avoid having to 61| | * declassify the PK before the PCT has succeeded. */ 62| 28| ret = mlk_ct_memcmp(pk, p_reencoded, MLKEM_POLYVECBYTES) ? MLK_ERR_FAIL : 0; ------------------ | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | ------------------ | | | | 13| 28|#define MLKEM_K 2 | | ------------------ | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | ------------------ | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | ------------------ ------------------ ret = mlk_ct_memcmp(pk, p_reencoded, MLKEM_POLYVECBYTES) ? MLK_ERR_FAIL : 0; ------------------ | | 272| 0|#define MLK_ERR_FAIL (-1) ------------------ | Branch (62:9): [True: 0, False: 28] ------------------ 63| | 64| 28|cleanup: 65| | /* Specification: Partially implements 66| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 67| 28| MLK_FREE(p_reencoded, uint8_t, MLKEM_POLYVECBYTES, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 68| | MLK_FREE(p, mlk_polyvec, 1, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 69| 28| return ret; 70| 28|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_check_sk: 78| 28|{ 79| 28| int ret = 0; 80| 28| MLK_ALLOC(test, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 81| | 82| 28| if (test == NULL) ------------------ | Branch (82:7): [True: 0, False: 28] ------------------ 83| 0| { 84| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 85| 0| goto cleanup; 86| 0| } 87| | 88| | /* 89| | * The parts of `sk` being hashed and compared here are public, so 90| | * no public information is leaked through the runtime or the return value 91| | * of this function. 92| | */ 93| | 94| | /* Declassify the public part of the secret key */ 95| 28| MLK_CT_TESTING_DECLASSIFY(sk + MLKEM_INDCPA_SECRETKEYBYTES, ------------------ | | 235| 28| do \ | | 236| 28| { \ | | 237| 28| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 28] | | ------------------ ------------------ 96| 28| MLKEM_INDCCA_PUBLICKEYBYTES); 97| 28| MLK_CT_TESTING_DECLASSIFY( ------------------ | | 235| 28| do \ | | 236| 28| { \ | | 237| 28| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 28] | | ------------------ ------------------ 98| 28| sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, MLKEM_SYMBYTES); 99| | 100| 28| mlk_hash_h(test, sk + MLKEM_INDCPA_SECRETKEYBYTES, ------------------ | | 29| 28|#define mlk_hash_h(OUT, IN, INBYTES) mlk_sha3_256(OUT, IN, INBYTES) | | ------------------ | | | | 19| 28|#define mlk_sha3_256 sha3_256 | | | | ------------------ | | | | | | 15| 28|#define sha3_256 OQS_SHA3_sha3_256 | | | | ------------------ | | ------------------ ------------------ 101| 28| MLKEM_INDCCA_PUBLICKEYBYTES); 102| | /* This doesn't have to be a constant-time memcmp, but it's the only place 103| | * in the library where a normal memcmp would be used otherwise, so for sake 104| | * of minimizing stdlib dependency, we use our constant-time one anyway. */ 105| 28| ret = mlk_ct_memcmp(sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 72| 28| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 28|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 28|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 28|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 28|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 28| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ ret = mlk_ct_memcmp(sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ | Branch (105:9): [True: 0, False: 28] ------------------ 106| 28| test, MLKEM_SYMBYTES) ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 107| 28| ? MLK_ERR_FAIL ------------------ | | 272| 0|#define MLK_ERR_FAIL (-1) ------------------ 108| 28| : 0; 109| | 110| 28|cleanup: 111| | /* Specification: Partially implements 112| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 113| | MLK_FREE(test, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 114| 28| return ret; 115| 28|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_keypair_derand: 214| 28|{ 215| 28| int ret; 216| | 217| 28| ret = mlk_indcpa_keypair_derand(pk, sk, coins, context); ------------------ | | 49| 28| MLK_NAMESPACE_K(indcpa_keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | MLK_NAMESPACE_K(indcpa_keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 212| 28|#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2) | | ------------------ ------------------ 218| 28| if (ret != 0) ------------------ | Branch (218:7): [True: 0, False: 28] ------------------ 219| 0| { 220| 0| goto cleanup; 221| 0| } 222| | 223| 28| mlk_memcpy(sk + MLKEM_INDCPA_SECRETKEYBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 168| 28|#define mlk_memcpy memcpy ------------------ mlk_memcpy(sk + MLKEM_INDCPA_SECRETKEYBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 65| 28|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | ------------------ | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 13| 28|#define MLKEM_K 2 | | | | ------------------ | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | ------------------ | | ------------------ ------------------ mlk_memcpy(sk + MLKEM_INDCPA_SECRETKEYBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 69| 28|#define MLKEM_INDCCA_PUBLICKEYBYTES (MLKEM_INDCPA_PUBLICKEYBYTES) | | ------------------ | | | | 64| 28|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 28|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ ------------------ 224| 28| mlk_hash_h(sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, pk, ------------------ | | 29| 28|#define mlk_hash_h(OUT, IN, INBYTES) mlk_sha3_256(OUT, IN, INBYTES) | | ------------------ | | | | 19| 28|#define mlk_sha3_256 sha3_256 | | | | ------------------ | | | | | | 15| 28|#define sha3_256 OQS_SHA3_sha3_256 | | | | ------------------ | | ------------------ ------------------ 225| 28| MLKEM_INDCCA_PUBLICKEYBYTES); 226| | /* Value z for pseudo-random output on reject */ 227| 28| mlk_memcpy(sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 168| 28|#define mlk_memcpy memcpy ------------------ mlk_memcpy(sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 72| 28| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 28|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 28|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 28|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 28|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 28| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ mlk_memcpy(sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 228| 28| coins + MLKEM_SYMBYTES, MLKEM_SYMBYTES); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ coins + MLKEM_SYMBYTES, MLKEM_SYMBYTES); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 229| | 230| | /* Declassify public key */ 231| 28| MLK_CT_TESTING_DECLASSIFY(pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 235| 28| do \ | | 236| 28| { \ | | 237| 28| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 28] | | ------------------ ------------------ 232| | 233| | /* Pairwise Consistency Test (PCT) @[FIPS140_3_IG, p.87] */ 234| 28| ret = mlk_check_pct(pk, sk, context); ------------------ | | 37| 28|#define mlk_check_pct MLK_ADD_PARAM_SET(mlk_check_pct) MLK_CONTEXT_PARAMETERS_2 | | ------------------ | | | | 48| 28|#define MLK_ADD_PARAM_SET(s) s | | ------------------ | | #define mlk_check_pct MLK_ADD_PARAM_SET(mlk_check_pct) MLK_CONTEXT_PARAMETERS_2 | | ------------------ | | | | 211| 28|#define MLK_CONTEXT_PARAMETERS_2(arg0, arg1, context) (arg0, arg1) | | ------------------ ------------------ 235| 28| if (ret != 0) ------------------ | Branch (235:7): [True: 0, False: 28] ------------------ 236| 0| { 237| 0| goto cleanup; 238| 0| } 239| | 240| 28|cleanup: 241| 28| if (ret != 0) ------------------ | Branch (241:7): [True: 0, False: 28] ------------------ 242| 0| { 243| 0| mlk_zeroize(pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 69| 0|#define MLKEM_INDCCA_PUBLICKEYBYTES (MLKEM_INDCPA_PUBLICKEYBYTES) | | ------------------ | | | | 64| 0|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 0|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 0|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 0|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ ------------------ 244| 0| mlk_zeroize(sk, MLKEM_INDCCA_SECRETKEYBYTES); ------------------ | | 72| 0| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 0|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 0|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 0|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 0|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 0|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 0|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 0|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 0|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 0| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ 245| 0| } 246| | 247| 28| return ret; 248| 28|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_keypair: 257| 28|{ 258| 28| int ret = 0; 259| 28| MLK_ALLOC(coins, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 260| | 261| 28| if (coins == NULL) ------------------ | Branch (261:7): [True: 0, False: 28] ------------------ 262| 0| { 263| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 264| 0| goto cleanup; 265| 0| } 266| | 267| | /* Acquire necessary randomness, and mark it as secret. */ 268| 28| if (mlk_randombytes(coins, 2 * MLKEM_SYMBYTES) != 0) ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ | Branch (268:7): [True: 0, False: 28] ------------------ 269| 0| { 270| 0| ret = MLK_ERR_RNG_FAIL; ------------------ | | 278| 0|#define MLK_ERR_RNG_FAIL (-3) ------------------ 271| 0| goto cleanup; 272| 0| } 273| | 274| 28| MLK_CT_TESTING_SECRET(coins, 2 * MLKEM_SYMBYTES); ------------------ | | 231| 28| do \ | | 232| 28| { \ | | 233| 28| } while (0) | | ------------------ | | | Branch (233:12): [Folded, False: 28] | | ------------------ ------------------ 275| | 276| 28| ret = mlk_kem_keypair_derand(pk, sk, coins, context); ------------------ | | 50| 28| MLK_NAMESPACE_K(keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | MLK_NAMESPACE_K(keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 212| 28|#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2) | | ------------------ ------------------ 277| | 278| 28|cleanup: 279| | /* Specification: Partially implements 280| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 281| | MLK_FREE(coins, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 282| 28| return ret; 283| 28|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_enc_derand: 295| 28|{ 296| 28| int ret = 0; 297| 28| MLK_ALLOC(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 298| 28| MLK_ALLOC(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 299| | 300| 28| if (buf == NULL || kr == NULL) ------------------ | Branch (300:7): [True: 0, False: 28] | Branch (300:22): [True: 0, False: 28] ------------------ 301| 0| { 302| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 303| 0| goto cleanup; 304| 0| } 305| | 306| | /* Specification: Implements @[FIPS203, Section 7.2, Modulus check] */ 307| 28| ret = mlk_kem_check_pk(pk, context); ------------------ | | 55| 28|#define mlk_kem_check_pk MLK_NAMESPACE_K(check_pk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_kem_check_pk MLK_NAMESPACE_K(check_pk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 210| 28|#define MLK_CONTEXT_PARAMETERS_1(arg0, context) (arg0) | | ------------------ ------------------ 308| 28| if (ret != 0) ------------------ | Branch (308:7): [True: 0, False: 28] ------------------ 309| 0| { 310| 0| goto cleanup; 311| 0| } 312| | 313| 28| mlk_memcpy(buf, coins, MLKEM_SYMBYTES); ------------------ | | 168| 28|#define mlk_memcpy memcpy ------------------ mlk_memcpy(buf, coins, MLKEM_SYMBYTES); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 314| | 315| | /* Multitarget countermeasure for coins + contributory KEM */ 316| 28| mlk_hash_h(buf + MLKEM_SYMBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 29| 28|#define mlk_hash_h(OUT, IN, INBYTES) mlk_sha3_256(OUT, IN, INBYTES) | | ------------------ | | | | 19| 28|#define mlk_sha3_256 sha3_256 | | | | ------------------ | | | | | | 15| 28|#define sha3_256 OQS_SHA3_sha3_256 | | | | ------------------ | | ------------------ ------------------ 317| 28| mlk_hash_g(kr, buf, 2 * MLKEM_SYMBYTES); ------------------ | | 32| 28|#define mlk_hash_g(OUT, IN, INBYTES) mlk_sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 20| 28|#define mlk_sha3_512 sha3_512 | | | | ------------------ | | | | | | 31| 28|#define sha3_512 OQS_SHA3_sha3_512 | | | | ------------------ | | ------------------ ------------------ 318| | 319| | /* coins are in kr+MLKEM_SYMBYTES */ 320| 28| ret = mlk_indcpa_enc(ct, buf, pk, kr + MLKEM_SYMBYTES, context); ------------------ | | 88| 28|#define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 214| 28| (arg0, arg1, arg2, arg3) | | ------------------ ------------------ 321| 28| if (ret != 0) ------------------ | Branch (321:7): [True: 0, False: 28] ------------------ 322| 0| { 323| 0| goto cleanup; 324| 0| } 325| | 326| 28| mlk_memcpy(ss, kr, MLKEM_SYMBYTES); ------------------ | | 168| 28|#define mlk_memcpy memcpy ------------------ mlk_memcpy(ss, kr, MLKEM_SYMBYTES); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 327| | 328| 28|cleanup: 329| | /* Specification: Partially implements 330| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 331| 28| MLK_FREE(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 332| | MLK_FREE(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 333| 28| return ret; 334| 28|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_enc: 344| 28|{ 345| 28| int ret = 0; 346| 28| MLK_ALLOC(coins, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 347| | 348| 28| if (coins == NULL) ------------------ | Branch (348:7): [True: 0, False: 28] ------------------ 349| 0| { 350| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 351| 0| goto cleanup; 352| 0| } 353| | 354| 28| if (mlk_randombytes(coins, MLKEM_SYMBYTES) != 0) ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ | Branch (354:7): [True: 0, False: 28] ------------------ 355| 0| { 356| 0| ret = MLK_ERR_RNG_FAIL; ------------------ | | 278| 0|#define MLK_ERR_RNG_FAIL (-3) ------------------ 357| 0| goto cleanup; 358| 0| } 359| | 360| 28| MLK_CT_TESTING_SECRET(coins, MLKEM_SYMBYTES); ------------------ | | 231| 28| do \ | | 232| 28| { \ | | 233| 28| } while (0) | | ------------------ | | | Branch (233:12): [Folded, False: 28] | | ------------------ ------------------ 361| | 362| 28| ret = mlk_kem_enc_derand(ct, ss, pk, coins, context); ------------------ | | 52| 28|#define mlk_kem_enc_derand MLK_NAMESPACE_K(enc_derand) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_kem_enc_derand MLK_NAMESPACE_K(enc_derand) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 214| 28| (arg0, arg1, arg2, arg3) | | ------------------ ------------------ 363| | 364| 28|cleanup: 365| | /* Specification: Partially implements 366| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 367| | MLK_FREE(coins, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 368| 28| return ret; 369| 28|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_dec: 380| 28|{ 381| 28| int ret = 0; 382| 28| uint8_t fail; 383| 28| const uint8_t *pk = sk + MLKEM_INDCPA_SECRETKEYBYTES; ------------------ | | 65| 28|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | ------------------ | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 13| 28|#define MLKEM_K 2 | | | | ------------------ | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | ------------------ | | ------------------ ------------------ 384| 28| MLK_ALLOC(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 385| 28| MLK_ALLOC(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 386| 28| MLK_ALLOC(tmp, uint8_t, MLKEM_SYMBYTES + MLKEM_INDCCA_CIPHERTEXTBYTES, ------------------ | | 229| 28| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 28| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 387| 28| context); 388| | 389| 28| if (buf == NULL || kr == NULL || tmp == NULL) ------------------ | Branch (389:7): [True: 0, False: 28] | Branch (389:22): [True: 0, False: 28] | Branch (389:36): [True: 0, False: 28] ------------------ 390| 0| { 391| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 392| 0| goto cleanup; 393| 0| } 394| | 395| | /* Specification: Implements @[FIPS203, Section 7.3, Hash check] */ 396| 28| ret = mlk_kem_check_sk(sk, context); ------------------ | | 56| 28|#define mlk_kem_check_sk MLK_NAMESPACE_K(check_sk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_kem_check_sk MLK_NAMESPACE_K(check_sk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 210| 28|#define MLK_CONTEXT_PARAMETERS_1(arg0, context) (arg0) | | ------------------ ------------------ 397| 28| if (ret != 0) ------------------ | Branch (397:7): [True: 0, False: 28] ------------------ 398| 0| { 399| 0| goto cleanup; 400| 0| } 401| | 402| 28| ret = mlk_indcpa_dec(buf, ct, sk, context); ------------------ | | 127| 28|#define mlk_indcpa_dec MLK_NAMESPACE_K(indcpa_dec) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_indcpa_dec MLK_NAMESPACE_K(indcpa_dec) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 212| 28|#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2) | | ------------------ ------------------ 403| 28| if (ret != 0) ------------------ | Branch (403:7): [True: 0, False: 28] ------------------ 404| 0| { 405| 0| goto cleanup; 406| 0| } 407| | 408| | /* Multitarget countermeasure for coins + contributory KEM */ 409| 28| mlk_memcpy(buf + MLKEM_SYMBYTES, ------------------ | | 168| 28|#define mlk_memcpy memcpy ------------------ mlk_memcpy(buf + MLKEM_SYMBYTES, ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 410| 28| sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 72| 28| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 28|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 28|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 28|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 28|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 28| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 411| 28| MLKEM_SYMBYTES); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 412| 28| mlk_hash_g(kr, buf, 2 * MLKEM_SYMBYTES); ------------------ | | 32| 28|#define mlk_hash_g(OUT, IN, INBYTES) mlk_sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 20| 28|#define mlk_sha3_512 sha3_512 | | | | ------------------ | | | | | | 31| 28|#define sha3_512 OQS_SHA3_sha3_512 | | | | ------------------ | | ------------------ ------------------ 413| | 414| | /* Recompute and compare ciphertext */ 415| | /* coins are in kr+MLKEM_SYMBYTES */ 416| 28| ret = mlk_indcpa_enc(tmp, buf, pk, kr + MLKEM_SYMBYTES, context); ------------------ | | 88| 28|#define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 64| 28|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 214| 28| (arg0, arg1, arg2, arg3) | | ------------------ ------------------ 417| 28| if (ret != 0) ------------------ | Branch (417:7): [True: 0, False: 28] ------------------ 418| 0| { 419| 0| goto cleanup; 420| 0| } 421| | 422| 28| fail = mlk_ct_memcmp(ct, tmp, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 74| 28|#define MLKEM_INDCCA_CIPHERTEXTBYTES (MLKEM_INDCPA_BYTES) | | ------------------ | | | | 67| 28| (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 44| 28|#define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 13| 28|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 43| 28|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D10 | | | | | | | | ------------------ | | | | | | | | | | 35| 28|#define MLKEM_POLYCOMPRESSEDBYTES_D10 320 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 42| 28|#define MLKEM_POLYCOMPRESSEDBYTES_DV MLKEM_POLYCOMPRESSEDBYTES_D4 | | | | | | ------------------ | | | | | | | | 33| 28|#define MLKEM_POLYCOMPRESSEDBYTES_D4 128 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 423| | 424| | /* Compute rejection key */ 425| 28| mlk_memcpy(tmp, sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 168| 28|#define mlk_memcpy memcpy ------------------ mlk_memcpy(tmp, sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 72| 28| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 28|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 28|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 28|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 28|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 13| 28|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 28|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 28| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ mlk_memcpy(tmp, sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 426| 28| MLKEM_SYMBYTES); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 427| 28| mlk_memcpy(tmp + MLKEM_SYMBYTES, ct, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 168| 28|#define mlk_memcpy memcpy ------------------ mlk_memcpy(tmp + MLKEM_SYMBYTES, ct, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ mlk_memcpy(tmp + MLKEM_SYMBYTES, ct, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 74| 28|#define MLKEM_INDCCA_CIPHERTEXTBYTES (MLKEM_INDCPA_BYTES) | | ------------------ | | | | 67| 28| (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 44| 28|#define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 13| 28|#define MLKEM_K 2 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 43| 28|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D10 | | | | | | | | ------------------ | | | | | | | | | | 35| 28|#define MLKEM_POLYCOMPRESSEDBYTES_D10 320 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 42| 28|#define MLKEM_POLYCOMPRESSEDBYTES_DV MLKEM_POLYCOMPRESSEDBYTES_D4 | | | | | | ------------------ | | | | | | | | 33| 28|#define MLKEM_POLYCOMPRESSEDBYTES_D4 128 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 428| 28| mlk_hash_j(ss, tmp, MLKEM_SYMBYTES + MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 36| 28| mlk_shake256(OUT, MLKEM_SYMBYTES, IN, INBYTES) | | ------------------ | | | | 18| 28|#define mlk_shake256 shake256 | | | | ------------------ | | | | | | 12| 28|#define shake256 OQS_SHA3_shake256 | | | | ------------------ | | ------------------ | | mlk_shake256(OUT, MLKEM_SYMBYTES, IN, INBYTES) | | ------------------ | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ 429| | 430| | /* Copy true key to return buffer if fail is 0 */ 431| 28| mlk_ct_cmov_zero(ss, kr, MLKEM_SYMBYTES, fail); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 432| | 433| 28|cleanup: 434| | /* Specification: Partially implements 435| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 436| 28| MLK_FREE(tmp, uint8_t, MLKEM_SYMBYTES + MLKEM_INDCCA_CIPHERTEXTBYTES, ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 437| 28| context); 438| 28| MLK_FREE(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 439| 28| MLK_FREE(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 28| do \ | | 239| 28| { \ | | 240| 28| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 28| (v) = NULL; \ | | 242| 28| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 28] | | ------------------ ------------------ 440| | 441| 28| return ret; 442| 28|} poly_k.c:mlk_polyvec_basemul_acc_montgomery_cached_k2_native: 125| 252|{ 126| 252| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (126:7): [True: 0, False: 252] ------------------ 127| 0| { 128| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 129| 0| } 130| | 131| 252| mlk_polyvec_basemul_acc_montgomery_cached_k2_avx2_asm(r, a, b, b_cache); ------------------ | | 107| 252| MLK_NAMESPACE(polyvec_basemul_acc_montgomery_cached_k2_avx2_asm) | | ------------------ | | | | 63| 252|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 252|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 252|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 132| 252| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 252|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 133| 252|} sampling.c:mlk_rej_uniform_native: 50| 2.49k|{ 51| 2.49k| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2) || len != MLKEM_N || ------------------ | | 22| 4.98k|#define MLKEM_N 256 ------------------ | Branch (51:7): [True: 0, False: 2.49k] | Branch (51:54): [True: 0, False: 2.49k] ------------------ 52| 2.49k| buflen % 12 != 0) ------------------ | Branch (52:7): [True: 0, False: 2.49k] ------------------ 53| 0| { 54| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 55| 0| } 56| 2.49k| return (int)mlk_rej_uniform_avx2_asm(r, buf, buflen, mlk_rej_uniform_table); ------------------ | | 20| 2.49k|#define mlk_rej_uniform_avx2_asm MLK_NAMESPACE(rej_uniform_avx2_asm) | | ------------------ | | | | 63| 2.49k|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 2.49k|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 2.49k|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ return (int)mlk_rej_uniform_avx2_asm(r, buf, buflen, mlk_rej_uniform_table); ------------------ | | 17| 2.49k|#define mlk_rej_uniform_table MLK_NAMESPACE(rej_uniform_table) | | ------------------ | | | | 63| 2.49k|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 2.49k|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 2.49k|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 57| 2.49k|} compress.c:mlk_poly_compress_d4_native: 198| 116|{ 199| 116| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (199:7): [True: 0, False: 116] ------------------ 200| 0| { 201| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 202| 0| } 203| | 204| 116| mlk_poly_compress_d4_avx2_asm(r, a, mlk_compress_d4_data); ------------------ | | 195| 116|#define mlk_poly_compress_d4_avx2_asm MLK_NAMESPACE(poly_compress_d4_avx2_asm) | | ------------------ | | | | 63| 116|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 116|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 116|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_compress_d4_avx2_asm(r, a, mlk_compress_d4_data); ------------------ | | 19| 116|#define mlk_compress_d4_data MLK_NAMESPACE(compress_d4_data) | | ------------------ | | | | 63| 116|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 116|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 116|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 205| 116| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 116|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 206| 116|} compress.c:mlk_poly_compress_d10_native: 211| 292|{ 212| 292| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (212:7): [True: 0, False: 292] ------------------ 213| 0| { 214| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 215| 0| } 216| | 217| 292| mlk_poly_compress_d10_avx2_asm(r, a, mlk_compress_d10_data); ------------------ | | 228| 292|#define mlk_poly_compress_d10_avx2_asm MLK_NAMESPACE(poly_compress_d10_avx2_asm) | | ------------------ | | | | 63| 292|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 292|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 292|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_compress_d10_avx2_asm(r, a, mlk_compress_d10_data); ------------------ | | 25| 292|#define mlk_compress_d10_data MLK_NAMESPACE(compress_d10_data) | | ------------------ | | | | 63| 292|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 292|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 292|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 218| 292| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 292|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 219| 292|} compress.c:mlk_poly_decompress_d4_native: 224| 58|{ 225| 58| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (225:7): [True: 0, False: 58] ------------------ 226| 0| { 227| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 228| 0| } 229| | 230| 58| mlk_poly_decompress_d4_avx2_asm(r, a, mlk_decompress_d4_data); ------------------ | | 212| 58| MLK_NAMESPACE(poly_decompress_d4_avx2_asm) | | ------------------ | | | | 63| 58|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 58|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 58|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_decompress_d4_avx2_asm(r, a, mlk_decompress_d4_data); ------------------ | | 22| 58|#define mlk_decompress_d4_data MLK_NAMESPACE(decompress_d4_data) | | ------------------ | | | | 63| 58|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 58|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 58|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 231| 58| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 58|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 232| 58|} compress.c:mlk_poly_decompress_d10_native: 237| 146|{ 238| 146| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (238:7): [True: 0, False: 146] ------------------ 239| 0| { 240| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 241| 0| } 242| | 243| 146| mlk_poly_decompress_d10_avx2_asm(r, a, mlk_decompress_d10_data); ------------------ | | 245| 146| MLK_NAMESPACE(poly_decompress_d10_avx2_asm) | | ------------------ | | | | 63| 146|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 146|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 146|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_decompress_d10_avx2_asm(r, a, mlk_decompress_d10_data); ------------------ | | 28| 146|#define mlk_decompress_d10_data MLK_NAMESPACE(decompress_d10_data) | | ------------------ | | | | 63| 146|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 146|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 146|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 244| 146| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 146|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 245| 146|} compress.c:mlk_poly_tobytes_native: 171| 774|{ 172| 774| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (172:7): [True: 0, False: 774] ------------------ 173| 0| { 174| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 175| 0| } 176| | 177| 774| mlk_ntttobytes_avx2_asm(r, a); ------------------ | | 157| 774|#define mlk_ntttobytes_avx2_asm MLK_NAMESPACE(ntttobytes_avx2_asm) | | ------------------ | | | | 63| 774|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 774|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 774|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 178| 774| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 774|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 179| 774|} compress.c:mlk_poly_frombytes_native: 184| 1.03k|{ 185| 1.03k| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (185:7): [True: 0, False: 1.03k] ------------------ 186| 0| { 187| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 188| 0| } 189| | 190| 1.03k| mlk_nttfrombytes_avx2_asm(r, a); ------------------ | | 170| 1.03k|#define mlk_nttfrombytes_avx2_asm MLK_NAMESPACE(nttfrombytes_avx2_asm) | | ------------------ | | | | 63| 1.03k|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 1.03k|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 1.03k|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 191| 1.03k| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 1.03k|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 192| 1.03k|} indcpa.c:mlk_poly_permute_bitrev_to_custom: 39| 2.49k|{ 40| 2.49k| if (mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (40:7): [True: 2.49k, False: 0] ------------------ 41| 2.49k| { 42| 2.49k| mlk_nttunpack_avx2_asm(data); ------------------ | | 65| 2.49k|#define mlk_nttunpack_avx2_asm MLK_NAMESPACE(nttunpack_avx2_asm) | | ------------------ | | | | 63| 2.49k|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 2.49k|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 2.49k|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 43| 2.49k| } 44| 2.49k|} poly.c:mlk_poly_tomont_native: 97| 258|{ 98| 258| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (98:7): [True: 0, False: 258] ------------------ 99| 0| { 100| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 101| 0| } 102| | 103| 258| mlk_tomont_avx2_asm(data); ------------------ | | 183| 258|#define mlk_tomont_avx2_asm MLK_NAMESPACE(tomont_avx2_asm) | | ------------------ | | | | 63| 258|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 258|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 258|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 104| 258| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 258|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 105| 258|} poly.c:mlk_poly_reduce_native: 85| 1.54k|{ 86| 1.54k| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (86:7): [True: 0, False: 1.54k] ------------------ 87| 0| { 88| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 89| 0| } 90| | 91| 1.54k| mlk_reduce_avx2_asm(data); ------------------ | | 80| 1.54k|#define mlk_reduce_avx2_asm MLK_NAMESPACE(reduce_avx2_asm) | | ------------------ | | | | 63| 1.54k|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 1.54k|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 1.54k|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 92| 1.54k| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 1.54k|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 93| 1.54k|} poly.c:mlk_poly_mulcache_compute_native: 110| 1.03k|{ 111| 1.03k| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (111:7): [True: 0, False: 1.03k] ------------------ 112| 0| { 113| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 114| 0| } 115| | 116| 1.03k| mlk_poly_mulcache_compute_avx2_asm(x, y, mlk_qdata); ------------------ | | 92| 1.03k| MLK_NAMESPACE(poly_mulcache_compute_avx2_asm) | | ------------------ | | | | 63| 1.03k|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 1.03k|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 1.03k|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_mulcache_compute_avx2_asm(x, y, mlk_qdata); ------------------ | | 21| 1.03k|#define mlk_qdata MLK_NAMESPACE(qdata) | | ------------------ | | | | 63| 1.03k|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 1.03k|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 1.03k|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 117| 1.03k| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 1.03k|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 118| 1.03k|} poly.c:mlk_ntt_native: 61| 1.29k|{ 62| 1.29k| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (62:7): [True: 0, False: 1.29k] ------------------ 63| 0| { 64| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 65| 0| } 66| | 67| 1.29k| mlk_ntt_avx2_asm(data, mlk_qdata); ------------------ | | 36| 1.29k|#define mlk_ntt_avx2_asm MLK_NAMESPACE(ntt_avx2_asm) | | ------------------ | | | | 63| 1.29k|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 1.29k|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 1.29k|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_ntt_avx2_asm(data, mlk_qdata); ------------------ | | 21| 1.29k|#define mlk_qdata MLK_NAMESPACE(qdata) | | ------------------ | | | | 63| 1.29k|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 1.29k|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 1.29k|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 68| 1.29k| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 1.29k|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 69| 1.29k|} poly.c:mlk_intt_native: 73| 774|{ 74| 774| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (74:7): [True: 0, False: 774] ------------------ 75| 0| { 76| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 77| 0| } 78| | 79| 774| mlk_invntt_avx2_asm(data, mlk_qdata); ------------------ | | 51| 774|#define mlk_invntt_avx2_asm MLK_NAMESPACE(invntt_avx2_asm) | | ------------------ | | | | 63| 774|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 774|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 774|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_invntt_avx2_asm(data, mlk_qdata); ------------------ | | 21| 774|#define mlk_qdata MLK_NAMESPACE(qdata) | | ------------------ | | | | 63| 774|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 774|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 774|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 80| 774| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 774|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 81| 774|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_tomont: 132| 56|{ 133| 56|#if defined(MLK_USE_NATIVE_POLY_TOMONT) 134| 56| int ret; 135| 56| ret = mlk_poly_tomont_native(r->coeffs); 136| 56| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 56|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (136:7): [True: 56, False: 0] ------------------ 137| 56| { 138| 56| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_Q); ------------------ | | 105| 56| do \ | | 106| 56| { \ | | 107| 56| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 56] | | ------------------ ------------------ 139| 56| return; 140| 56| } 141| 0|#endif /* MLK_USE_NATIVE_POLY_TOMONT */ 142| | 143| 0| mlk_poly_tomont_c(r); 144| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_reduce: 211| 364|{ 212| 364|#if defined(MLK_USE_NATIVE_POLY_REDUCE) 213| 364| int ret; 214| 364| ret = mlk_poly_reduce_native(r->coeffs); 215| 364| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 364|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (215:7): [True: 364, False: 0] ------------------ 216| 364| { 217| 364| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 364| do \ | | 102| 364| { \ | | 103| 364| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 364] | | ------------------ ------------------ 218| 364| return; 219| 364| } 220| 0|#endif /* MLK_USE_NATIVE_POLY_REDUCE */ 221| | 222| 0| mlk_poly_reduce_c(r); 223| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_add: 230| 280|{ 231| 280| unsigned i; 232| 71.9k| for (i = 0; i < MLKEM_N; i++) ------------------ | | 22| 71.9k|#define MLKEM_N 256 ------------------ | Branch (232:15): [True: 71.6k, False: 280] ------------------ 233| 71.6k| __loop__( 234| 71.6k| invariant(i <= MLKEM_N) 235| 71.6k| invariant(forall(k0, i, MLKEM_N, r->coeffs[k0] == loop_entry(*r).coeffs[k0])) 236| 71.6k| invariant(forall(k1, 0, i, r->coeffs[k1] == loop_entry(*r).coeffs[k1] + b->coeffs[k1])) 237| 71.6k| decreases(MLKEM_N - i)) 238| 71.6k| { 239| | /* The preconditions imply that the addition stays within int16_t. */ 240| 71.6k| r->coeffs[i] = (int16_t)(r->coeffs[i] + b->coeffs[i]); 241| 71.6k| } 242| 280|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_sub: 249| 28|{ 250| 28| unsigned i; 251| 7.19k| for (i = 0; i < MLKEM_N; i++) ------------------ | | 22| 7.19k|#define MLKEM_N 256 ------------------ | Branch (251:15): [True: 7.16k, False: 28] ------------------ 252| 7.16k| __loop__( 253| 7.16k| invariant(i <= MLKEM_N) 254| 7.16k| invariant(forall(k0, i, MLKEM_N, r->coeffs[k0] == loop_entry(*r).coeffs[k0])) 255| 7.16k| invariant(forall(k1, 0, i, r->coeffs[k1] == loop_entry(*r).coeffs[k1] - b->coeffs[k1])) 256| 7.16k| decreases(MLKEM_N - i)) 257| 7.16k| { 258| | /* The preconditions imply that the subtraction stays within int16_t. */ 259| 7.16k| r->coeffs[i] = (int16_t)(r->coeffs[i] - b->coeffs[i]); 260| 7.16k| } 261| 28|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_mulcache_compute: 302| 224|{ 303| 224|#if defined(MLK_USE_NATIVE_POLY_MULCACHE_COMPUTE) 304| 224| int ret; 305| 224| ret = mlk_poly_mulcache_compute_native(x->coeffs, a->coeffs); 306| 224| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 224|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (306:7): [True: 224, False: 0] ------------------ 307| 224| { 308| 224| return; 309| 224| } 310| 0|#endif /* MLK_USE_NATIVE_POLY_MULCACHE_COMPUTE */ 311| | 312| 0| mlk_poly_mulcache_compute_c(x, a); 313| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_ntt: 457| 280|{ 458| 280|#if defined(MLK_USE_NATIVE_NTT) 459| 280| int ret; 460| 280| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_Q); ------------------ | | 105| 280| do \ | | 106| 280| { \ | | 107| 280| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 280] | | ------------------ ------------------ 461| 280| ret = mlk_ntt_native(r->coeffs); 462| 280| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 280|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (462:7): [True: 280, False: 0] ------------------ 463| 280| { 464| 280| mlk_assert_abs_bound(r, MLKEM_N, MLK_NTT_BOUND); ------------------ | | 105| 280| do \ | | 106| 280| { \ | | 107| 280| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 280] | | ------------------ ------------------ 465| 280| return; 466| 280| } 467| 0|#endif /* MLK_USE_NATIVE_NTT */ 468| | 469| 0| mlk_poly_ntt_c(r); 470| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_invntt_tomont: 558| 196|{ 559| 196|#if defined(MLK_USE_NATIVE_INTT) 560| 196| int ret; 561| 196| ret = mlk_intt_native(r->coeffs); 562| 196| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 196|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (562:7): [True: 196, False: 0] ------------------ 563| 196| { 564| 196| mlk_assert_abs_bound(r, MLKEM_N, MLK_INVNTT_BOUND); ------------------ | | 105| 196| do \ | | 106| 196| { \ | | 107| 196| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 196] | | ------------------ ------------------ 565| 196| return; 566| 196| } 567| 0|#endif /* MLK_USE_NATIVE_INTT */ 568| | 569| 0| mlk_poly_invntt_tomont_c(r); 570| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_compress_du: 50| 56|{ 51| 56| unsigned i; 52| 56| mlk_assert_bound_2d(a->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 56| do \ | | 111| 56| { \ | | 112| 56| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 56] | | ------------------ ------------------ 53| | 54| 168| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 168|#define MLKEM_K 2 ------------------ | Branch (54:15): [True: 112, False: 56] ------------------ 55| 112| { 56| 112| mlk_poly_compress_du(r + i * MLKEM_POLYCOMPRESSEDBYTES_DU, &a->vec[i]); ------------------ | | 49| 112|#define mlk_poly_compress_du MLK_NAMESPACE_K(poly_compress_du) | | ------------------ | | | | 64| 112|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 112|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 112|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_compress_du(r + i * MLKEM_POLYCOMPRESSEDBYTES_DU, &a->vec[i]); ------------------ | | 43| 112|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D10 | | ------------------ | | | | 35| 112|#define MLKEM_POLYCOMPRESSEDBYTES_D10 320 | | ------------------ ------------------ 57| 112| } 58| 56|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_decompress_du: 64| 28|{ 65| 28| unsigned i; 66| 84| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 84|#define MLKEM_K 2 ------------------ | Branch (66:15): [True: 56, False: 28] ------------------ 67| 56| { 68| 56| mlk_poly_decompress_du(&r->vec[i], a + i * MLKEM_POLYCOMPRESSEDBYTES_DU); ------------------ | | 79| 56|#define mlk_poly_decompress_du MLK_NAMESPACE_K(poly_decompress_du) | | ------------------ | | | | 64| 56|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_decompress_du(&r->vec[i], a + i * MLKEM_POLYCOMPRESSEDBYTES_DU); ------------------ | | 43| 56|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D10 | | ------------------ | | | | 35| 56|#define MLKEM_POLYCOMPRESSEDBYTES_D10 320 | | ------------------ ------------------ 69| 56| } 70| | 71| 28| mlk_assert_bound_2d(r->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 28| do \ | | 111| 28| { \ | | 112| 28| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 28] | | ------------------ ------------------ 72| 28|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_tobytes: 81| 84|{ 82| 84| unsigned i; 83| 84| mlk_assert_bound_2d(a->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 84| do \ | | 111| 84| { \ | | 112| 84| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 84] | | ------------------ ------------------ 84| | 85| 252| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 252|#define MLKEM_K 2 ------------------ | Branch (85:15): [True: 168, False: 84] ------------------ 86| 168| __loop__( 87| 168| assigns(i, memory_slice(r, MLKEM_POLYVECBYTES)) 88| 168| invariant(i <= MLKEM_K) 89| 168| decreases(MLKEM_K - i) 90| 168| ) 91| 168| { 92| 168| mlk_poly_tobytes(&r[i * MLKEM_POLYBYTES], &a->vec[i]); ------------------ | | 512| 168|#define mlk_poly_tobytes MLK_NAMESPACE(poly_tobytes) | | ------------------ | | | | 63| 168|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 168|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 168|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_tobytes(&r[i * MLKEM_POLYBYTES], &a->vec[i]); ------------------ | | 30| 168|#define MLKEM_POLYBYTES 384 ------------------ 93| 168| } 94| 84|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_frombytes: 99| 112|{ 100| 112| unsigned i; 101| 336| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 336|#define MLKEM_K 2 ------------------ | Branch (101:15): [True: 224, False: 112] ------------------ 102| 224| { 103| 224| mlk_poly_frombytes(&r->vec[i], a + i * MLKEM_POLYBYTES); ------------------ | | 534| 224|#define mlk_poly_frombytes MLK_NAMESPACE(poly_frombytes) | | ------------------ | | | | 63| 224|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 224|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 224|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_frombytes(&r->vec[i], a + i * MLKEM_POLYBYTES); ------------------ | | 30| 224|#define MLKEM_POLYBYTES 384 ------------------ 104| 224| } 105| | 106| 112| mlk_assert_bound_2d(r->vec, MLKEM_K, MLKEM_N, 0, MLKEM_UINT12_LIMIT); ------------------ | | 110| 112| do \ | | 111| 112| { \ | | 112| 112| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 112] | | ------------------ ------------------ 107| 112|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_ntt: 112| 140|{ 113| 140| unsigned i; 114| 420| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 420|#define MLKEM_K 2 ------------------ | Branch (114:15): [True: 280, False: 140] ------------------ 115| 280| { 116| 280| mlk_poly_ntt(&r->vec[i]); ------------------ | | 235| 280|#define mlk_poly_ntt MLK_NAMESPACE(poly_ntt) | | ------------------ | | | | 63| 280|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 280|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 280|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 117| 280| } 118| | 119| 140| mlk_assert_abs_bound_2d(r->vec, MLKEM_K, MLKEM_N, MLK_NTT_BOUND); ------------------ | | 115| 140| do \ | | 116| 140| { \ | | 117| 140| } while (0) | | ------------------ | | | Branch (117:12): [Folded, False: 140] | | ------------------ ------------------ 120| 140|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_invntt_tomont: 129| 56|{ 130| 56| unsigned i; 131| 168| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 168|#define MLKEM_K 2 ------------------ | Branch (131:15): [True: 112, False: 56] ------------------ 132| 112| { 133| 112| mlk_poly_invntt_tomont(&r->vec[i]); ------------------ | | 263| 112|#define mlk_poly_invntt_tomont MLK_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 63| 112|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 112|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 112|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 134| 112| } 135| | 136| 56| mlk_assert_abs_bound_2d(r->vec, MLKEM_K, MLKEM_N, MLK_INVNTT_BOUND); ------------------ | | 115| 56| do \ | | 116| 56| { \ | | 117| 56| } while (0) | | ------------------ | | | Branch (117:12): [Folded, False: 56] | | ------------------ ------------------ 137| 56|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_basemul_acc_montgomery_cached: 195| 252|{ 196| 252|#if defined(MLK_USE_NATIVE_POLYVEC_BASEMUL_ACC_MONTGOMERY_CACHED) 197| 252| { 198| 252| int ret; 199| 252| mlk_assert_bound_2d(a->vec, MLKEM_K, MLKEM_N, 0, MLKEM_UINT12_LIMIT); ------------------ | | 110| 252| do \ | | 111| 252| { \ | | 112| 252| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 252] | | ------------------ ------------------ 200| 252|#if MLKEM_K == 2 201| 252| ret = mlk_polyvec_basemul_acc_montgomery_cached_k2_native( 202| 252| r->coeffs, (const int16_t *)a, (const int16_t *)b, 203| 252| (const int16_t *)b_cache); 204| |#elif MLKEM_K == 3 205| | ret = mlk_polyvec_basemul_acc_montgomery_cached_k3_native( 206| | r->coeffs, (const int16_t *)a, (const int16_t *)b, 207| | (const int16_t *)b_cache); 208| |#elif MLKEM_K == 4 209| | ret = mlk_polyvec_basemul_acc_montgomery_cached_k4_native( 210| | r->coeffs, (const int16_t *)a, (const int16_t *)b, 211| | (const int16_t *)b_cache); 212| |#endif 213| 252| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 252|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (213:9): [True: 252, False: 0] ------------------ 214| 252| { 215| 252| return; 216| 252| } 217| 252| } 218| 0|#endif /* MLK_USE_NATIVE_POLYVEC_BASEMUL_ACC_MONTGOMERY_CACHED */ 219| | 220| 0| mlk_polyvec_basemul_acc_montgomery_cached_c(r, a, b, b_cache); ------------------ | | 39| 0| MLK_ADD_PARAM_SET(mlk_polyvec_basemul_acc_montgomery_cached_c) | | ------------------ | | | | 48| 0|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 221| 0|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_mulcache_compute: 229| 112|{ 230| 112| unsigned i; 231| 336| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 336|#define MLKEM_K 2 ------------------ | Branch (231:15): [True: 224, False: 112] ------------------ 232| 224| { 233| 224| mlk_poly_mulcache_compute(&x->vec[i], &a->vec[i]); ------------------ | | 123| 224|#define mlk_poly_mulcache_compute MLK_NAMESPACE(poly_mulcache_compute) | | ------------------ | | | | 63| 224|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 224|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 224|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 234| 224| } 235| 112|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_reduce: 246| 140|{ 247| 140| unsigned i; 248| 420| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 420|#define MLKEM_K 2 ------------------ | Branch (248:15): [True: 280, False: 140] ------------------ 249| 280| { 250| 280| mlk_poly_reduce(&r->vec[i]); ------------------ | | 154| 280|#define mlk_poly_reduce MLK_NAMESPACE(poly_reduce) | | ------------------ | | | | 63| 280|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 280|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 280|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 251| 280| } 252| | 253| 140| mlk_assert_bound_2d(r->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 140| do \ | | 111| 140| { \ | | 112| 140| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 140] | | ------------------ ------------------ 254| 140|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_add: 261| 84|{ 262| 84| unsigned i; 263| 252| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 252|#define MLKEM_K 2 ------------------ | Branch (263:15): [True: 168, False: 84] ------------------ 264| 168| __loop__( 265| 168| assigns(i, memory_slice(r, sizeof(mlk_polyvec))) 266| 168| invariant(i <= MLKEM_K) 267| 168| invariant(forall(j0, i, MLKEM_K, 268| 168| forall(k0, 0, MLKEM_N, 269| 168| ((int32_t)r->vec[j0].coeffs[k0] + b->vec[j0].coeffs[k0] <= INT16_MAX) && 270| 168| ((int32_t)r->vec[j0].coeffs[k0] + b->vec[j0].coeffs[k0] >= INT16_MIN)))) 271| 168| invariant(forall(j2, 0, i, 272| 168| forall(k2, 0, MLKEM_N, 273| 168| (r->vec[j2].coeffs[k2] <= INT16_MAX) && 274| 168| (r->vec[j2].coeffs[k2] >= INT16_MIN)))) 275| 168| decreases(MLKEM_K - i) 276| 168| ) 277| 168| { 278| 168| mlk_poly_add(&r->vec[i], &b->vec[i]); ------------------ | | 181| 168|#define mlk_poly_add MLK_NAMESPACE(poly_add) | | ------------------ | | | | 63| 168|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 168|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 168|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 279| 168| } 280| 84|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_polyvec_tomont: 285| 28|{ 286| 28| unsigned i; 287| 84| for (i = 0; i < MLKEM_K; i++) ------------------ | | 13| 84|#define MLKEM_K 2 ------------------ | Branch (287:15): [True: 56, False: 28] ------------------ 288| 56| { 289| 56| mlk_poly_tomont(&r->vec[i]); ------------------ | | 102| 56|#define mlk_poly_tomont MLK_NAMESPACE(poly_tomont) | | ------------------ | | | | 63| 56|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 290| 56| } 291| | 292| 28| mlk_assert_abs_bound_2d(r->vec, MLKEM_K, MLKEM_N, MLKEM_Q); ------------------ | | 115| 28| do \ | | 116| 28| { \ | | 117| 28| } while (0) | | ------------------ | | | Branch (117:12): [Folded, False: 28] | | ------------------ ------------------ 293| 28|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_getnoise_eta1_4x: 337| 28|{ 338| 28| MLK_ALIGN uint8_t buf[4][MLK_ALIGN_UP(MLKEM_ETA1 * MLKEM_N / 4)]; ------------------ | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 339| 28| MLK_ALIGN uint8_t extkey[4][MLK_ALIGN_UP(MLKEM_SYMBYTES + 1)]; ------------------ | | 190| 28|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 340| 28| mlk_memcpy(extkey[0], seed, MLKEM_SYMBYTES); ------------------ | | 168| 28|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[0], seed, MLKEM_SYMBYTES); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 341| 28| mlk_memcpy(extkey[1], seed, MLKEM_SYMBYTES); ------------------ | | 168| 28|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[1], seed, MLKEM_SYMBYTES); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 342| 28| mlk_memcpy(extkey[2], seed, MLKEM_SYMBYTES); ------------------ | | 168| 28|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[2], seed, MLKEM_SYMBYTES); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 343| 28| mlk_memcpy(extkey[3], seed, MLKEM_SYMBYTES); ------------------ | | 168| 28|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[3], seed, MLKEM_SYMBYTES); ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 344| 28| extkey[0][MLKEM_SYMBYTES] = nonce0; ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 345| 28| extkey[1][MLKEM_SYMBYTES] = nonce1; ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 346| 28| extkey[2][MLKEM_SYMBYTES] = nonce2; ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 347| 28| extkey[3][MLKEM_SYMBYTES] = nonce3; ------------------ | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 348| | 349| 28|#if !defined(FIPS202_X4_DEFAULT_IMPLEMENTATION) && \ 350| 28| !defined(MLK_CONFIG_SERIAL_FIPS202_ONLY) 351| 28| mlk_prf_eta1_x4(buf, extkey); ------------------ | | 45| 28| mlk_shake256x4((OUT)[0], (OUT)[1], (OUT)[2], (OUT)[3], \ | | ------------------ | | | | 18| 28|#define mlk_shake256x4 shake256x4 | | | | ------------------ | | | | | | 36| 28|#define shake256x4 OQS_SHA3_shake256_x4 | | | | ------------------ | | ------------------ | | 46| 28| (MLKEM_ETA1 * MLKEM_N / 4), (IN)[0], (IN)[1], (IN)[2], \ | | ------------------ | | | | 39| 28|#define MLKEM_ETA1 3 | | ------------------ | | (MLKEM_ETA1 * MLKEM_N / 4), (IN)[0], (IN)[1], (IN)[2], \ | | ------------------ | | | | 22| 28|#define MLKEM_N 256 | | ------------------ | | 47| 28| (IN)[3], MLKEM_SYMBYTES + 1) | | ------------------ | | | | 27| 28|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ 352| |#else 353| | mlk_prf_eta1(buf[0], extkey[0]); 354| | mlk_prf_eta1(buf[1], extkey[1]); 355| | mlk_prf_eta1(buf[2], extkey[2]); 356| | if (r3 != NULL) 357| | { 358| | mlk_prf_eta1(buf[3], extkey[3]); 359| | } 360| |#endif /* !(!FIPS202_X4_DEFAULT_IMPLEMENTATION && \ 361| | !MLK_CONFIG_SERIAL_FIPS202_ONLY) */ 362| | 363| 28| mlk_poly_cbd_eta1(r0, buf[0]); ------------------ | | 36| 28|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 28|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 364| 28| mlk_poly_cbd_eta1(r1, buf[1]); ------------------ | | 36| 28|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 28|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 365| 28| mlk_poly_cbd_eta1(r2, buf[2]); ------------------ | | 36| 28|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 28|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 366| 28| if (r3 != NULL) ------------------ | Branch (366:7): [True: 28, False: 0] ------------------ 367| 28| { 368| 28| mlk_poly_cbd_eta1(r3, buf[3]); ------------------ | | 36| 28|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 28|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 369| 28| mlk_assert_abs_bound(r3, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 28| do \ | | 106| 28| { \ | | 107| 28| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 28] | | ------------------ ------------------ 370| 28| } 371| | 372| 28| mlk_assert_abs_bound(r0, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 28| do \ | | 106| 28| { \ | | 107| 28| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 28] | | ------------------ ------------------ 373| 28| mlk_assert_abs_bound(r1, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 28| do \ | | 106| 28| { \ | | 107| 28| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 28] | | ------------------ ------------------ 374| 28| mlk_assert_abs_bound(r2, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 28| do \ | | 106| 28| { \ | | 107| 28| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 28] | | ------------------ ------------------ 375| | 376| | /* Specification: Partially implements 377| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 378| 28| mlk_zeroize(buf, sizeof(buf)); 379| 28| mlk_zeroize(extkey, sizeof(extkey)); 380| 28|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_getnoise_eta2: 417| 56|{ 418| 56| MLK_ALIGN uint8_t buf[MLKEM_ETA2 * MLKEM_N / 4]; ------------------ | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 419| 56| MLK_ALIGN uint8_t extkey[MLKEM_SYMBYTES + 1]; ------------------ | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 420| | 421| 56| mlk_memcpy(extkey, seed, MLKEM_SYMBYTES); ------------------ | | 168| 56|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey, seed, MLKEM_SYMBYTES); ------------------ | | 27| 56|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 422| 56| extkey[MLKEM_SYMBYTES] = nonce; ------------------ | | 27| 56|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 423| 56| mlk_prf_eta2(buf, extkey); ------------------ | | 43| 56|#define mlk_prf_eta2(OUT, IN) mlk_prf_eta(MLKEM_ETA2, OUT, IN) | | ------------------ | | | | 41| 56| mlk_shake256(OUT, (ETA) * MLKEM_N / 4, IN, MLKEM_SYMBYTES + 1) | | | | ------------------ | | | | | | 18| 56|#define mlk_shake256 shake256 | | | | | | ------------------ | | | | | | | | 12| 56|#define shake256 OQS_SHA3_shake256 | | | | | | ------------------ | | | | ------------------ | | | | mlk_shake256(OUT, (ETA) * MLKEM_N / 4, IN, MLKEM_SYMBYTES + 1) | | | | ------------------ | | | | | | 22| 56|#define MLKEM_N 256 | | | | ------------------ | | | | mlk_shake256(OUT, (ETA) * MLKEM_N / 4, IN, MLKEM_SYMBYTES + 1) | | | | ------------------ | | | | | | 27| 56|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ ------------------ 424| | 425| 56| mlk_poly_cbd_eta2(r, buf); ------------------ | | 37| 56|#define mlk_poly_cbd_eta2 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta2) | | ------------------ | | | | 48| 56|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 426| | 427| 56| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_ETA2 + 1); ------------------ | | 105| 56| do \ | | 106| 56| { \ | | 107| 56| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 56] | | ------------------ ------------------ 428| | 429| | /* Specification: Partially implements 430| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 431| 56| mlk_zeroize(buf, sizeof(buf)); 432| 56| mlk_zeroize(extkey, sizeof(extkey)); 433| 56|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_getnoise_eta1122_4x: 450| 56|{ 451| |#if MLKEM_ETA2 >= MLKEM_ETA1 452| |#error mlk_poly_getnoise_eta1122_4x assumes MLKEM_ETA1 > MLKEM_ETA2 453| |#endif 454| 56| MLK_ALIGN uint8_t buf[4][MLK_ALIGN_UP(MLKEM_ETA1 * MLKEM_N / 4)]; ------------------ | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 455| 56| MLK_ALIGN uint8_t extkey[4][MLK_ALIGN_UP(MLKEM_SYMBYTES + 1)]; ------------------ | | 190| 56|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 456| | 457| 56| mlk_memcpy(extkey[0], seed, MLKEM_SYMBYTES); ------------------ | | 168| 56|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[0], seed, MLKEM_SYMBYTES); ------------------ | | 27| 56|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 458| 56| mlk_memcpy(extkey[1], seed, MLKEM_SYMBYTES); ------------------ | | 168| 56|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[1], seed, MLKEM_SYMBYTES); ------------------ | | 27| 56|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 459| 56| mlk_memcpy(extkey[2], seed, MLKEM_SYMBYTES); ------------------ | | 168| 56|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[2], seed, MLKEM_SYMBYTES); ------------------ | | 27| 56|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 460| 56| mlk_memcpy(extkey[3], seed, MLKEM_SYMBYTES); ------------------ | | 168| 56|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[3], seed, MLKEM_SYMBYTES); ------------------ | | 27| 56|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 461| 56| extkey[0][MLKEM_SYMBYTES] = nonce0; ------------------ | | 27| 56|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 462| 56| extkey[1][MLKEM_SYMBYTES] = nonce1; ------------------ | | 27| 56|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 463| 56| extkey[2][MLKEM_SYMBYTES] = nonce2; ------------------ | | 27| 56|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 464| 56| extkey[3][MLKEM_SYMBYTES] = nonce3; ------------------ | | 27| 56|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 465| | 466| | /* On systems with fast batched Keccak, we use 4-fold batched PRF, 467| | * even though that means generating more random data in buf[2] and buf[3] 468| | * than necessary. */ 469| 56|#if !defined(FIPS202_X4_DEFAULT_IMPLEMENTATION) && \ 470| 56| !defined(MLK_CONFIG_SERIAL_FIPS202_ONLY) 471| 56| mlk_prf_eta1_x4(buf, extkey); ------------------ | | 45| 56| mlk_shake256x4((OUT)[0], (OUT)[1], (OUT)[2], (OUT)[3], \ | | ------------------ | | | | 18| 56|#define mlk_shake256x4 shake256x4 | | | | ------------------ | | | | | | 36| 56|#define shake256x4 OQS_SHA3_shake256_x4 | | | | ------------------ | | ------------------ | | 46| 56| (MLKEM_ETA1 * MLKEM_N / 4), (IN)[0], (IN)[1], (IN)[2], \ | | ------------------ | | | | 39| 56|#define MLKEM_ETA1 3 | | ------------------ | | (MLKEM_ETA1 * MLKEM_N / 4), (IN)[0], (IN)[1], (IN)[2], \ | | ------------------ | | | | 22| 56|#define MLKEM_N 256 | | ------------------ | | 47| 56| (IN)[3], MLKEM_SYMBYTES + 1) | | ------------------ | | | | 27| 56|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ 472| |#else 473| | mlk_prf_eta1(buf[0], extkey[0]); 474| | mlk_prf_eta1(buf[1], extkey[1]); 475| | mlk_prf_eta2(buf[2], extkey[2]); 476| | mlk_prf_eta2(buf[3], extkey[3]); 477| |#endif /* !(!FIPS202_X4_DEFAULT_IMPLEMENTATION && \ 478| | !MLK_CONFIG_SERIAL_FIPS202_ONLY) */ 479| | 480| 56| mlk_poly_cbd_eta1(r0, buf[0]); ------------------ | | 36| 56|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 56|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 481| 56| mlk_poly_cbd_eta1(r1, buf[1]); ------------------ | | 36| 56|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 56|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 482| 56| mlk_poly_cbd_eta2(r2, buf[2]); ------------------ | | 37| 56|#define mlk_poly_cbd_eta2 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta2) | | ------------------ | | | | 48| 56|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 483| 56| mlk_poly_cbd_eta2(r3, buf[3]); ------------------ | | 37| 56|#define mlk_poly_cbd_eta2 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta2) | | ------------------ | | | | 48| 56|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 484| | 485| 56| mlk_assert_abs_bound(r0, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 56| do \ | | 106| 56| { \ | | 107| 56| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 56] | | ------------------ ------------------ 486| 56| mlk_assert_abs_bound(r1, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 56| do \ | | 106| 56| { \ | | 107| 56| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 56] | | ------------------ ------------------ 487| 56| mlk_assert_abs_bound(r2, MLKEM_N, MLKEM_ETA2 + 1); ------------------ | | 105| 56| do \ | | 106| 56| { \ | | 107| 56| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 56] | | ------------------ ------------------ 488| 56| mlk_assert_abs_bound(r3, MLKEM_N, MLKEM_ETA2 + 1); ------------------ | | 105| 56| do \ | | 106| 56| { \ | | 107| 56| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 56] | | ------------------ ------------------ 489| | 490| | /* Specification: Partially implements 491| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 492| 56| mlk_zeroize(buf, sizeof(buf)); 493| 56| mlk_zeroize(extkey, sizeof(extkey)); 494| 56|} poly_k.c:PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_compress_du: 69| 112|{ 70| 112|#if MLKEM_DU == 10 71| 112| mlk_poly_compress_d10(r, a); ------------------ | | 357| 112|#define mlk_poly_compress_d10 MLK_NAMESPACE(poly_compress_d10) | | ------------------ | | | | 63| 112|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 112|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 112|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 72| |#elif MLKEM_DU == 11 73| | mlk_poly_compress_d11(r, a); 74| |#else 75| |#error "Invalid value of MLKEM_DU" 76| |#endif 77| 112|} poly_k.c:PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_decompress_du: 102| 56|{ 103| 56|#if MLKEM_DU == 10 104| 56| mlk_poly_decompress_d10(r, a); ------------------ | | 400| 56|#define mlk_poly_decompress_d10 MLK_NAMESPACE(poly_decompress_d10) | | ------------------ | | | | 63| 56|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 105| |#elif MLKEM_DU == 11 106| | mlk_poly_decompress_d11(r, a); 107| |#else 108| |#error "Invalid value of MLKEM_DU" 109| |#endif 110| 56|} indcpa.c:PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_compress_dv: 132| 56|{ 133| 56|#if MLKEM_DV == 4 134| 56| mlk_poly_compress_d4(r, a); ------------------ | | 337| 56|#define mlk_poly_compress_d4 MLK_NAMESPACE(poly_compress_d4) | | ------------------ | | | | 63| 56|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 56|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 56|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 135| |#elif MLKEM_DV == 5 136| | mlk_poly_compress_d5(r, a); 137| |#else 138| |#error "Invalid value of MLKEM_DV" 139| |#endif 140| 56|} indcpa.c:PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_decompress_dv: 166| 28|{ 167| 28|#if MLKEM_DV == 4 168| 28| mlk_poly_decompress_d4(r, a); ------------------ | | 377| 28|#define mlk_poly_decompress_d4 MLK_NAMESPACE(poly_decompress_d4) | | ------------------ | | | | 63| 28|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 28|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 28|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 169| |#elif MLKEM_DV == 5 170| | mlk_poly_decompress_d5(r, a); 171| |#else 172| |#error "Invalid value of MLKEM_DV" 173| |#endif 174| 28|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_rej_uniform_x4: 158| 84|{ 159| | /* Temporary buffers for XOF output before rejection sampling */ 160| 84| MLK_ALIGN uint8_t ------------------ | | 190| 84|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 161| 84| buf[4][MLK_ALIGN_UP(MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE)]; 162| | 163| | /* Tracks the number of coefficients we have already sampled */ 164| 84| unsigned ctr[4]; 165| 84| mlk_xof_x4_ctx statex; ------------------ | | 51| 84|#define mlk_xof_x4_ctx mlk_shake128x4ctx | | ------------------ | | | | 13| 84|#define mlk_shake128x4ctx shake128x4ctx | | | | ------------------ | | | | | | 51| 84|#define shake128x4ctx shake128x4incctx | | | | | | ------------------ | | | | | | | | 18| 84|#define shake128x4incctx OQS_SHA3_shake128_x4_inc_ctx | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 166| 84| unsigned buflen; 167| | 168| 84| mlk_xof_x4_init(&statex); ------------------ | | 59| 84|#define mlk_xof_x4_init(CTX) mlk_shake128x4_init((CTX)) | | ------------------ | | | | 16| 84|#define mlk_shake128x4_init shake128x4_init | | | | ------------------ | | | | | | 52| 84|#define shake128x4_init shake128x4_inc_init | | | | | | ------------------ | | | | | | | | 19| 84|#define shake128x4_inc_init OQS_SHA3_shake128_x4_inc_init | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 169| 84| mlk_xof_x4_absorb(&statex, seed, MLKEM_SYMBYTES + 2); ------------------ | | 61| 84| mlk_shake128x4_absorb_once((CTX), (IN)[0], (IN)[1], (IN)[2], (IN)[3], \ | | ------------------ | | | | 14| 84|#define mlk_shake128x4_absorb_once shake128x4_absorb_once | | | | ------------------ | | | | | | 39| 84|#define shake128x4_absorb_once OQS_SHA3_shake128_x4_absorb_once | | | | ------------------ | | ------------------ | | 62| 84| (INBYTES)) ------------------ 170| | 171| | /* 172| | * Initially, squeeze heuristic number of MLKEM_GEN_MATRIX_NBLOCKS. 173| | * This should generate the matrix entries with high probability. 174| | */ 175| 84| mlk_xof_x4_squeezeblocks(buf, MLKEM_GEN_MATRIX_NBLOCKS, &statex); ------------------ | | 64| 84| mlk_shake128x4_squeezeblocks((BUF)[0], (BUF)[1], (BUF)[2], (BUF)[3], \ | | ------------------ | | | | 15| 84|#define mlk_shake128x4_squeezeblocks shake128x4_squeezeblocks | | | | ------------------ | | | | | | 46| 84| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | | | | | ------------------ | | | | | | | | 239| 84|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 65| 84| (NBLOCKS), (CTX)) ------------------ 176| 84| buflen = MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE; ------------------ | | 146| 84| ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 22| 84|#define MLKEM_N 256 | | ------------------ | | ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 23| 84|#define MLKEM_Q 3329 | | ------------------ | | ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 68| 84|#define MLK_XOF_RATE SHAKE128_RATE | | | | ------------------ | | | | | | 8| 84|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 84|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 147| 84| MLK_XOF_RATE) | | ------------------ | | | | 68| 84|#define MLK_XOF_RATE SHAKE128_RATE | | | | ------------------ | | | | | | 8| 84|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 84|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ buflen = MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE; ------------------ | | 68| 84|#define MLK_XOF_RATE SHAKE128_RATE | | ------------------ | | | | 8| 84|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | ------------------ | | | | | | 239| 84|#define OQS_SHA3_SHAKE128_RATE 168 | | | | ------------------ | | ------------------ ------------------ 177| 84| ctr[0] = mlk_rej_uniform(vec0->coeffs, MLKEM_N, 0, buf[0], buflen); ------------------ | | 22| 84|#define MLKEM_N 256 ------------------ 178| 84| ctr[1] = mlk_rej_uniform(vec1->coeffs, MLKEM_N, 0, buf[1], buflen); ------------------ | | 22| 84|#define MLKEM_N 256 ------------------ 179| 84| ctr[2] = mlk_rej_uniform(vec2->coeffs, MLKEM_N, 0, buf[2], buflen); ------------------ | | 22| 84|#define MLKEM_N 256 ------------------ 180| 84| ctr[3] = mlk_rej_uniform(vec3->coeffs, MLKEM_N, 0, buf[3], buflen); ------------------ | | 22| 84|#define MLKEM_N 256 ------------------ 181| | 182| | /* 183| | * So long as not all matrix entries have been generated, squeeze 184| | * one more block a time until we're done. 185| | */ 186| 84| buflen = MLK_XOF_RATE; ------------------ | | 68| 84|#define MLK_XOF_RATE SHAKE128_RATE | | ------------------ | | | | 8| 84|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | ------------------ | | | | | | 239| 84|#define OQS_SHA3_SHAKE128_RATE 168 | | | | ------------------ | | ------------------ ------------------ 187| 168| while (ctr[0] < MLKEM_N || ctr[1] < MLKEM_N || ctr[2] < MLKEM_N || ------------------ | | 22| 336|#define MLKEM_N 256 ------------------ while (ctr[0] < MLKEM_N || ctr[1] < MLKEM_N || ctr[2] < MLKEM_N || ------------------ | | 22| 312|#define MLKEM_N 256 ------------------ while (ctr[0] < MLKEM_N || ctr[1] < MLKEM_N || ctr[2] < MLKEM_N || ------------------ | | 22| 289|#define MLKEM_N 256 ------------------ | Branch (187:10): [True: 24, False: 144] | Branch (187:30): [True: 23, False: 121] | Branch (187:50): [True: 22, False: 99] ------------------ 188| 99| ctr[3] < MLKEM_N) ------------------ | | 22| 99|#define MLKEM_N 256 ------------------ | Branch (188:10): [True: 15, False: 84] ------------------ 189| 84| __loop__( 190| 84| assigns(ctr, statex, 191| 84| memory_slice(vec0, sizeof(mlk_poly)), 192| 84| memory_slice(vec1, sizeof(mlk_poly)), 193| 84| memory_slice(vec2, sizeof(mlk_poly)), 194| 84| memory_slice(vec3, sizeof(mlk_poly)), 195| 84| object_whole(buf)) 196| 84| invariant(ctr[0] <= MLKEM_N && ctr[1] <= MLKEM_N) 197| 84| invariant(ctr[2] <= MLKEM_N && ctr[3] <= MLKEM_N) 198| 84| invariant(array_bound(vec0->coeffs, 0, ctr[0], 0, MLKEM_Q)) 199| 84| invariant(array_bound(vec1->coeffs, 0, ctr[1], 0, MLKEM_Q)) 200| 84| invariant(array_bound(vec2->coeffs, 0, ctr[2], 0, MLKEM_Q)) 201| 84| invariant(array_bound(vec3->coeffs, 0, ctr[3], 0, MLKEM_Q))) 202| 84| { 203| 84| mlk_xof_x4_squeezeblocks(buf, 1, &statex); ------------------ | | 64| 84| mlk_shake128x4_squeezeblocks((BUF)[0], (BUF)[1], (BUF)[2], (BUF)[3], \ | | ------------------ | | | | 15| 84|#define mlk_shake128x4_squeezeblocks shake128x4_squeezeblocks | | | | ------------------ | | | | | | 46| 84| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | | | | | ------------------ | | | | | | | | 239| 84|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 65| 84| (NBLOCKS), (CTX)) ------------------ 204| 84| ctr[0] = mlk_rej_uniform(vec0->coeffs, MLKEM_N, ctr[0], buf[0], buflen); ------------------ | | 22| 84|#define MLKEM_N 256 ------------------ 205| 84| ctr[1] = mlk_rej_uniform(vec1->coeffs, MLKEM_N, ctr[1], buf[1], buflen); ------------------ | | 22| 84|#define MLKEM_N 256 ------------------ 206| 84| ctr[2] = mlk_rej_uniform(vec2->coeffs, MLKEM_N, ctr[2], buf[2], buflen); ------------------ | | 22| 84|#define MLKEM_N 256 ------------------ 207| 84| ctr[3] = mlk_rej_uniform(vec3->coeffs, MLKEM_N, ctr[3], buf[3], buflen); ------------------ | | 22| 84|#define MLKEM_N 256 ------------------ 208| 84| } 209| | 210| 84| mlk_xof_x4_release(&statex); ------------------ | | 66| 84|#define mlk_xof_x4_release(CTX) mlk_shake128x4_release((CTX)) | | ------------------ | | | | 17| 84|#define mlk_shake128x4_release shake128x4_release | | | | ------------------ | | | | | | 53| 84|#define shake128x4_release shake128x4_inc_ctx_release | | | | | | ------------------ | | | | | | | | 23| 84|#define shake128x4_inc_ctx_release OQS_SHA3_shake128_x4_inc_ctx_release | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 211| | 212| | /* Specification: Partially implements 213| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 214| 84| mlk_zeroize(buf, sizeof(buf)); 215| 84|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_cbd2: 276| 168|{ 277| 168| unsigned i; 278| 5.54k| for (i = 0; i < MLKEM_N / 8; i++) ------------------ | | 22| 5.54k|#define MLKEM_N 256 ------------------ | Branch (278:15): [True: 5.37k, False: 168] ------------------ 279| 5.37k| __loop__( 280| 5.37k| invariant(i <= MLKEM_N / 8) 281| 5.37k| invariant(array_abs_bound(r->coeffs, 0, 8 * i, 3)) 282| 5.37k| decreases(MLKEM_N / 8 - i)) 283| 5.37k| { 284| 5.37k| unsigned j; 285| 5.37k| uint32_t t = mlk_load32_littleendian(buf + 4 * i); 286| 5.37k| uint32_t d = t & 0x55555555; 287| 5.37k| d += (t >> 1) & 0x55555555; 288| | 289| 48.3k| for (j = 0; j < 8; j++) ------------------ | Branch (289:17): [True: 43.0k, False: 5.37k] ------------------ 290| 43.0k| __loop__( 291| 43.0k| invariant(i <= MLKEM_N / 8 && j <= 8) 292| 43.0k| invariant(array_abs_bound(r->coeffs, 0, 8 * i + j, 3)) 293| 43.0k| decreases(8 - j)) 294| 43.0k| { 295| | /* Safety: The & 0x3 masks each value to 2 bits (range [0, 3]), so the 296| | * truncation and subsequent subtraction in int16_t is lossless. */ 297| 43.0k| const int16_t a = (int16_t)((d >> (4 * j + 0)) & 0x3); 298| 43.0k| const int16_t b = (int16_t)((d >> (4 * j + 2)) & 0x3); 299| 43.0k| r->coeffs[8 * i + j] = (int16_t)(a - b); 300| 43.0k| } 301| 5.37k| } 302| 168|} PQCP_MLKEM_NATIVE_MLKEM512_X86_64_poly_cbd3: 329| 224|{ 330| 224| unsigned i; 331| 14.5k| for (i = 0; i < MLKEM_N / 4; i++) ------------------ | | 22| 14.5k|#define MLKEM_N 256 ------------------ | Branch (331:15): [True: 14.3k, False: 224] ------------------ 332| 14.3k| __loop__( 333| 14.3k| invariant(i <= MLKEM_N / 4) 334| 14.3k| invariant(array_abs_bound(r->coeffs, 0, 4 * i, 4)) 335| 14.3k| decreases(MLKEM_N / 4 - i)) 336| 14.3k| { 337| 14.3k| unsigned j; 338| 14.3k| const uint32_t t = mlk_load24_littleendian(buf + 3 * i); 339| 14.3k| uint32_t d = t & 0x00249249; 340| 14.3k| d += (t >> 1) & 0x00249249; 341| 14.3k| d += (t >> 2) & 0x00249249; 342| | 343| 71.6k| for (j = 0; j < 4; j++) ------------------ | Branch (343:17): [True: 57.3k, False: 14.3k] ------------------ 344| 57.3k| __loop__( 345| 57.3k| invariant(i <= MLKEM_N / 4 && j <= 4) 346| 57.3k| invariant(array_abs_bound(r->coeffs, 0, 4 * i + j, 4)) 347| 57.3k| decreases(4 - j)) 348| 57.3k| { 349| | /* Safety: The & 0x7 masks each value to 3 bits (range [0, 7]), so the 350| | * truncation and subsequent subtraction in int16_t is lossless. */ 351| 57.3k| const int16_t a = (int16_t)((d >> (6 * j + 0)) & 0x7); 352| 57.3k| const int16_t b = (int16_t)((d >> (6 * j + 3)) & 0x7); 353| 57.3k| r->coeffs[4 * i + j] = (int16_t)(a - b); 354| 57.3k| } 355| 14.3k| } 356| 224|} poly_k.c:mlk_sys_check_capability: 289| 1.03k|{ 290| | /* By default, we rely on compile-time feature detection/specification: 291| | * If a feature is enabled at compile-time, we assume it is supported by 292| | * the host that the resulting library/binary will be built on. 293| | * If this assumption is not true, you MUST overwrite this function. 294| | * See the documentation of MLK_CONFIG_CUSTOM_CAPABILITY_FUNC in 295| | * mlkem_native_config.h for more information. */ 296| 1.03k| (void)cap; 297| 1.03k| return 1; 298| 1.03k|} sampling.c:mlk_sys_check_capability: 289| 2.49k|{ 290| | /* By default, we rely on compile-time feature detection/specification: 291| | * If a feature is enabled at compile-time, we assume it is supported by 292| | * the host that the resulting library/binary will be built on. 293| | * If this assumption is not true, you MUST overwrite this function. 294| | * See the documentation of MLK_CONFIG_CUSTOM_CAPABILITY_FUNC in 295| | * mlkem_native_config.h for more information. */ 296| 2.49k| (void)cap; 297| 2.49k| return 1; 298| 2.49k|} compress.c:mlk_sys_check_capability: 289| 2.83k|{ 290| | /* By default, we rely on compile-time feature detection/specification: 291| | * If a feature is enabled at compile-time, we assume it is supported by 292| | * the host that the resulting library/binary will be built on. 293| | * If this assumption is not true, you MUST overwrite this function. 294| | * See the documentation of MLK_CONFIG_CUSTOM_CAPABILITY_FUNC in 295| | * mlkem_native_config.h for more information. */ 296| 2.83k| (void)cap; 297| 2.83k| return 1; 298| 2.83k|} indcpa.c:mlk_sys_check_capability: 289| 2.49k|{ 290| | /* By default, we rely on compile-time feature detection/specification: 291| | * If a feature is enabled at compile-time, we assume it is supported by 292| | * the host that the resulting library/binary will be built on. 293| | * If this assumption is not true, you MUST overwrite this function. 294| | * See the documentation of MLK_CONFIG_CUSTOM_CAPABILITY_FUNC in 295| | * mlkem_native_config.h for more information. */ 296| 2.49k| (void)cap; 297| 2.49k| return 1; 298| 2.49k|} poly.c:mlk_sys_check_capability: 289| 4.90k|{ 290| | /* By default, we rely on compile-time feature detection/specification: 291| | * If a feature is enabled at compile-time, we assume it is supported by 292| | * the host that the resulting library/binary will be built on. 293| | * If this assumption is not true, you MUST overwrite this function. 294| | * See the documentation of MLK_CONFIG_CUSTOM_CAPABILITY_FUNC in 295| | * mlkem_native_config.h for more information. */ 296| 4.90k| (void)cap; 297| 4.90k| return 1; 298| 4.90k|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_compress_d4: 80| 60|{ 81| 60|#if defined(MLK_USE_NATIVE_POLY_COMPRESS_D4) 82| 60| int ret; 83| 60| mlk_assert_bound(a, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 60| do \ | | 102| 60| { \ | | 103| 60| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 60] | | ------------------ ------------------ 84| 60| ret = mlk_poly_compress_d4_native(r, a->coeffs); 85| 60| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 60|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (85:7): [True: 60, False: 0] ------------------ 86| 60| { 87| 60| return; 88| 60| } 89| 0|#endif /* MLK_USE_NATIVE_POLY_COMPRESS_D4 */ 90| | 91| 0| mlk_poly_compress_d4_c(r, a); 92| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_compress_d10: 147| 180|{ 148| 180|#if defined(MLK_USE_NATIVE_POLY_COMPRESS_D10) 149| 180| int ret; 150| 180| mlk_assert_bound(a, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 180| do \ | | 102| 180| { \ | | 103| 180| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 180] | | ------------------ ------------------ 151| 180| ret = mlk_poly_compress_d10_native(r, a->coeffs); 152| 180| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 180|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (152:7): [True: 180, False: 0] ------------------ 153| 180| { 154| 180| return; 155| 180| } 156| 0|#endif /* MLK_USE_NATIVE_POLY_COMPRESS_D10 */ 157| | 158| 0| mlk_poly_compress_d10_c(r, a); 159| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_decompress_d4: 195| 30|{ 196| 30|#if defined(MLK_USE_NATIVE_POLY_DECOMPRESS_D4) 197| 30| int ret; 198| 30| ret = mlk_poly_decompress_d4_native(r->coeffs, a); 199| 30| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 30|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (199:7): [True: 30, False: 0] ------------------ 200| 30| { 201| 30| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 30| do \ | | 102| 30| { \ | | 103| 30| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 30] | | ------------------ ------------------ 202| 30| return; 203| 30| } 204| 0|#endif /* MLK_USE_NATIVE_POLY_DECOMPRESS_D4 */ 205| | 206| 0| mlk_poly_decompress_d4_c(r, a); 207| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_decompress_d10: 258| 90|{ 259| 90|#if defined(MLK_USE_NATIVE_POLY_DECOMPRESS_D10) 260| 90| int ret; 261| 90| ret = mlk_poly_decompress_d10_native(r->coeffs, a); 262| 90| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 90|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (262:7): [True: 90, False: 0] ------------------ 263| 90| { 264| 90| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 90| do \ | | 102| 90| { \ | | 103| 90| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 90] | | ------------------ ------------------ 265| 90| return; 266| 90| } 267| 0|#endif /* MLK_USE_NATIVE_POLY_DECOMPRESS_D10 */ 268| | 269| 0| mlk_poly_decompress_d10_c(r, a); 270| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_tobytes: 610| 270|{ 611| 270|#if defined(MLK_USE_NATIVE_POLY_TOBYTES) 612| 270| int ret; 613| 270| mlk_assert_bound(a, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 270| do \ | | 102| 270| { \ | | 103| 270| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 270] | | ------------------ ------------------ 614| 270| ret = mlk_poly_tobytes_native(r, a->coeffs); 615| 270| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 270|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (615:7): [True: 270, False: 0] ------------------ 616| 270| { 617| 270| return; 618| 270| } 619| 0|#endif /* MLK_USE_NATIVE_POLY_TOBYTES */ 620| | 621| 0| mlk_poly_tobytes_c(r, a); 622| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_frombytes: 659| 360|{ 660| 360|#if defined(MLK_USE_NATIVE_POLY_FROMBYTES) 661| 360| int ret; 662| 360| ret = mlk_poly_frombytes_native(r->coeffs, a); 663| 360| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 360|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (663:7): [True: 360, False: 0] ------------------ 664| 360| { 665| 360| return; 666| 360| } 667| 0|#endif /* MLK_USE_NATIVE_POLY_FROMBYTES */ 668| | 669| 0| mlk_poly_frombytes_c(r, a); 670| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_frommsg: 680| 60|{ 681| 60| unsigned i; 682| |#if (MLKEM_INDCPA_MSGBYTES != MLKEM_N / 8) 683| |#error "MLKEM_INDCPA_MSGBYTES must be equal to MLKEM_N/8 bytes!" 684| |#endif 685| | 686| 1.98k| for (i = 0; i < MLKEM_N / 8; i++) ------------------ | | 22| 1.98k|#define MLKEM_N 256 ------------------ | Branch (686:15): [True: 1.92k, False: 60] ------------------ 687| 1.92k| __loop__( 688| 1.92k| invariant(i <= MLKEM_N / 8) 689| 1.92k| invariant(array_bound(r->coeffs, 0, 8 * i, 0, MLKEM_Q)) 690| 1.92k| decreases(MLKEM_N / 8 - i)) 691| 1.92k| { 692| 1.92k| unsigned j; 693| 17.2k| for (j = 0; j < 8; j++) ------------------ | Branch (693:17): [True: 15.3k, False: 1.92k] ------------------ 694| 15.3k| __loop__( 695| 15.3k| invariant(i < MLKEM_N / 8 && j <= 8) 696| 15.3k| invariant(array_bound(r->coeffs, 0, 8 * i + j, 0, MLKEM_Q)) 697| 15.3k| decreases(8 - j)) 698| 15.3k| { 699| | /* mlk_ct_sel_int16(MLKEM_Q_HALF, 0, b) is `Decompress_1(b != 0)` 700| | * as per @[FIPS203, Eq (4.8)]. */ 701| | 702| | /* Prevent the compiler from recognizing this as a bit selection */ 703| 15.3k| uint8_t mask = mlk_value_barrier_u8((uint8_t)(1u << j)); 704| 15.3k| r->coeffs[8 * i + j] = mlk_ct_sel_int16(MLKEM_Q_HALF, 0, msg[i] & mask); ------------------ | | 24| 15.3k|#define MLKEM_Q_HALF ((MLKEM_Q + 1) / 2) /* 1665 */ | | ------------------ | | | | 23| 15.3k|#define MLKEM_Q 3329 | | ------------------ ------------------ 705| 15.3k| } 706| 1.92k| } 707| 60| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_Q); ------------------ | | 105| 60| do \ | | 106| 60| { \ | | 107| 60| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 60] | | ------------------ ------------------ 708| 60|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_tomsg: 718| 30|{ 719| 30| unsigned i; 720| 30| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 30| do \ | | 102| 30| { \ | | 103| 30| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 30] | | ------------------ ------------------ 721| | 722| 990| for (i = 0; i < MLKEM_N / 8; i++) ------------------ | | 22| 990|#define MLKEM_N 256 ------------------ | Branch (722:15): [True: 960, False: 30] ------------------ 723| 960| __loop__(invariant(i <= MLKEM_N / 8) 724| 960| decreases(MLKEM_N / 8 - i)) 725| 960| { 726| 960| unsigned j; 727| 960| msg[i] = 0; 728| 8.64k| for (j = 0; j < 8; j++) ------------------ | Branch (728:17): [True: 7.68k, False: 960] ------------------ 729| 7.68k| __loop__( 730| 7.68k| invariant(i <= MLKEM_N / 8 && j <= 8) 731| 7.68k| decreases(8 - j)) 732| 7.68k| { 733| 7.68k| uint32_t t = mlk_scalar_compress_d1(r->coeffs[8 * i + j]); 734| 7.68k| msg[i] |= (uint8_t)(t << j); 735| 7.68k| } 736| 960| } 737| 30|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_gen_matrix: 223| 90|{ 224| 90| unsigned i, j; 225| 90| MLK_ALIGN uint8_t seed_ext[4][MLK_ALIGN_UP(MLKEM_SYMBYTES + 2)]; ------------------ | | 190| 90|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 226| | 227| 450| for (j = 0; j < 4; j++) ------------------ | Branch (227:15): [True: 360, False: 90] ------------------ 228| 360| { 229| 360| mlk_memcpy(seed_ext[j], seed, MLKEM_SYMBYTES); ------------------ | | 168| 360|#define mlk_memcpy memcpy ------------------ mlk_memcpy(seed_ext[j], seed, MLKEM_SYMBYTES); ------------------ | | 27| 360|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 230| 360| } 231| | 232| 90|#if !defined(MLK_CONFIG_SERIAL_FIPS202_ONLY) 233| | /* Sample 4 matrix entries a time. */ 234| 270| for (i = 0; i < (MLKEM_K * MLKEM_K / 4) * 4; i += 4) ------------------ | | 15| 270|#define MLKEM_K 3 ------------------ for (i = 0; i < (MLKEM_K * MLKEM_K / 4) * 4; i += 4) ------------------ | | 15| 270|#define MLKEM_K 3 ------------------ | Branch (234:15): [True: 180, False: 90] ------------------ 235| 180| { 236| 900| for (j = 0; j < 4; j++) ------------------ | Branch (236:17): [True: 720, False: 180] ------------------ 237| 720| { 238| 720| uint8_t x, y; 239| | /* MLKEM_K <= 4, so the values fit in uint8_t. */ 240| 720| x = (uint8_t)((i + j) / MLKEM_K); ------------------ | | 15| 720|#define MLKEM_K 3 ------------------ 241| 720| y = (uint8_t)((i + j) % MLKEM_K); ------------------ | | 15| 720|#define MLKEM_K 3 ------------------ 242| 720| if (transposed) ------------------ | Branch (242:11): [True: 480, False: 240] ------------------ 243| 480| { 244| 480| seed_ext[j][MLKEM_SYMBYTES + 0] = x; ------------------ | | 27| 480|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 245| 480| seed_ext[j][MLKEM_SYMBYTES + 1] = y; ------------------ | | 27| 480|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 246| 480| } 247| 240| else 248| 240| { 249| 240| seed_ext[j][MLKEM_SYMBYTES + 0] = y; ------------------ | | 27| 240|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 250| 240| seed_ext[j][MLKEM_SYMBYTES + 1] = x; ------------------ | | 27| 240|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 251| 240| } 252| 720| } 253| | 254| 180| mlk_poly_rej_uniform_x4(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], ------------------ | | 55| 180|#define mlk_poly_rej_uniform_x4 MLK_NAMESPACE(poly_rej_uniform_x4) | | ------------------ | | | | 63| 180|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 180|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 180|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_rej_uniform_x4(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], ------------------ | | 15| 180|#define MLKEM_K 3 ------------------ mlk_poly_rej_uniform_x4(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], ------------------ | | 15| 180|#define MLKEM_K 3 ------------------ 255| 180| &a->vec[(i + 1) / MLKEM_K].vec[(i + 1) % MLKEM_K], ------------------ | | 15| 180|#define MLKEM_K 3 ------------------ &a->vec[(i + 1) / MLKEM_K].vec[(i + 1) % MLKEM_K], ------------------ | | 15| 180|#define MLKEM_K 3 ------------------ 256| 180| &a->vec[(i + 2) / MLKEM_K].vec[(i + 2) % MLKEM_K], ------------------ | | 15| 180|#define MLKEM_K 3 ------------------ &a->vec[(i + 2) / MLKEM_K].vec[(i + 2) % MLKEM_K], ------------------ | | 15| 180|#define MLKEM_K 3 ------------------ 257| 180| &a->vec[(i + 3) / MLKEM_K].vec[(i + 3) % MLKEM_K], ------------------ | | 15| 180|#define MLKEM_K 3 ------------------ &a->vec[(i + 3) / MLKEM_K].vec[(i + 3) % MLKEM_K], ------------------ | | 15| 180|#define MLKEM_K 3 ------------------ 258| 180| seed_ext); 259| 180| } 260| |#else /* !MLK_CONFIG_SERIAL_FIPS202_ONLY */ 261| | /* When using serial FIPS202, sample all entries individually. */ 262| | i = 0; 263| |#endif /* MLK_CONFIG_SERIAL_FIPS202_ONLY */ 264| | 265| | /* For MLKEM_K == 3, sample the last entry individually. 266| | * When MLK_CONFIG_SERIAL_FIPS202_ONLY is set, sample all entries 267| | * individually. */ 268| 180| for (; i < MLKEM_K * MLKEM_K; i++) ------------------ | | 15| 180|#define MLKEM_K 3 ------------------ for (; i < MLKEM_K * MLKEM_K; i++) ------------------ | | 15| 180|#define MLKEM_K 3 ------------------ | Branch (268:10): [True: 90, False: 90] ------------------ 269| 90| { 270| 90| uint8_t x, y; 271| | /* MLKEM_K <= 4, so the values fit in uint8_t. */ 272| 90| x = (uint8_t)(i / MLKEM_K); ------------------ | | 15| 90|#define MLKEM_K 3 ------------------ 273| 90| y = (uint8_t)(i % MLKEM_K); ------------------ | | 15| 90|#define MLKEM_K 3 ------------------ 274| | 275| 90| if (transposed) ------------------ | Branch (275:9): [True: 60, False: 30] ------------------ 276| 60| { 277| 60| seed_ext[0][MLKEM_SYMBYTES + 0] = x; ------------------ | | 27| 60|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 278| 60| seed_ext[0][MLKEM_SYMBYTES + 1] = y; ------------------ | | 27| 60|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 279| 60| } 280| 30| else 281| 30| { 282| 30| seed_ext[0][MLKEM_SYMBYTES + 0] = y; ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 283| 30| seed_ext[0][MLKEM_SYMBYTES + 1] = x; ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 284| 30| } 285| | 286| 90| mlk_poly_rej_uniform(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], seed_ext[0]); ------------------ | | 89| 90|#define mlk_poly_rej_uniform MLK_NAMESPACE(poly_rej_uniform) | | ------------------ | | | | 63| 90|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 90|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 90|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_rej_uniform(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], seed_ext[0]); ------------------ | | 15| 90|#define MLKEM_K 3 ------------------ mlk_poly_rej_uniform(&a->vec[i / MLKEM_K].vec[i % MLKEM_K], seed_ext[0]); ------------------ | | 15| 90|#define MLKEM_K 3 ------------------ 287| 90| } 288| | 289| 90| mlk_assert(i == MLKEM_K * MLKEM_K); ------------------ | | 97| 90| do \ | | 98| 90| { \ | | 99| 90| } while (0) | | ------------------ | | | Branch (99:12): [Folded, False: 90] | | ------------------ ------------------ 290| | 291| | /* 292| | * The public matrix is generated in NTT domain. If the native backend 293| | * uses a custom order in NTT domain, permute A accordingly. 294| | */ 295| 90| mlk_polymat_permute_bitrev_to_custom(a); ------------------ | | 42| 90| MLK_ADD_PARAM_SET(mlk_polymat_permute_bitrev_to_custom) | | ------------------ | | | | 48| 90|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 296| | 297| | /* Specification: Partially implements 298| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 299| 90| mlk_zeroize(seed_ext, sizeof(seed_ext)); 300| 90|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_indcpa_keypair_derand: 445| 30|{ 446| 30| int ret = 0; 447| 30| const uint8_t *publicseed; 448| 30| const uint8_t *noiseseed; 449| 30| MLK_ALLOC(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 450| 30| MLK_ALLOC(coins_with_domain_separator, uint8_t, MLKEM_SYMBYTES + 1, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 451| 30| MLK_ALLOC(a, mlk_polymat, 1, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 452| 30| MLK_ALLOC(e, mlk_polyvec, 1, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 453| 30| MLK_ALLOC(pkpv, mlk_polyvec, 1, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 454| 30| MLK_ALLOC(skpv, mlk_polyvec, 1, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 455| 30| MLK_ALLOC(skpv_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 456| | 457| 30| if (buf == NULL || coins_with_domain_separator == NULL || a == NULL || ------------------ | Branch (457:7): [True: 0, False: 30] | Branch (457:22): [True: 0, False: 30] | Branch (457:61): [True: 0, False: 30] ------------------ 458| 30| e == NULL || pkpv == NULL || skpv == NULL || skpv_cache == NULL) ------------------ | Branch (458:7): [True: 0, False: 30] | Branch (458:20): [True: 0, False: 30] | Branch (458:36): [True: 0, False: 30] | Branch (458:52): [True: 0, False: 30] ------------------ 459| 0| { 460| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 461| 0| goto cleanup; 462| 0| } 463| | 464| 30| publicseed = buf; 465| 30| noiseseed = buf + MLKEM_SYMBYTES; ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 466| | 467| | /* Concatenate coins with MLKEM_K for domain separation of security levels */ 468| 30| mlk_memcpy(coins_with_domain_separator, coins, MLKEM_SYMBYTES); ------------------ | | 168| 30|#define mlk_memcpy memcpy ------------------ mlk_memcpy(coins_with_domain_separator, coins, MLKEM_SYMBYTES); ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 469| 30| coins_with_domain_separator[MLKEM_SYMBYTES] = MLKEM_K; ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ coins_with_domain_separator[MLKEM_SYMBYTES] = MLKEM_K; ------------------ | | 15| 30|#define MLKEM_K 3 ------------------ 470| | 471| 30| mlk_hash_g(buf, coins_with_domain_separator, MLKEM_SYMBYTES + 1); ------------------ | | 32| 30|#define mlk_hash_g(OUT, IN, INBYTES) mlk_sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 20| 30|#define mlk_sha3_512 sha3_512 | | | | ------------------ | | | | | | 31| 30|#define sha3_512 OQS_SHA3_sha3_512 | | | | ------------------ | | ------------------ ------------------ 472| | 473| | /* 474| | * Declassify the public seed. 475| | * Required to use it in conditional-branches in rejection sampling. 476| | * This is needed because all output of randombytes is marked as secret 477| | * (=undefined) 478| | */ 479| 30| MLK_CT_TESTING_DECLASSIFY(publicseed, MLKEM_SYMBYTES); ------------------ | | 235| 30| do \ | | 236| 30| { \ | | 237| 30| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 30] | | ------------------ ------------------ 480| | 481| 30| mlk_gen_matrix(a, publicseed, 0 /* no transpose */); ------------------ | | 22| 30|#define mlk_gen_matrix MLK_NAMESPACE_K(gen_matrix) | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 482| | 483| 30| mlk_keypair_getnoise_eta1(skpv, e, noiseseed); ------------------ | | 43| 30|#define mlk_keypair_getnoise_eta1 MLK_ADD_PARAM_SET(mlk_keypair_getnoise_eta1) | | ------------------ | | | | 48| 30|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 484| | 485| 30| mlk_polyvec_ntt(skpv); ------------------ | | 269| 30|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 486| 30| mlk_polyvec_ntt(e); ------------------ | | 269| 30|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 487| | 488| 30| mlk_polyvec_mulcache_compute(skpv_cache, skpv); ------------------ | | 353| 30|#define mlk_polyvec_mulcache_compute MLK_NAMESPACE_K(polyvec_mulcache_compute) | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 489| 30| mlk_matvec_mul(pkpv, a, skpv, skpv_cache); ------------------ | | 38| 30|#define mlk_matvec_mul MLK_ADD_PARAM_SET(mlk_matvec_mul) | | ------------------ | | | | 48| 30|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 490| 30| mlk_polyvec_tomont(pkpv); ------------------ | | 445| 30|#define mlk_polyvec_tomont MLK_NAMESPACE_K(polyvec_tomont) | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 491| | 492| 30| mlk_polyvec_add(pkpv, e); ------------------ | | 414| 30|#define mlk_polyvec_add MLK_NAMESPACE_K(polyvec_add) | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 493| 30| mlk_polyvec_reduce(pkpv); ------------------ | | 387| 30|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 494| 30| mlk_polyvec_reduce(skpv); ------------------ | | 387| 30|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 495| | 496| 30| mlk_pack_sk(sk, skpv); ------------------ | | 34| 30|#define mlk_pack_sk MLK_ADD_PARAM_SET(mlk_pack_sk) | | ------------------ | | | | 48| 30|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 497| 30| mlk_pack_pk(pk, pkpv, publicseed); ------------------ | | 32| 30|#define mlk_pack_pk MLK_ADD_PARAM_SET(mlk_pack_pk) | | ------------------ | | | | 48| 30|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 498| | 499| 30|cleanup: 500| | /* Specification: Partially implements 501| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 502| 30| MLK_FREE(skpv_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 503| 30| MLK_FREE(skpv, mlk_polyvec, 1, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 504| 30| MLK_FREE(pkpv, mlk_polyvec, 1, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 505| 30| MLK_FREE(e, mlk_polyvec, 1, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 506| 30| MLK_FREE(a, mlk_polymat, 1, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 507| 30| MLK_FREE(coins_with_domain_separator, uint8_t, MLKEM_SYMBYTES + 1, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 508| | MLK_FREE(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 509| 30| return ret; 510| 30|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_indcpa_enc: 526| 60|{ 527| 60| int ret = 0; 528| 60| MLK_ALLOC(seed, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 229| 60| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 60|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 60| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 529| 60| MLK_ALLOC(at, mlk_polymat, 1, context); ------------------ | | 229| 60| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 60|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 60| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 530| 60| MLK_ALLOC(sp, mlk_polyvec, 1, context); ------------------ | | 229| 60| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 60|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 60| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 531| 60| MLK_ALLOC(pkpv, mlk_polyvec, 1, context); ------------------ | | 229| 60| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 60|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 60| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 532| 60| MLK_ALLOC(ep, mlk_polyvec, 1, context); ------------------ | | 229| 60| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 60|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 60| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 533| 60| MLK_ALLOC(b, mlk_polyvec, 1, context); ------------------ | | 229| 60| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 60|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 60| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 534| 60| MLK_ALLOC(v, mlk_poly, 1, context); ------------------ | | 229| 60| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 60|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 60| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 535| 60| MLK_ALLOC(k, mlk_poly, 1, context); ------------------ | | 229| 60| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 60|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 60| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 536| 60| MLK_ALLOC(epp, mlk_poly, 1, context); ------------------ | | 229| 60| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 60|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 60| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 537| 60| MLK_ALLOC(sp_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 229| 60| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 60|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 60| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 538| | 539| 60| if (seed == NULL || at == NULL || sp == NULL || pkpv == NULL || ep == NULL || ------------------ | Branch (539:7): [True: 0, False: 60] | Branch (539:23): [True: 0, False: 60] | Branch (539:37): [True: 0, False: 60] | Branch (539:51): [True: 0, False: 60] | Branch (539:67): [True: 0, False: 60] ------------------ 540| 60| b == NULL || v == NULL || k == NULL || epp == NULL || sp_cache == NULL) ------------------ | Branch (540:7): [True: 0, False: 60] | Branch (540:20): [True: 0, False: 60] | Branch (540:33): [True: 0, False: 60] | Branch (540:46): [True: 0, False: 60] | Branch (540:61): [True: 0, False: 60] ------------------ 541| 0| { 542| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 543| 0| goto cleanup; 544| 0| } 545| | 546| 60| mlk_unpack_pk(pkpv, seed, pk); ------------------ | | 33| 60|#define mlk_unpack_pk MLK_ADD_PARAM_SET(mlk_unpack_pk) | | ------------------ | | | | 48| 60|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 547| 60| mlk_poly_frommsg(k, m); ------------------ | | 555| 60|#define mlk_poly_frommsg MLK_NAMESPACE(poly_frommsg) | | ------------------ | | | | 63| 60|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 60|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 60|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 548| | 549| | /* 550| | * Declassify the public seed. 551| | * Required to use it in conditional-branches in rejection sampling. 552| | * This is needed because in re-encryption the publicseed originated from sk 553| | * which is marked undefined. 554| | */ 555| 60| MLK_CT_TESTING_DECLASSIFY(seed, MLKEM_SYMBYTES); ------------------ | | 235| 60| do \ | | 236| 60| { \ | | 237| 60| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 60] | | ------------------ ------------------ 556| | 557| 60| mlk_gen_matrix(at, seed, 1 /* transpose */); ------------------ | | 22| 60|#define mlk_gen_matrix MLK_NAMESPACE_K(gen_matrix) | | ------------------ | | | | 64| 60|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 60|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 60|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 558| | 559| 60| mlk_enc_getnoise_eta1_eta2(sp, ep, epp, coins); ------------------ | | 44| 60|#define mlk_enc_getnoise_eta1_eta2 MLK_ADD_PARAM_SET(mlk_enc_getnoise_eta1_eta2) | | ------------------ | | | | 48| 60|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 560| | 561| 60| mlk_polyvec_ntt(sp); ------------------ | | 269| 60|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 60|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 60|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 60|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 562| | 563| 60| mlk_polyvec_mulcache_compute(sp_cache, sp); ------------------ | | 353| 60|#define mlk_polyvec_mulcache_compute MLK_NAMESPACE_K(polyvec_mulcache_compute) | | ------------------ | | | | 64| 60|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 60|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 60|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 564| 60| mlk_matvec_mul(b, at, sp, sp_cache); ------------------ | | 38| 60|#define mlk_matvec_mul MLK_ADD_PARAM_SET(mlk_matvec_mul) | | ------------------ | | | | 48| 60|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 565| 60| mlk_polyvec_basemul_acc_montgomery_cached(v, pkpv, sp, sp_cache); ------------------ | | 321| 60| MLK_NAMESPACE_K(polyvec_basemul_acc_montgomery_cached) | | ------------------ | | | | 64| 60|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 60|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 60|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 566| | 567| 60| mlk_polyvec_invntt_tomont(b); ------------------ | | 295| 60|#define mlk_polyvec_invntt_tomont MLK_NAMESPACE_K(polyvec_invntt_tomont) | | ------------------ | | | | 64| 60|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 60|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 60|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 568| 60| mlk_poly_invntt_tomont(v); ------------------ | | 263| 60|#define mlk_poly_invntt_tomont MLK_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 63| 60|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 60|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 60|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 569| | 570| 60| mlk_polyvec_add(b, ep); ------------------ | | 414| 60|#define mlk_polyvec_add MLK_NAMESPACE_K(polyvec_add) | | ------------------ | | | | 64| 60|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 60|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 60|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 571| 60| mlk_poly_add(v, epp); ------------------ | | 181| 60|#define mlk_poly_add MLK_NAMESPACE(poly_add) | | ------------------ | | | | 63| 60|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 60|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 60|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 572| 60| mlk_poly_add(v, k); ------------------ | | 181| 60|#define mlk_poly_add MLK_NAMESPACE(poly_add) | | ------------------ | | | | 63| 60|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 60|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 60|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 573| | 574| 60| mlk_polyvec_reduce(b); ------------------ | | 387| 60|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 60|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 60|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 60|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 575| 60| mlk_poly_reduce(v); ------------------ | | 154| 60|#define mlk_poly_reduce MLK_NAMESPACE(poly_reduce) | | ------------------ | | | | 63| 60|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 60|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 60|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 576| | 577| 60| mlk_pack_ciphertext(c, b, v); ------------------ | | 36| 60|#define mlk_pack_ciphertext MLK_ADD_PARAM_SET(mlk_pack_ciphertext) | | ------------------ | | | | 48| 60|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 578| | 579| 60|cleanup: 580| | /* Specification: Partially implements 581| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 582| 60| MLK_FREE(sp_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 238| 60| do \ | | 239| 60| { \ | | 240| 60| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 60| (v) = NULL; \ | | 242| 60| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 60] | | ------------------ ------------------ 583| 60| MLK_FREE(epp, mlk_poly, 1, context); ------------------ | | 238| 60| do \ | | 239| 60| { \ | | 240| 60| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 60| (v) = NULL; \ | | 242| 60| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 60] | | ------------------ ------------------ 584| 60| MLK_FREE(k, mlk_poly, 1, context); ------------------ | | 238| 60| do \ | | 239| 60| { \ | | 240| 60| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 60| (v) = NULL; \ | | 242| 60| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 60] | | ------------------ ------------------ 585| 60| MLK_FREE(v, mlk_poly, 1, context); ------------------ | | 238| 60| do \ | | 239| 60| { \ | | 240| 60| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 60| (v) = NULL; \ | | 242| 60| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 60] | | ------------------ ------------------ 586| 60| MLK_FREE(b, mlk_polyvec, 1, context); ------------------ | | 238| 60| do \ | | 239| 60| { \ | | 240| 60| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 60| (v) = NULL; \ | | 242| 60| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 60] | | ------------------ ------------------ 587| 60| MLK_FREE(ep, mlk_polyvec, 1, context); ------------------ | | 238| 60| do \ | | 239| 60| { \ | | 240| 60| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 60| (v) = NULL; \ | | 242| 60| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 60] | | ------------------ ------------------ 588| 60| MLK_FREE(pkpv, mlk_polyvec, 1, context); ------------------ | | 238| 60| do \ | | 239| 60| { \ | | 240| 60| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 60| (v) = NULL; \ | | 242| 60| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 60] | | ------------------ ------------------ 589| 60| MLK_FREE(sp, mlk_polyvec, 1, context); ------------------ | | 238| 60| do \ | | 239| 60| { \ | | 240| 60| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 60| (v) = NULL; \ | | 242| 60| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 60] | | ------------------ ------------------ 590| 60| MLK_FREE(at, mlk_polymat, 1, context); ------------------ | | 238| 60| do \ | | 239| 60| { \ | | 240| 60| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 60| (v) = NULL; \ | | 242| 60| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 60] | | ------------------ ------------------ 591| | MLK_FREE(seed, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 238| 60| do \ | | 239| 60| { \ | | 240| 60| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 60| (v) = NULL; \ | | 242| 60| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 60] | | ------------------ ------------------ 592| 60| return ret; 593| 60|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_indcpa_dec: 603| 30|{ 604| 30| int ret = 0; 605| 30| MLK_ALLOC(b, mlk_polyvec, 1, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 606| 30| MLK_ALLOC(skpv, mlk_polyvec, 1, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 607| 30| MLK_ALLOC(v, mlk_poly, 1, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 608| 30| MLK_ALLOC(sb, mlk_poly, 1, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 609| 30| MLK_ALLOC(b_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 610| | 611| 30| if (b == NULL || skpv == NULL || v == NULL || sb == NULL || b_cache == NULL) ------------------ | Branch (611:7): [True: 0, False: 30] | Branch (611:20): [True: 0, False: 30] | Branch (611:36): [True: 0, False: 30] | Branch (611:49): [True: 0, False: 30] | Branch (611:63): [True: 0, False: 30] ------------------ 612| 0| { 613| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 614| 0| goto cleanup; 615| 0| } 616| | 617| 30| mlk_unpack_ciphertext(b, v, c); ------------------ | | 37| 30|#define mlk_unpack_ciphertext MLK_ADD_PARAM_SET(mlk_unpack_ciphertext) | | ------------------ | | | | 48| 30|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 618| 30| mlk_unpack_sk(skpv, sk); ------------------ | | 35| 30|#define mlk_unpack_sk MLK_ADD_PARAM_SET(mlk_unpack_sk) | | ------------------ | | | | 48| 30|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 619| | 620| 30| mlk_polyvec_ntt(b); ------------------ | | 269| 30|#define mlk_polyvec_ntt MLK_NAMESPACE_K(polyvec_ntt) | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 621| 30| mlk_polyvec_mulcache_compute(b_cache, b); ------------------ | | 353| 30|#define mlk_polyvec_mulcache_compute MLK_NAMESPACE_K(polyvec_mulcache_compute) | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 622| 30| mlk_polyvec_basemul_acc_montgomery_cached(sb, skpv, b, b_cache); ------------------ | | 321| 30| MLK_NAMESPACE_K(polyvec_basemul_acc_montgomery_cached) | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 623| 30| mlk_poly_invntt_tomont(sb); ------------------ | | 263| 30|#define mlk_poly_invntt_tomont MLK_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 63| 30|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 624| | 625| 30| mlk_poly_sub(v, sb); ------------------ | | 210| 30|#define mlk_poly_sub MLK_NAMESPACE(poly_sub) | | ------------------ | | | | 63| 30|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 626| 30| mlk_poly_reduce(v); ------------------ | | 154| 30|#define mlk_poly_reduce MLK_NAMESPACE(poly_reduce) | | ------------------ | | | | 63| 30|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 627| | 628| 30| mlk_poly_tomsg(m, v); ------------------ | | 577| 30|#define mlk_poly_tomsg MLK_NAMESPACE(poly_tomsg) | | ------------------ | | | | 63| 30|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 629| | 630| 30|cleanup: 631| | /* Specification: Partially implements 632| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 633| 30| MLK_FREE(b_cache, mlk_polyvec_mulcache, 1, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 634| 30| MLK_FREE(sb, mlk_poly, 1, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 635| 30| MLK_FREE(v, mlk_poly, 1, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 636| 30| MLK_FREE(skpv, mlk_polyvec, 1, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 637| | MLK_FREE(b, mlk_polyvec, 1, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 638| 30| return ret; 639| 30|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_check_pk: 45| 30|{ 46| 30| int ret = 0; 47| 30| MLK_ALLOC(p, mlk_polyvec, 1, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 48| 30| MLK_ALLOC(p_reencoded, uint8_t, MLKEM_POLYVECBYTES, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 49| | 50| 30| if (p == NULL || p_reencoded == NULL) ------------------ | Branch (50:7): [True: 0, False: 30] | Branch (50:20): [True: 0, False: 30] ------------------ 51| 0| { 52| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 53| 0| goto cleanup; 54| 0| } 55| | 56| 30| mlk_polyvec_frombytes(p, pk); ------------------ | | 247| 30|#define mlk_polyvec_frombytes MLK_NAMESPACE_K(polyvec_frombytes) | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 57| 30| mlk_polyvec_reduce(p); ------------------ | | 387| 30|#define mlk_polyvec_reduce MLK_NAMESPACE_K(polyvec_reduce) | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 58| 30| mlk_polyvec_tobytes(p_reencoded, p); ------------------ | | 225| 30|#define mlk_polyvec_tobytes MLK_NAMESPACE_K(polyvec_tobytes) | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 59| | 60| | /* We use a constant-time memcmp here to avoid having to 61| | * declassify the PK before the PCT has succeeded. */ 62| 30| ret = mlk_ct_memcmp(pk, p_reencoded, MLKEM_POLYVECBYTES) ? MLK_ERR_FAIL : 0; ------------------ | | 31| 30|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | ------------------ | | | | 15| 30|#define MLKEM_K 3 | | ------------------ | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | ------------------ | | | | 30| 30|#define MLKEM_POLYBYTES 384 | | ------------------ ------------------ ret = mlk_ct_memcmp(pk, p_reencoded, MLKEM_POLYVECBYTES) ? MLK_ERR_FAIL : 0; ------------------ | | 272| 0|#define MLK_ERR_FAIL (-1) ------------------ | Branch (62:9): [True: 0, False: 30] ------------------ 63| | 64| 30|cleanup: 65| | /* Specification: Partially implements 66| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 67| 30| MLK_FREE(p_reencoded, uint8_t, MLKEM_POLYVECBYTES, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 68| | MLK_FREE(p, mlk_polyvec, 1, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 69| 30| return ret; 70| 30|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_check_sk: 78| 30|{ 79| 30| int ret = 0; 80| 30| MLK_ALLOC(test, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 81| | 82| 30| if (test == NULL) ------------------ | Branch (82:7): [True: 0, False: 30] ------------------ 83| 0| { 84| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 85| 0| goto cleanup; 86| 0| } 87| | 88| | /* 89| | * The parts of `sk` being hashed and compared here are public, so 90| | * no public information is leaked through the runtime or the return value 91| | * of this function. 92| | */ 93| | 94| | /* Declassify the public part of the secret key */ 95| 30| MLK_CT_TESTING_DECLASSIFY(sk + MLKEM_INDCPA_SECRETKEYBYTES, ------------------ | | 235| 30| do \ | | 236| 30| { \ | | 237| 30| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 30] | | ------------------ ------------------ 96| 30| MLKEM_INDCCA_PUBLICKEYBYTES); 97| 30| MLK_CT_TESTING_DECLASSIFY( ------------------ | | 235| 30| do \ | | 236| 30| { \ | | 237| 30| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 30] | | ------------------ ------------------ 98| 30| sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, MLKEM_SYMBYTES); 99| | 100| 30| mlk_hash_h(test, sk + MLKEM_INDCPA_SECRETKEYBYTES, ------------------ | | 29| 30|#define mlk_hash_h(OUT, IN, INBYTES) mlk_sha3_256(OUT, IN, INBYTES) | | ------------------ | | | | 19| 30|#define mlk_sha3_256 sha3_256 | | | | ------------------ | | | | | | 15| 30|#define sha3_256 OQS_SHA3_sha3_256 | | | | ------------------ | | ------------------ ------------------ 101| 30| MLKEM_INDCCA_PUBLICKEYBYTES); 102| | /* This doesn't have to be a constant-time memcmp, but it's the only place 103| | * in the library where a normal memcmp would be used otherwise, so for sake 104| | * of minimizing stdlib dependency, we use our constant-time one anyway. */ 105| 30| ret = mlk_ct_memcmp(sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 72| 30| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 30|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 30|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 30|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 30|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 30|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 30|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 30|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 30|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 30| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ ret = mlk_ct_memcmp(sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ | Branch (105:9): [True: 0, False: 30] ------------------ 106| 30| test, MLKEM_SYMBYTES) ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 107| 30| ? MLK_ERR_FAIL ------------------ | | 272| 0|#define MLK_ERR_FAIL (-1) ------------------ 108| 30| : 0; 109| | 110| 30|cleanup: 111| | /* Specification: Partially implements 112| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 113| | MLK_FREE(test, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 114| 30| return ret; 115| 30|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_keypair_derand: 214| 30|{ 215| 30| int ret; 216| | 217| 30| ret = mlk_indcpa_keypair_derand(pk, sk, coins, context); ------------------ | | 49| 30| MLK_NAMESPACE_K(indcpa_keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | MLK_NAMESPACE_K(indcpa_keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 212| 30|#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2) | | ------------------ ------------------ 218| 30| if (ret != 0) ------------------ | Branch (218:7): [True: 0, False: 30] ------------------ 219| 0| { 220| 0| goto cleanup; 221| 0| } 222| | 223| 30| mlk_memcpy(sk + MLKEM_INDCPA_SECRETKEYBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 168| 30|#define mlk_memcpy memcpy ------------------ mlk_memcpy(sk + MLKEM_INDCPA_SECRETKEYBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 65| 30|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | ------------------ | | | | 31| 30|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 15| 30|#define MLKEM_K 3 | | | | ------------------ | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 30| 30|#define MLKEM_POLYBYTES 384 | | | | ------------------ | | ------------------ ------------------ mlk_memcpy(sk + MLKEM_INDCPA_SECRETKEYBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 69| 30|#define MLKEM_INDCCA_PUBLICKEYBYTES (MLKEM_INDCPA_PUBLICKEYBYTES) | | ------------------ | | | | 64| 30|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 30|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 30|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 30|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ ------------------ 224| 30| mlk_hash_h(sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, pk, ------------------ | | 29| 30|#define mlk_hash_h(OUT, IN, INBYTES) mlk_sha3_256(OUT, IN, INBYTES) | | ------------------ | | | | 19| 30|#define mlk_sha3_256 sha3_256 | | | | ------------------ | | | | | | 15| 30|#define sha3_256 OQS_SHA3_sha3_256 | | | | ------------------ | | ------------------ ------------------ 225| 30| MLKEM_INDCCA_PUBLICKEYBYTES); 226| | /* Value z for pseudo-random output on reject */ 227| 30| mlk_memcpy(sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 168| 30|#define mlk_memcpy memcpy ------------------ mlk_memcpy(sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 72| 30| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 30|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 30|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 30|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 30|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 30|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 30|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 30|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 30|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 30| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ mlk_memcpy(sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 228| 30| coins + MLKEM_SYMBYTES, MLKEM_SYMBYTES); ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ coins + MLKEM_SYMBYTES, MLKEM_SYMBYTES); ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 229| | 230| | /* Declassify public key */ 231| 30| MLK_CT_TESTING_DECLASSIFY(pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 235| 30| do \ | | 236| 30| { \ | | 237| 30| } while (0) | | ------------------ | | | Branch (237:12): [Folded, False: 30] | | ------------------ ------------------ 232| | 233| | /* Pairwise Consistency Test (PCT) @[FIPS140_3_IG, p.87] */ 234| 30| ret = mlk_check_pct(pk, sk, context); ------------------ | | 37| 30|#define mlk_check_pct MLK_ADD_PARAM_SET(mlk_check_pct) MLK_CONTEXT_PARAMETERS_2 | | ------------------ | | | | 48| 30|#define MLK_ADD_PARAM_SET(s) s | | ------------------ | | #define mlk_check_pct MLK_ADD_PARAM_SET(mlk_check_pct) MLK_CONTEXT_PARAMETERS_2 | | ------------------ | | | | 211| 30|#define MLK_CONTEXT_PARAMETERS_2(arg0, arg1, context) (arg0, arg1) | | ------------------ ------------------ 235| 30| if (ret != 0) ------------------ | Branch (235:7): [True: 0, False: 30] ------------------ 236| 0| { 237| 0| goto cleanup; 238| 0| } 239| | 240| 30|cleanup: 241| 30| if (ret != 0) ------------------ | Branch (241:7): [True: 0, False: 30] ------------------ 242| 0| { 243| 0| mlk_zeroize(pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 69| 0|#define MLKEM_INDCCA_PUBLICKEYBYTES (MLKEM_INDCPA_PUBLICKEYBYTES) | | ------------------ | | | | 64| 0|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 0|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 0|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 0|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ ------------------ 244| 0| mlk_zeroize(sk, MLKEM_INDCCA_SECRETKEYBYTES); ------------------ | | 72| 0| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 0|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 0|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 0|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 0|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 0|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 0|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 0|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 0|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 0| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 0|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ 245| 0| } 246| | 247| 30| return ret; 248| 30|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_keypair: 257| 30|{ 258| 30| int ret = 0; 259| 30| MLK_ALLOC(coins, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 260| | 261| 30| if (coins == NULL) ------------------ | Branch (261:7): [True: 0, False: 30] ------------------ 262| 0| { 263| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 264| 0| goto cleanup; 265| 0| } 266| | 267| | /* Acquire necessary randomness, and mark it as secret. */ 268| 30| if (mlk_randombytes(coins, 2 * MLKEM_SYMBYTES) != 0) ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ | Branch (268:7): [True: 0, False: 30] ------------------ 269| 0| { 270| 0| ret = MLK_ERR_RNG_FAIL; ------------------ | | 278| 0|#define MLK_ERR_RNG_FAIL (-3) ------------------ 271| 0| goto cleanup; 272| 0| } 273| | 274| 30| MLK_CT_TESTING_SECRET(coins, 2 * MLKEM_SYMBYTES); ------------------ | | 231| 30| do \ | | 232| 30| { \ | | 233| 30| } while (0) | | ------------------ | | | Branch (233:12): [Folded, False: 30] | | ------------------ ------------------ 275| | 276| 30| ret = mlk_kem_keypair_derand(pk, sk, coins, context); ------------------ | | 50| 30| MLK_NAMESPACE_K(keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | MLK_NAMESPACE_K(keypair_derand) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 212| 30|#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2) | | ------------------ ------------------ 277| | 278| 30|cleanup: 279| | /* Specification: Partially implements 280| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 281| | MLK_FREE(coins, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 282| 30| return ret; 283| 30|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_enc_derand: 295| 30|{ 296| 30| int ret = 0; 297| 30| MLK_ALLOC(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 298| 30| MLK_ALLOC(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 299| | 300| 30| if (buf == NULL || kr == NULL) ------------------ | Branch (300:7): [True: 0, False: 30] | Branch (300:22): [True: 0, False: 30] ------------------ 301| 0| { 302| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 303| 0| goto cleanup; 304| 0| } 305| | 306| | /* Specification: Implements @[FIPS203, Section 7.2, Modulus check] */ 307| 30| ret = mlk_kem_check_pk(pk, context); ------------------ | | 55| 30|#define mlk_kem_check_pk MLK_NAMESPACE_K(check_pk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_kem_check_pk MLK_NAMESPACE_K(check_pk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 210| 30|#define MLK_CONTEXT_PARAMETERS_1(arg0, context) (arg0) | | ------------------ ------------------ 308| 30| if (ret != 0) ------------------ | Branch (308:7): [True: 0, False: 30] ------------------ 309| 0| { 310| 0| goto cleanup; 311| 0| } 312| | 313| 30| mlk_memcpy(buf, coins, MLKEM_SYMBYTES); ------------------ | | 168| 30|#define mlk_memcpy memcpy ------------------ mlk_memcpy(buf, coins, MLKEM_SYMBYTES); ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 314| | 315| | /* Multitarget countermeasure for coins + contributory KEM */ 316| 30| mlk_hash_h(buf + MLKEM_SYMBYTES, pk, MLKEM_INDCCA_PUBLICKEYBYTES); ------------------ | | 29| 30|#define mlk_hash_h(OUT, IN, INBYTES) mlk_sha3_256(OUT, IN, INBYTES) | | ------------------ | | | | 19| 30|#define mlk_sha3_256 sha3_256 | | | | ------------------ | | | | | | 15| 30|#define sha3_256 OQS_SHA3_sha3_256 | | | | ------------------ | | ------------------ ------------------ 317| 30| mlk_hash_g(kr, buf, 2 * MLKEM_SYMBYTES); ------------------ | | 32| 30|#define mlk_hash_g(OUT, IN, INBYTES) mlk_sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 20| 30|#define mlk_sha3_512 sha3_512 | | | | ------------------ | | | | | | 31| 30|#define sha3_512 OQS_SHA3_sha3_512 | | | | ------------------ | | ------------------ ------------------ 318| | 319| | /* coins are in kr+MLKEM_SYMBYTES */ 320| 30| ret = mlk_indcpa_enc(ct, buf, pk, kr + MLKEM_SYMBYTES, context); ------------------ | | 88| 30|#define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 214| 30| (arg0, arg1, arg2, arg3) | | ------------------ ------------------ 321| 30| if (ret != 0) ------------------ | Branch (321:7): [True: 0, False: 30] ------------------ 322| 0| { 323| 0| goto cleanup; 324| 0| } 325| | 326| 30| mlk_memcpy(ss, kr, MLKEM_SYMBYTES); ------------------ | | 168| 30|#define mlk_memcpy memcpy ------------------ mlk_memcpy(ss, kr, MLKEM_SYMBYTES); ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 327| | 328| 30|cleanup: 329| | /* Specification: Partially implements 330| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 331| 30| MLK_FREE(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 332| | MLK_FREE(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 333| 30| return ret; 334| 30|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_enc: 344| 30|{ 345| 30| int ret = 0; 346| 30| MLK_ALLOC(coins, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 347| | 348| 30| if (coins == NULL) ------------------ | Branch (348:7): [True: 0, False: 30] ------------------ 349| 0| { 350| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 351| 0| goto cleanup; 352| 0| } 353| | 354| 30| if (mlk_randombytes(coins, MLKEM_SYMBYTES) != 0) ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ | Branch (354:7): [True: 0, False: 30] ------------------ 355| 0| { 356| 0| ret = MLK_ERR_RNG_FAIL; ------------------ | | 278| 0|#define MLK_ERR_RNG_FAIL (-3) ------------------ 357| 0| goto cleanup; 358| 0| } 359| | 360| 30| MLK_CT_TESTING_SECRET(coins, MLKEM_SYMBYTES); ------------------ | | 231| 30| do \ | | 232| 30| { \ | | 233| 30| } while (0) | | ------------------ | | | Branch (233:12): [Folded, False: 30] | | ------------------ ------------------ 361| | 362| 30| ret = mlk_kem_enc_derand(ct, ss, pk, coins, context); ------------------ | | 52| 30|#define mlk_kem_enc_derand MLK_NAMESPACE_K(enc_derand) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_kem_enc_derand MLK_NAMESPACE_K(enc_derand) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 214| 30| (arg0, arg1, arg2, arg3) | | ------------------ ------------------ 363| | 364| 30|cleanup: 365| | /* Specification: Partially implements 366| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 367| | MLK_FREE(coins, uint8_t, MLKEM_SYMBYTES, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 368| 30| return ret; 369| 30|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_dec: 380| 30|{ 381| 30| int ret = 0; 382| 30| uint8_t fail; 383| 30| const uint8_t *pk = sk + MLKEM_INDCPA_SECRETKEYBYTES; ------------------ | | 65| 30|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | ------------------ | | | | 31| 30|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 15| 30|#define MLKEM_K 3 | | | | ------------------ | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | ------------------ | | | | | | 30| 30|#define MLKEM_POLYBYTES 384 | | | | ------------------ | | ------------------ ------------------ 384| 30| MLK_ALLOC(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 385| 30| MLK_ALLOC(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 386| 30| MLK_ALLOC(tmp, uint8_t, MLKEM_SYMBYTES + MLKEM_INDCCA_CIPHERTEXTBYTES, ------------------ | | 229| 30| MLK_ALIGN T mlk_alloc_##v[N]; \ | | ------------------ | | | | 190| 30|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) | | ------------------ | | 230| 30| T *v = mlk_alloc_##v /* NOLINT(bugprone-macro-parentheses) */ ------------------ 387| 30| context); 388| | 389| 30| if (buf == NULL || kr == NULL || tmp == NULL) ------------------ | Branch (389:7): [True: 0, False: 30] | Branch (389:22): [True: 0, False: 30] | Branch (389:36): [True: 0, False: 30] ------------------ 390| 0| { 391| 0| ret = MLK_ERR_OUT_OF_MEMORY; ------------------ | | 275| 0|#define MLK_ERR_OUT_OF_MEMORY (-2) ------------------ 392| 0| goto cleanup; 393| 0| } 394| | 395| | /* Specification: Implements @[FIPS203, Section 7.3, Hash check] */ 396| 30| ret = mlk_kem_check_sk(sk, context); ------------------ | | 56| 30|#define mlk_kem_check_sk MLK_NAMESPACE_K(check_sk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_kem_check_sk MLK_NAMESPACE_K(check_sk) MLK_CONTEXT_PARAMETERS_1 | | ------------------ | | | | 210| 30|#define MLK_CONTEXT_PARAMETERS_1(arg0, context) (arg0) | | ------------------ ------------------ 397| 30| if (ret != 0) ------------------ | Branch (397:7): [True: 0, False: 30] ------------------ 398| 0| { 399| 0| goto cleanup; 400| 0| } 401| | 402| 30| ret = mlk_indcpa_dec(buf, ct, sk, context); ------------------ | | 127| 30|#define mlk_indcpa_dec MLK_NAMESPACE_K(indcpa_dec) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_indcpa_dec MLK_NAMESPACE_K(indcpa_dec) MLK_CONTEXT_PARAMETERS_3 | | ------------------ | | | | 212| 30|#define MLK_CONTEXT_PARAMETERS_3(arg0, arg1, arg2, context) (arg0, arg1, arg2) | | ------------------ ------------------ 403| 30| if (ret != 0) ------------------ | Branch (403:7): [True: 0, False: 30] ------------------ 404| 0| { 405| 0| goto cleanup; 406| 0| } 407| | 408| | /* Multitarget countermeasure for coins + contributory KEM */ 409| 30| mlk_memcpy(buf + MLKEM_SYMBYTES, ------------------ | | 168| 30|#define mlk_memcpy memcpy ------------------ mlk_memcpy(buf + MLKEM_SYMBYTES, ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 410| 30| sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 72| 30| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 30|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 30|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 30|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 30|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 30|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 30|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 30|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 30|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 30| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ sk + MLKEM_INDCCA_SECRETKEYBYTES - 2 * MLKEM_SYMBYTES, ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 411| 30| MLKEM_SYMBYTES); ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 412| 30| mlk_hash_g(kr, buf, 2 * MLKEM_SYMBYTES); ------------------ | | 32| 30|#define mlk_hash_g(OUT, IN, INBYTES) mlk_sha3_512(OUT, IN, INBYTES) | | ------------------ | | | | 20| 30|#define mlk_sha3_512 sha3_512 | | | | ------------------ | | | | | | 31| 30|#define sha3_512 OQS_SHA3_sha3_512 | | | | ------------------ | | ------------------ ------------------ 413| | 414| | /* Recompute and compare ciphertext */ 415| | /* coins are in kr+MLKEM_SYMBYTES */ 416| 30| ret = mlk_indcpa_enc(tmp, buf, pk, kr + MLKEM_SYMBYTES, context); ------------------ | | 88| 30|#define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 64| 30|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define mlk_indcpa_enc MLK_NAMESPACE_K(indcpa_enc) MLK_CONTEXT_PARAMETERS_4 | | ------------------ | | | | 214| 30| (arg0, arg1, arg2, arg3) | | ------------------ ------------------ 417| 30| if (ret != 0) ------------------ | Branch (417:7): [True: 0, False: 30] ------------------ 418| 0| { 419| 0| goto cleanup; 420| 0| } 421| | 422| 30| fail = mlk_ct_memcmp(ct, tmp, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 74| 30|#define MLKEM_INDCCA_CIPHERTEXTBYTES (MLKEM_INDCPA_BYTES) | | ------------------ | | | | 67| 30| (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 51| 30|#define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 15| 30|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 50| 30|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D10 | | | | | | | | ------------------ | | | | | | | | | | 35| 30|#define MLKEM_POLYCOMPRESSEDBYTES_D10 320 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 49| 30|#define MLKEM_POLYCOMPRESSEDBYTES_DV MLKEM_POLYCOMPRESSEDBYTES_D4 | | | | | | ------------------ | | | | | | | | 33| 30|#define MLKEM_POLYCOMPRESSEDBYTES_D4 128 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 423| | 424| | /* Compute rejection key */ 425| 30| mlk_memcpy(tmp, sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 168| 30|#define mlk_memcpy memcpy ------------------ mlk_memcpy(tmp, sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 72| 30| (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 65| 30|#define MLKEM_INDCPA_SECRETKEYBYTES (MLKEM_POLYVECBYTES) | | | | ------------------ | | | | | | 31| 30|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 30|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 30|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | (MLKEM_INDCPA_SECRETKEYBYTES + MLKEM_INDCPA_PUBLICKEYBYTES + \ | | ------------------ | | | | 64| 30|#define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 31| 30|#define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 15| 30|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECBYTES (MLKEM_K * MLKEM_POLYBYTES) | | | | | | ------------------ | | | | | | | | 30| 30|#define MLKEM_POLYBYTES 384 | | | | | | ------------------ | | | | ------------------ | | | | #define MLKEM_INDCPA_PUBLICKEYBYTES (MLKEM_POLYVECBYTES + MLKEM_SYMBYTES) | | | | ------------------ | | | | | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | | | ------------------ | | ------------------ | | 73| 30| 2 * MLKEM_SYMBYTES) | | ------------------ | | | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ mlk_memcpy(tmp, sk + MLKEM_INDCCA_SECRETKEYBYTES - MLKEM_SYMBYTES, ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 426| 30| MLKEM_SYMBYTES); ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 427| 30| mlk_memcpy(tmp + MLKEM_SYMBYTES, ct, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 168| 30|#define mlk_memcpy memcpy ------------------ mlk_memcpy(tmp + MLKEM_SYMBYTES, ct, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ mlk_memcpy(tmp + MLKEM_SYMBYTES, ct, MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 74| 30|#define MLKEM_INDCCA_CIPHERTEXTBYTES (MLKEM_INDCPA_BYTES) | | ------------------ | | | | 67| 30| (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 51| 30|#define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 15| 30|#define MLKEM_K 3 | | | | | | ------------------ | | | | | | #define MLKEM_POLYVECCOMPRESSEDBYTES_DU (MLKEM_K * MLKEM_POLYCOMPRESSEDBYTES_DU) | | | | | | ------------------ | | | | | | | | 50| 30|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D10 | | | | | | | | ------------------ | | | | | | | | | | 35| 30|#define MLKEM_POLYCOMPRESSEDBYTES_D10 320 | | | | | | | | ------------------ | | | | | | ------------------ | | | | ------------------ | | | | (MLKEM_POLYVECCOMPRESSEDBYTES_DU + MLKEM_POLYCOMPRESSEDBYTES_DV) | | | | ------------------ | | | | | | 49| 30|#define MLKEM_POLYCOMPRESSEDBYTES_DV MLKEM_POLYCOMPRESSEDBYTES_D4 | | | | | | ------------------ | | | | | | | | 33| 30|#define MLKEM_POLYCOMPRESSEDBYTES_D4 128 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 428| 30| mlk_hash_j(ss, tmp, MLKEM_SYMBYTES + MLKEM_INDCCA_CIPHERTEXTBYTES); ------------------ | | 36| 30| mlk_shake256(OUT, MLKEM_SYMBYTES, IN, INBYTES) | | ------------------ | | | | 18| 30|#define mlk_shake256 shake256 | | | | ------------------ | | | | | | 12| 30|#define shake256 OQS_SHA3_shake256 | | | | ------------------ | | ------------------ | | mlk_shake256(OUT, MLKEM_SYMBYTES, IN, INBYTES) | | ------------------ | | | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ 429| | 430| | /* Copy true key to return buffer if fail is 0 */ 431| 30| mlk_ct_cmov_zero(ss, kr, MLKEM_SYMBYTES, fail); ------------------ | | 27| 30|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 432| | 433| 30|cleanup: 434| | /* Specification: Partially implements 435| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 436| 30| MLK_FREE(tmp, uint8_t, MLKEM_SYMBYTES + MLKEM_INDCCA_CIPHERTEXTBYTES, ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 437| 30| context); 438| 30| MLK_FREE(kr, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 439| 30| MLK_FREE(buf, uint8_t, 2 * MLKEM_SYMBYTES, context); ------------------ | | 238| 30| do \ | | 239| 30| { \ | | 240| 30| mlk_zeroize(mlk_alloc_##v, sizeof(mlk_alloc_##v)); \ | | 241| 30| (v) = NULL; \ | | 242| 30| } while (0) | | ------------------ | | | Branch (242:12): [Folded, False: 30] | | ------------------ ------------------ 440| | 441| 30| return ret; 442| 30|} poly_k.c:mlk_polyvec_basemul_acc_montgomery_cached_k3_native: 141| 360|{ 142| 360| if (!mlk_sys_check_capability(MLK_SYS_CAP_AVX2)) ------------------ | Branch (142:7): [True: 0, False: 360] ------------------ 143| 0| { 144| 0| return MLK_NATIVE_FUNC_FALLBACK; ------------------ | | 38| 0|#define MLK_NATIVE_FUNC_FALLBACK (-1) ------------------ 145| 0| } 146| | 147| 360| mlk_polyvec_basemul_acc_montgomery_cached_k3_avx2_asm(r, a, b, b_cache); ------------------ | | 124| 360| MLK_NAMESPACE(polyvec_basemul_acc_montgomery_cached_k3_avx2_asm) | | ------------------ | | | | 63| 360|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 360|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 360|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 148| 360| return MLK_NATIVE_FUNC_SUCCESS; ------------------ | | 33| 360|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ 149| 360|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_tomont: 132| 90|{ 133| 90|#if defined(MLK_USE_NATIVE_POLY_TOMONT) 134| 90| int ret; 135| 90| ret = mlk_poly_tomont_native(r->coeffs); 136| 90| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 90|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (136:7): [True: 90, False: 0] ------------------ 137| 90| { 138| 90| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_Q); ------------------ | | 105| 90| do \ | | 106| 90| { \ | | 107| 90| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 90] | | ------------------ ------------------ 139| 90| return; 140| 90| } 141| 0|#endif /* MLK_USE_NATIVE_POLY_TOMONT */ 142| | 143| 0| mlk_poly_tomont_c(r); 144| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_reduce: 211| 540|{ 212| 540|#if defined(MLK_USE_NATIVE_POLY_REDUCE) 213| 540| int ret; 214| 540| ret = mlk_poly_reduce_native(r->coeffs); 215| 540| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 540|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (215:7): [True: 540, False: 0] ------------------ 216| 540| { 217| 540| mlk_assert_bound(r, MLKEM_N, 0, MLKEM_Q); ------------------ | | 101| 540| do \ | | 102| 540| { \ | | 103| 540| } while (0) | | ------------------ | | | Branch (103:12): [Folded, False: 540] | | ------------------ ------------------ 218| 540| return; 219| 540| } 220| 0|#endif /* MLK_USE_NATIVE_POLY_REDUCE */ 221| | 222| 0| mlk_poly_reduce_c(r); 223| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_add: 230| 390|{ 231| 390| unsigned i; 232| 100k| for (i = 0; i < MLKEM_N; i++) ------------------ | | 22| 100k|#define MLKEM_N 256 ------------------ | Branch (232:15): [True: 99.8k, False: 390] ------------------ 233| 99.8k| __loop__( 234| 99.8k| invariant(i <= MLKEM_N) 235| 99.8k| invariant(forall(k0, i, MLKEM_N, r->coeffs[k0] == loop_entry(*r).coeffs[k0])) 236| 99.8k| invariant(forall(k1, 0, i, r->coeffs[k1] == loop_entry(*r).coeffs[k1] + b->coeffs[k1])) 237| 99.8k| decreases(MLKEM_N - i)) 238| 99.8k| { 239| | /* The preconditions imply that the addition stays within int16_t. */ 240| 99.8k| r->coeffs[i] = (int16_t)(r->coeffs[i] + b->coeffs[i]); 241| 99.8k| } 242| 390|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_sub: 249| 30|{ 250| 30| unsigned i; 251| 7.71k| for (i = 0; i < MLKEM_N; i++) ------------------ | | 22| 7.71k|#define MLKEM_N 256 ------------------ | Branch (251:15): [True: 7.68k, False: 30] ------------------ 252| 7.68k| __loop__( 253| 7.68k| invariant(i <= MLKEM_N) 254| 7.68k| invariant(forall(k0, i, MLKEM_N, r->coeffs[k0] == loop_entry(*r).coeffs[k0])) 255| 7.68k| invariant(forall(k1, 0, i, r->coeffs[k1] == loop_entry(*r).coeffs[k1] - b->coeffs[k1])) 256| 7.68k| decreases(MLKEM_N - i)) 257| 7.68k| { 258| | /* The preconditions imply that the subtraction stays within int16_t. */ 259| 7.68k| r->coeffs[i] = (int16_t)(r->coeffs[i] - b->coeffs[i]); 260| 7.68k| } 261| 30|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_mulcache_compute: 302| 360|{ 303| 360|#if defined(MLK_USE_NATIVE_POLY_MULCACHE_COMPUTE) 304| 360| int ret; 305| 360| ret = mlk_poly_mulcache_compute_native(x->coeffs, a->coeffs); 306| 360| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 360|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (306:7): [True: 360, False: 0] ------------------ 307| 360| { 308| 360| return; 309| 360| } 310| 0|#endif /* MLK_USE_NATIVE_POLY_MULCACHE_COMPUTE */ 311| | 312| 0| mlk_poly_mulcache_compute_c(x, a); 313| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_ntt: 457| 450|{ 458| 450|#if defined(MLK_USE_NATIVE_NTT) 459| 450| int ret; 460| 450| mlk_assert_abs_bound(r, MLKEM_N, MLKEM_Q); ------------------ | | 105| 450| do \ | | 106| 450| { \ | | 107| 450| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 450] | | ------------------ ------------------ 461| 450| ret = mlk_ntt_native(r->coeffs); 462| 450| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 450|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (462:7): [True: 450, False: 0] ------------------ 463| 450| { 464| 450| mlk_assert_abs_bound(r, MLKEM_N, MLK_NTT_BOUND); ------------------ | | 105| 450| do \ | | 106| 450| { \ | | 107| 450| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 450] | | ------------------ ------------------ 465| 450| return; 466| 450| } 467| 0|#endif /* MLK_USE_NATIVE_NTT */ 468| | 469| 0| mlk_poly_ntt_c(r); 470| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_invntt_tomont: 558| 270|{ 559| 270|#if defined(MLK_USE_NATIVE_INTT) 560| 270| int ret; 561| 270| ret = mlk_intt_native(r->coeffs); 562| 270| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 270|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (562:7): [True: 270, False: 0] ------------------ 563| 270| { 564| 270| mlk_assert_abs_bound(r, MLKEM_N, MLK_INVNTT_BOUND); ------------------ | | 105| 270| do \ | | 106| 270| { \ | | 107| 270| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 270] | | ------------------ ------------------ 565| 270| return; 566| 270| } 567| 0|#endif /* MLK_USE_NATIVE_INTT */ 568| | 569| 0| mlk_poly_invntt_tomont_c(r); 570| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_compress_du: 50| 60|{ 51| 60| unsigned i; 52| 60| mlk_assert_bound_2d(a->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 60| do \ | | 111| 60| { \ | | 112| 60| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 60] | | ------------------ ------------------ 53| | 54| 240| for (i = 0; i < MLKEM_K; i++) ------------------ | | 15| 240|#define MLKEM_K 3 ------------------ | Branch (54:15): [True: 180, False: 60] ------------------ 55| 180| { 56| 180| mlk_poly_compress_du(r + i * MLKEM_POLYCOMPRESSEDBYTES_DU, &a->vec[i]); ------------------ | | 49| 180|#define mlk_poly_compress_du MLK_NAMESPACE_K(poly_compress_du) | | ------------------ | | | | 64| 180|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 180|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 180|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_compress_du(r + i * MLKEM_POLYCOMPRESSEDBYTES_DU, &a->vec[i]); ------------------ | | 50| 180|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D10 | | ------------------ | | | | 35| 180|#define MLKEM_POLYCOMPRESSEDBYTES_D10 320 | | ------------------ ------------------ 57| 180| } 58| 60|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_decompress_du: 64| 30|{ 65| 30| unsigned i; 66| 120| for (i = 0; i < MLKEM_K; i++) ------------------ | | 15| 120|#define MLKEM_K 3 ------------------ | Branch (66:15): [True: 90, False: 30] ------------------ 67| 90| { 68| 90| mlk_poly_decompress_du(&r->vec[i], a + i * MLKEM_POLYCOMPRESSEDBYTES_DU); ------------------ | | 79| 90|#define mlk_poly_decompress_du MLK_NAMESPACE_K(poly_decompress_du) | | ------------------ | | | | 64| 90|#define MLK_NAMESPACE_K(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX_K, s) | | | | ------------------ | | | | | | 42| 90|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 90|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_decompress_du(&r->vec[i], a + i * MLKEM_POLYCOMPRESSEDBYTES_DU); ------------------ | | 50| 90|#define MLKEM_POLYCOMPRESSEDBYTES_DU MLKEM_POLYCOMPRESSEDBYTES_D10 | | ------------------ | | | | 35| 90|#define MLKEM_POLYCOMPRESSEDBYTES_D10 320 | | ------------------ ------------------ 69| 90| } 70| | 71| 30| mlk_assert_bound_2d(r->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 30| do \ | | 111| 30| { \ | | 112| 30| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 30] | | ------------------ ------------------ 72| 30|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_tobytes: 81| 90|{ 82| 90| unsigned i; 83| 90| mlk_assert_bound_2d(a->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 90| do \ | | 111| 90| { \ | | 112| 90| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 90] | | ------------------ ------------------ 84| | 85| 360| for (i = 0; i < MLKEM_K; i++) ------------------ | | 15| 360|#define MLKEM_K 3 ------------------ | Branch (85:15): [True: 270, False: 90] ------------------ 86| 270| __loop__( 87| 270| assigns(i, memory_slice(r, MLKEM_POLYVECBYTES)) 88| 270| invariant(i <= MLKEM_K) 89| 270| decreases(MLKEM_K - i) 90| 270| ) 91| 270| { 92| 270| mlk_poly_tobytes(&r[i * MLKEM_POLYBYTES], &a->vec[i]); ------------------ | | 512| 270|#define mlk_poly_tobytes MLK_NAMESPACE(poly_tobytes) | | ------------------ | | | | 63| 270|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 270|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 270|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_tobytes(&r[i * MLKEM_POLYBYTES], &a->vec[i]); ------------------ | | 30| 270|#define MLKEM_POLYBYTES 384 ------------------ 93| 270| } 94| 90|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_frombytes: 99| 120|{ 100| 120| unsigned i; 101| 480| for (i = 0; i < MLKEM_K; i++) ------------------ | | 15| 480|#define MLKEM_K 3 ------------------ | Branch (101:15): [True: 360, False: 120] ------------------ 102| 360| { 103| 360| mlk_poly_frombytes(&r->vec[i], a + i * MLKEM_POLYBYTES); ------------------ | | 534| 360|#define mlk_poly_frombytes MLK_NAMESPACE(poly_frombytes) | | ------------------ | | | | 63| 360|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 360|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 360|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ mlk_poly_frombytes(&r->vec[i], a + i * MLKEM_POLYBYTES); ------------------ | | 30| 360|#define MLKEM_POLYBYTES 384 ------------------ 104| 360| } 105| | 106| 120| mlk_assert_bound_2d(r->vec, MLKEM_K, MLKEM_N, 0, MLKEM_UINT12_LIMIT); ------------------ | | 110| 120| do \ | | 111| 120| { \ | | 112| 120| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 120] | | ------------------ ------------------ 107| 120|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_ntt: 112| 150|{ 113| 150| unsigned i; 114| 600| for (i = 0; i < MLKEM_K; i++) ------------------ | | 15| 600|#define MLKEM_K 3 ------------------ | Branch (114:15): [True: 450, False: 150] ------------------ 115| 450| { 116| 450| mlk_poly_ntt(&r->vec[i]); ------------------ | | 235| 450|#define mlk_poly_ntt MLK_NAMESPACE(poly_ntt) | | ------------------ | | | | 63| 450|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 450|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 450|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 117| 450| } 118| | 119| 150| mlk_assert_abs_bound_2d(r->vec, MLKEM_K, MLKEM_N, MLK_NTT_BOUND); ------------------ | | 115| 150| do \ | | 116| 150| { \ | | 117| 150| } while (0) | | ------------------ | | | Branch (117:12): [Folded, False: 150] | | ------------------ ------------------ 120| 150|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_invntt_tomont: 129| 60|{ 130| 60| unsigned i; 131| 240| for (i = 0; i < MLKEM_K; i++) ------------------ | | 15| 240|#define MLKEM_K 3 ------------------ | Branch (131:15): [True: 180, False: 60] ------------------ 132| 180| { 133| 180| mlk_poly_invntt_tomont(&r->vec[i]); ------------------ | | 263| 180|#define mlk_poly_invntt_tomont MLK_NAMESPACE(poly_invntt_tomont) | | ------------------ | | | | 63| 180|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 180|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 180|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 134| 180| } 135| | 136| 60| mlk_assert_abs_bound_2d(r->vec, MLKEM_K, MLKEM_N, MLK_INVNTT_BOUND); ------------------ | | 115| 60| do \ | | 116| 60| { \ | | 117| 60| } while (0) | | ------------------ | | | Branch (117:12): [Folded, False: 60] | | ------------------ ------------------ 137| 60|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_basemul_acc_montgomery_cached: 195| 360|{ 196| 360|#if defined(MLK_USE_NATIVE_POLYVEC_BASEMUL_ACC_MONTGOMERY_CACHED) 197| 360| { 198| 360| int ret; 199| 360| mlk_assert_bound_2d(a->vec, MLKEM_K, MLKEM_N, 0, MLKEM_UINT12_LIMIT); ------------------ | | 110| 360| do \ | | 111| 360| { \ | | 112| 360| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 360] | | ------------------ ------------------ 200| |#if MLKEM_K == 2 201| | ret = mlk_polyvec_basemul_acc_montgomery_cached_k2_native( 202| | r->coeffs, (const int16_t *)a, (const int16_t *)b, 203| | (const int16_t *)b_cache); 204| |#elif MLKEM_K == 3 205| | ret = mlk_polyvec_basemul_acc_montgomery_cached_k3_native( 206| 360| r->coeffs, (const int16_t *)a, (const int16_t *)b, 207| 360| (const int16_t *)b_cache); 208| |#elif MLKEM_K == 4 209| | ret = mlk_polyvec_basemul_acc_montgomery_cached_k4_native( 210| | r->coeffs, (const int16_t *)a, (const int16_t *)b, 211| | (const int16_t *)b_cache); 212| |#endif 213| 360| if (ret == MLK_NATIVE_FUNC_SUCCESS) ------------------ | | 33| 360|#define MLK_NATIVE_FUNC_SUCCESS (0) ------------------ | Branch (213:9): [True: 360, False: 0] ------------------ 214| 360| { 215| 360| return; 216| 360| } 217| 360| } 218| 0|#endif /* MLK_USE_NATIVE_POLYVEC_BASEMUL_ACC_MONTGOMERY_CACHED */ 219| | 220| 0| mlk_polyvec_basemul_acc_montgomery_cached_c(r, a, b, b_cache); ------------------ | | 39| 0| MLK_ADD_PARAM_SET(mlk_polyvec_basemul_acc_montgomery_cached_c) | | ------------------ | | | | 48| 0|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 221| 0|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_mulcache_compute: 229| 120|{ 230| 120| unsigned i; 231| 480| for (i = 0; i < MLKEM_K; i++) ------------------ | | 15| 480|#define MLKEM_K 3 ------------------ | Branch (231:15): [True: 360, False: 120] ------------------ 232| 360| { 233| 360| mlk_poly_mulcache_compute(&x->vec[i], &a->vec[i]); ------------------ | | 123| 360|#define mlk_poly_mulcache_compute MLK_NAMESPACE(poly_mulcache_compute) | | ------------------ | | | | 63| 360|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 360|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 360|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 234| 360| } 235| 120|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_reduce: 246| 150|{ 247| 150| unsigned i; 248| 600| for (i = 0; i < MLKEM_K; i++) ------------------ | | 15| 600|#define MLKEM_K 3 ------------------ | Branch (248:15): [True: 450, False: 150] ------------------ 249| 450| { 250| 450| mlk_poly_reduce(&r->vec[i]); ------------------ | | 154| 450|#define mlk_poly_reduce MLK_NAMESPACE(poly_reduce) | | ------------------ | | | | 63| 450|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 450|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 450|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 251| 450| } 252| | 253| 150| mlk_assert_bound_2d(r->vec, MLKEM_K, MLKEM_N, 0, MLKEM_Q); ------------------ | | 110| 150| do \ | | 111| 150| { \ | | 112| 150| } while (0) | | ------------------ | | | Branch (112:12): [Folded, False: 150] | | ------------------ ------------------ 254| 150|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_add: 261| 90|{ 262| 90| unsigned i; 263| 360| for (i = 0; i < MLKEM_K; i++) ------------------ | | 15| 360|#define MLKEM_K 3 ------------------ | Branch (263:15): [True: 270, False: 90] ------------------ 264| 270| __loop__( 265| 270| assigns(i, memory_slice(r, sizeof(mlk_polyvec))) 266| 270| invariant(i <= MLKEM_K) 267| 270| invariant(forall(j0, i, MLKEM_K, 268| 270| forall(k0, 0, MLKEM_N, 269| 270| ((int32_t)r->vec[j0].coeffs[k0] + b->vec[j0].coeffs[k0] <= INT16_MAX) && 270| 270| ((int32_t)r->vec[j0].coeffs[k0] + b->vec[j0].coeffs[k0] >= INT16_MIN)))) 271| 270| invariant(forall(j2, 0, i, 272| 270| forall(k2, 0, MLKEM_N, 273| 270| (r->vec[j2].coeffs[k2] <= INT16_MAX) && 274| 270| (r->vec[j2].coeffs[k2] >= INT16_MIN)))) 275| 270| decreases(MLKEM_K - i) 276| 270| ) 277| 270| { 278| 270| mlk_poly_add(&r->vec[i], &b->vec[i]); ------------------ | | 181| 270|#define mlk_poly_add MLK_NAMESPACE(poly_add) | | ------------------ | | | | 63| 270|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 270|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 270|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 279| 270| } 280| 90|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_polyvec_tomont: 285| 30|{ 286| 30| unsigned i; 287| 120| for (i = 0; i < MLKEM_K; i++) ------------------ | | 15| 120|#define MLKEM_K 3 ------------------ | Branch (287:15): [True: 90, False: 30] ------------------ 288| 90| { 289| 90| mlk_poly_tomont(&r->vec[i]); ------------------ | | 102| 90|#define mlk_poly_tomont MLK_NAMESPACE(poly_tomont) | | ------------------ | | | | 63| 90|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 90|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 90|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 290| 90| } 291| | 292| 30| mlk_assert_abs_bound_2d(r->vec, MLKEM_K, MLKEM_N, MLKEM_Q); ------------------ | | 115| 30| do \ | | 116| 30| { \ | | 117| 30| } while (0) | | ------------------ | | | Branch (117:12): [Folded, False: 30] | | ------------------ ------------------ 293| 30|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_getnoise_eta1_4x: 337| 180|{ 338| 180| MLK_ALIGN uint8_t buf[4][MLK_ALIGN_UP(MLKEM_ETA1 * MLKEM_N / 4)]; ------------------ | | 190| 180|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 339| 180| MLK_ALIGN uint8_t extkey[4][MLK_ALIGN_UP(MLKEM_SYMBYTES + 1)]; ------------------ | | 190| 180|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 340| 180| mlk_memcpy(extkey[0], seed, MLKEM_SYMBYTES); ------------------ | | 168| 180|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[0], seed, MLKEM_SYMBYTES); ------------------ | | 27| 180|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 341| 180| mlk_memcpy(extkey[1], seed, MLKEM_SYMBYTES); ------------------ | | 168| 180|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[1], seed, MLKEM_SYMBYTES); ------------------ | | 27| 180|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 342| 180| mlk_memcpy(extkey[2], seed, MLKEM_SYMBYTES); ------------------ | | 168| 180|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[2], seed, MLKEM_SYMBYTES); ------------------ | | 27| 180|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 343| 180| mlk_memcpy(extkey[3], seed, MLKEM_SYMBYTES); ------------------ | | 168| 180|#define mlk_memcpy memcpy ------------------ mlk_memcpy(extkey[3], seed, MLKEM_SYMBYTES); ------------------ | | 27| 180|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 344| 180| extkey[0][MLKEM_SYMBYTES] = nonce0; ------------------ | | 27| 180|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 345| 180| extkey[1][MLKEM_SYMBYTES] = nonce1; ------------------ | | 27| 180|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 346| 180| extkey[2][MLKEM_SYMBYTES] = nonce2; ------------------ | | 27| 180|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 347| 180| extkey[3][MLKEM_SYMBYTES] = nonce3; ------------------ | | 27| 180|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ ------------------ 348| | 349| 180|#if !defined(FIPS202_X4_DEFAULT_IMPLEMENTATION) && \ 350| 180| !defined(MLK_CONFIG_SERIAL_FIPS202_ONLY) 351| 180| mlk_prf_eta1_x4(buf, extkey); ------------------ | | 45| 180| mlk_shake256x4((OUT)[0], (OUT)[1], (OUT)[2], (OUT)[3], \ | | ------------------ | | | | 18| 180|#define mlk_shake256x4 shake256x4 | | | | ------------------ | | | | | | 36| 180|#define shake256x4 OQS_SHA3_shake256_x4 | | | | ------------------ | | ------------------ | | 46| 180| (MLKEM_ETA1 * MLKEM_N / 4), (IN)[0], (IN)[1], (IN)[2], \ | | ------------------ | | | | 46| 180|#define MLKEM_ETA1 2 | | ------------------ | | (MLKEM_ETA1 * MLKEM_N / 4), (IN)[0], (IN)[1], (IN)[2], \ | | ------------------ | | | | 22| 180|#define MLKEM_N 256 | | ------------------ | | 47| 180| (IN)[3], MLKEM_SYMBYTES + 1) | | ------------------ | | | | 27| 180|#define MLKEM_SYMBYTES 32 /* size in bytes of hashes, and seeds */ | | ------------------ ------------------ 352| |#else 353| | mlk_prf_eta1(buf[0], extkey[0]); 354| | mlk_prf_eta1(buf[1], extkey[1]); 355| | mlk_prf_eta1(buf[2], extkey[2]); 356| | if (r3 != NULL) 357| | { 358| | mlk_prf_eta1(buf[3], extkey[3]); 359| | } 360| |#endif /* !(!FIPS202_X4_DEFAULT_IMPLEMENTATION && \ 361| | !MLK_CONFIG_SERIAL_FIPS202_ONLY) */ 362| | 363| 180| mlk_poly_cbd_eta1(r0, buf[0]); ------------------ | | 36| 180|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 180|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 364| 180| mlk_poly_cbd_eta1(r1, buf[1]); ------------------ | | 36| 180|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 180|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 365| 180| mlk_poly_cbd_eta1(r2, buf[2]); ------------------ | | 36| 180|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 180|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 366| 180| if (r3 != NULL) ------------------ | Branch (366:7): [True: 60, False: 120] ------------------ 367| 60| { 368| 60| mlk_poly_cbd_eta1(r3, buf[3]); ------------------ | | 36| 60|#define mlk_poly_cbd_eta1 MLK_ADD_PARAM_SET(mlk_poly_cbd_eta1) | | ------------------ | | | | 48| 60|#define MLK_ADD_PARAM_SET(s) s | | ------------------ ------------------ 369| 60| mlk_assert_abs_bound(r3, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 60| do \ | | 106| 60| { \ | | 107| 60| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 60] | | ------------------ ------------------ 370| 60| } 371| | 372| 180| mlk_assert_abs_bound(r0, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 180| do \ | | 106| 180| { \ | | 107| 180| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 180] | | ------------------ ------------------ 373| 180| mlk_assert_abs_bound(r1, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 180| do \ | | 106| 180| { \ | | 107| 180| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 180] | | ------------------ ------------------ 374| 180| mlk_assert_abs_bound(r2, MLKEM_N, MLKEM_ETA1 + 1); ------------------ | | 105| 180| do \ | | 106| 180| { \ | | 107| 180| } while (0) | | ------------------ | | | Branch (107:12): [Folded, False: 180] | | ------------------ ------------------ 375| | 376| | /* Specification: Partially implements 377| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 378| 180| mlk_zeroize(buf, sizeof(buf)); 379| 180| mlk_zeroize(extkey, sizeof(extkey)); 380| 180|} poly_k.c:PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_compress_du: 69| 180|{ 70| 180|#if MLKEM_DU == 10 71| 180| mlk_poly_compress_d10(r, a); ------------------ | | 357| 180|#define mlk_poly_compress_d10 MLK_NAMESPACE(poly_compress_d10) | | ------------------ | | | | 63| 180|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 180|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 180|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 72| |#elif MLKEM_DU == 11 73| | mlk_poly_compress_d11(r, a); 74| |#else 75| |#error "Invalid value of MLKEM_DU" 76| |#endif 77| 180|} poly_k.c:PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_decompress_du: 102| 90|{ 103| 90|#if MLKEM_DU == 10 104| 90| mlk_poly_decompress_d10(r, a); ------------------ | | 400| 90|#define mlk_poly_decompress_d10 MLK_NAMESPACE(poly_decompress_d10) | | ------------------ | | | | 63| 90|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 90|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 90|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 105| |#elif MLKEM_DU == 11 106| | mlk_poly_decompress_d11(r, a); 107| |#else 108| |#error "Invalid value of MLKEM_DU" 109| |#endif 110| 90|} indcpa.c:PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_compress_dv: 132| 60|{ 133| 60|#if MLKEM_DV == 4 134| 60| mlk_poly_compress_d4(r, a); ------------------ | | 337| 60|#define mlk_poly_compress_d4 MLK_NAMESPACE(poly_compress_d4) | | ------------------ | | | | 63| 60|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 60|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 60|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 135| |#elif MLKEM_DV == 5 136| | mlk_poly_compress_d5(r, a); 137| |#else 138| |#error "Invalid value of MLKEM_DV" 139| |#endif 140| 60|} indcpa.c:PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_decompress_dv: 166| 30|{ 167| 30|#if MLKEM_DV == 4 168| 30| mlk_poly_decompress_d4(r, a); ------------------ | | 377| 30|#define mlk_poly_decompress_d4 MLK_NAMESPACE(poly_decompress_d4) | | ------------------ | | | | 63| 30|#define MLK_NAMESPACE(s) MLK_CONCAT(MLK_NAMESPACE_PREFIX, s) | | | | ------------------ | | | | | | 42| 30|#define MLK_CONCAT(x1, x2) MLK_CONCAT_(x1, x2) | | | | | | ------------------ | | | | | | | | 41| 30|#define MLK_CONCAT_(x1, x2) x1##x2 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 169| |#elif MLKEM_DV == 5 170| | mlk_poly_decompress_d5(r, a); 171| |#else 172| |#error "Invalid value of MLKEM_DV" 173| |#endif 174| 30|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_rej_uniform_x4: 158| 180|{ 159| | /* Temporary buffers for XOF output before rejection sampling */ 160| 180| MLK_ALIGN uint8_t ------------------ | | 190| 180|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 161| 180| buf[4][MLK_ALIGN_UP(MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE)]; 162| | 163| | /* Tracks the number of coefficients we have already sampled */ 164| 180| unsigned ctr[4]; 165| 180| mlk_xof_x4_ctx statex; ------------------ | | 51| 180|#define mlk_xof_x4_ctx mlk_shake128x4ctx | | ------------------ | | | | 13| 180|#define mlk_shake128x4ctx shake128x4ctx | | | | ------------------ | | | | | | 51| 180|#define shake128x4ctx shake128x4incctx | | | | | | ------------------ | | | | | | | | 18| 180|#define shake128x4incctx OQS_SHA3_shake128_x4_inc_ctx | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 166| 180| unsigned buflen; 167| | 168| 180| mlk_xof_x4_init(&statex); ------------------ | | 59| 180|#define mlk_xof_x4_init(CTX) mlk_shake128x4_init((CTX)) | | ------------------ | | | | 16| 180|#define mlk_shake128x4_init shake128x4_init | | | | ------------------ | | | | | | 52| 180|#define shake128x4_init shake128x4_inc_init | | | | | | ------------------ | | | | | | | | 19| 180|#define shake128x4_inc_init OQS_SHA3_shake128_x4_inc_init | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 169| 180| mlk_xof_x4_absorb(&statex, seed, MLKEM_SYMBYTES + 2); ------------------ | | 61| 180| mlk_shake128x4_absorb_once((CTX), (IN)[0], (IN)[1], (IN)[2], (IN)[3], \ | | ------------------ | | | | 14| 180|#define mlk_shake128x4_absorb_once shake128x4_absorb_once | | | | ------------------ | | | | | | 39| 180|#define shake128x4_absorb_once OQS_SHA3_shake128_x4_absorb_once | | | | ------------------ | | ------------------ | | 62| 180| (INBYTES)) ------------------ 170| | 171| | /* 172| | * Initially, squeeze heuristic number of MLKEM_GEN_MATRIX_NBLOCKS. 173| | * This should generate the matrix entries with high probability. 174| | */ 175| 180| mlk_xof_x4_squeezeblocks(buf, MLKEM_GEN_MATRIX_NBLOCKS, &statex); ------------------ | | 64| 180| mlk_shake128x4_squeezeblocks((BUF)[0], (BUF)[1], (BUF)[2], (BUF)[3], \ | | ------------------ | | | | 15| 180|#define mlk_shake128x4_squeezeblocks shake128x4_squeezeblocks | | | | ------------------ | | | | | | 46| 180| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | | | | | ------------------ | | | | | | | | 239| 180|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 65| 180| (NBLOCKS), (CTX)) ------------------ 176| 180| buflen = MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE; ------------------ | | 146| 180| ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 22| 180|#define MLKEM_N 256 | | ------------------ | | ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 23| 180|#define MLKEM_Q 3329 | | ------------------ | | ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 68| 180|#define MLK_XOF_RATE SHAKE128_RATE | | | | ------------------ | | | | | | 8| 180|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 180|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 147| 180| MLK_XOF_RATE) | | ------------------ | | | | 68| 180|#define MLK_XOF_RATE SHAKE128_RATE | | | | ------------------ | | | | | | 8| 180|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 180|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ buflen = MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE; ------------------ | | 68| 180|#define MLK_XOF_RATE SHAKE128_RATE | | ------------------ | | | | 8| 180|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | ------------------ | | | | | | 239| 180|#define OQS_SHA3_SHAKE128_RATE 168 | | | | ------------------ | | ------------------ ------------------ 177| 180| ctr[0] = mlk_rej_uniform(vec0->coeffs, MLKEM_N, 0, buf[0], buflen); ------------------ | | 22| 180|#define MLKEM_N 256 ------------------ 178| 180| ctr[1] = mlk_rej_uniform(vec1->coeffs, MLKEM_N, 0, buf[1], buflen); ------------------ | | 22| 180|#define MLKEM_N 256 ------------------ 179| 180| ctr[2] = mlk_rej_uniform(vec2->coeffs, MLKEM_N, 0, buf[2], buflen); ------------------ | | 22| 180|#define MLKEM_N 256 ------------------ 180| 180| ctr[3] = mlk_rej_uniform(vec3->coeffs, MLKEM_N, 0, buf[3], buflen); ------------------ | | 22| 180|#define MLKEM_N 256 ------------------ 181| | 182| | /* 183| | * So long as not all matrix entries have been generated, squeeze 184| | * one more block a time until we're done. 185| | */ 186| 180| buflen = MLK_XOF_RATE; ------------------ | | 68| 180|#define MLK_XOF_RATE SHAKE128_RATE | | ------------------ | | | | 8| 180|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | ------------------ | | | | | | 239| 180|#define OQS_SHA3_SHAKE128_RATE 168 | | | | ------------------ | | ------------------ ------------------ 187| 269| while (ctr[0] < MLKEM_N || ctr[1] < MLKEM_N || ctr[2] < MLKEM_N || ------------------ | | 22| 538|#define MLKEM_N 256 ------------------ while (ctr[0] < MLKEM_N || ctr[1] < MLKEM_N || ctr[2] < MLKEM_N || ------------------ | | 22| 511|#define MLKEM_N 256 ------------------ while (ctr[0] < MLKEM_N || ctr[1] < MLKEM_N || ctr[2] < MLKEM_N || ------------------ | | 22| 484|#define MLKEM_N 256 ------------------ | Branch (187:10): [True: 27, False: 242] | Branch (187:30): [True: 27, False: 215] | Branch (187:50): [True: 14, False: 201] ------------------ 188| 201| ctr[3] < MLKEM_N) ------------------ | | 22| 201|#define MLKEM_N 256 ------------------ | Branch (188:10): [True: 21, False: 180] ------------------ 189| 89| __loop__( 190| 89| assigns(ctr, statex, 191| 89| memory_slice(vec0, sizeof(mlk_poly)), 192| 89| memory_slice(vec1, sizeof(mlk_poly)), 193| 89| memory_slice(vec2, sizeof(mlk_poly)), 194| 89| memory_slice(vec3, sizeof(mlk_poly)), 195| 89| object_whole(buf)) 196| 89| invariant(ctr[0] <= MLKEM_N && ctr[1] <= MLKEM_N) 197| 89| invariant(ctr[2] <= MLKEM_N && ctr[3] <= MLKEM_N) 198| 89| invariant(array_bound(vec0->coeffs, 0, ctr[0], 0, MLKEM_Q)) 199| 89| invariant(array_bound(vec1->coeffs, 0, ctr[1], 0, MLKEM_Q)) 200| 89| invariant(array_bound(vec2->coeffs, 0, ctr[2], 0, MLKEM_Q)) 201| 89| invariant(array_bound(vec3->coeffs, 0, ctr[3], 0, MLKEM_Q))) 202| 89| { 203| 89| mlk_xof_x4_squeezeblocks(buf, 1, &statex); ------------------ | | 64| 89| mlk_shake128x4_squeezeblocks((BUF)[0], (BUF)[1], (BUF)[2], (BUF)[3], \ | | ------------------ | | | | 15| 89|#define mlk_shake128x4_squeezeblocks shake128x4_squeezeblocks | | | | ------------------ | | | | | | 46| 89| OQS_SHA3_shake128_x4_inc_squeeze(OUT0, OUT1, OUT2, OUT3, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | | | | | ------------------ | | | | | | | | 239| 89|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 65| 89| (NBLOCKS), (CTX)) ------------------ 204| 89| ctr[0] = mlk_rej_uniform(vec0->coeffs, MLKEM_N, ctr[0], buf[0], buflen); ------------------ | | 22| 89|#define MLKEM_N 256 ------------------ 205| 89| ctr[1] = mlk_rej_uniform(vec1->coeffs, MLKEM_N, ctr[1], buf[1], buflen); ------------------ | | 22| 89|#define MLKEM_N 256 ------------------ 206| 89| ctr[2] = mlk_rej_uniform(vec2->coeffs, MLKEM_N, ctr[2], buf[2], buflen); ------------------ | | 22| 89|#define MLKEM_N 256 ------------------ 207| 89| ctr[3] = mlk_rej_uniform(vec3->coeffs, MLKEM_N, ctr[3], buf[3], buflen); ------------------ | | 22| 89|#define MLKEM_N 256 ------------------ 208| 89| } 209| | 210| 180| mlk_xof_x4_release(&statex); ------------------ | | 66| 180|#define mlk_xof_x4_release(CTX) mlk_shake128x4_release((CTX)) | | ------------------ | | | | 17| 180|#define mlk_shake128x4_release shake128x4_release | | | | ------------------ | | | | | | 53| 180|#define shake128x4_release shake128x4_inc_ctx_release | | | | | | ------------------ | | | | | | | | 23| 180|#define shake128x4_inc_ctx_release OQS_SHA3_shake128_x4_inc_ctx_release | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 211| | 212| | /* Specification: Partially implements 213| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 214| 180| mlk_zeroize(buf, sizeof(buf)); 215| 180|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_rej_uniform: 220| 90|{ 221| 90| mlk_xof_ctx state; ------------------ | | 50| 90|#define mlk_xof_ctx mlk_shake128ctx | | ------------------ | | | | 13| 90|#define mlk_shake128ctx shake128ctx | | | | ------------------ | | | | | | 54| 90|#define shake128ctx shake128incctx | | | | | | ------------------ | | | | | | | | 38| 90|#define shake128incctx OQS_SHA3_shake128_inc_ctx | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 222| 90| MLK_ALIGN uint8_t buf[MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE]; ------------------ | | 190| 90|#define MLK_ALIGN __attribute__((aligned(MLK_DEFAULT_ALIGN))) ------------------ 223| 90| unsigned ctr, buflen; 224| | 225| 90| mlk_xof_init(&state); ------------------ | | 52| 90|#define mlk_xof_init(CTX) mlk_shake128_init((CTX)) | | ------------------ | | | | 16| 90|#define mlk_shake128_init shake128_init | | | | ------------------ | | | | | | 56| 90|#define shake128_init shake128_inc_init | | | | | | ------------------ | | | | | | | | 39| 90|#define shake128_inc_init OQS_SHA3_shake128_inc_init | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 226| 90| mlk_xof_absorb(&state, seed, MLKEM_SYMBYTES + 2); ------------------ | | 54| 90| mlk_shake128_absorb_once((CTX), (IN), (INBYTES)) | | ------------------ | | | | 14| 90|#define mlk_shake128_absorb_once shake128_absorb_once | | | | ------------------ | | | | | | 57| 90|#define shake128_absorb_once OQS_SHA3_shake128_absorb_once | | | | ------------------ | | ------------------ ------------------ 227| | 228| | /* Initially, squeeze + sample heuristic number of MLKEM_GEN_MATRIX_NBLOCKS. 229| | */ 230| | /* This should generate the matrix entry with high probability. */ 231| 90| mlk_xof_squeezeblocks(buf, MLKEM_GEN_MATRIX_NBLOCKS, &state); ------------------ | | 56| 90| mlk_shake128_squeezeblocks((BUF), (NBLOCKS), (CTX)) | | ------------------ | | | | 15| 90|#define mlk_shake128_squeezeblocks shake128_squeezeblocks | | | | ------------------ | | | | | | 64| 90| OQS_SHA3_shake128_inc_squeeze(OUT, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | | | | | ------------------ | | | | | | | | 239| 90|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 232| 90| buflen = MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE; ------------------ | | 146| 90| ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 22| 90|#define MLKEM_N 256 | | ------------------ | | ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 23| 90|#define MLKEM_Q 3329 | | ------------------ | | ((12 * MLKEM_N / 8 * ((uint32_t)1 << 12) / MLKEM_Q + MLK_XOF_RATE) / \ | | ------------------ | | | | 68| 90|#define MLK_XOF_RATE SHAKE128_RATE | | | | ------------------ | | | | | | 8| 90|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 90|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | 147| 90| MLK_XOF_RATE) | | ------------------ | | | | 68| 90|#define MLK_XOF_RATE SHAKE128_RATE | | | | ------------------ | | | | | | 8| 90|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | | | ------------------ | | | | | | | | 239| 90|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ buflen = MLKEM_GEN_MATRIX_NBLOCKS * MLK_XOF_RATE; ------------------ | | 68| 90|#define MLK_XOF_RATE SHAKE128_RATE | | ------------------ | | | | 8| 90|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | ------------------ | | | | | | 239| 90|#define OQS_SHA3_SHAKE128_RATE 168 | | | | ------------------ | | ------------------ ------------------ 233| 90| ctr = mlk_rej_uniform(entry->coeffs, MLKEM_N, 0, buf, buflen); ------------------ | | 22| 90|#define MLKEM_N 256 ------------------ 234| | 235| | /* Squeeze + sample one more block a time until we're done */ 236| 90| buflen = MLK_XOF_RATE; ------------------ | | 68| 90|#define MLK_XOF_RATE SHAKE128_RATE | | ------------------ | | | | 8| 90|#define SHAKE128_RATE OQS_SHA3_SHAKE128_RATE | | | | ------------------ | | | | | | 239| 90|#define OQS_SHA3_SHAKE128_RATE 168 | | | | ------------------ | | ------------------ ------------------ 237| 102| while (ctr < MLKEM_N) ------------------ | | 22| 102|#define MLKEM_N 256 ------------------ | Branch (237:10): [True: 12, False: 90] ------------------ 238| 12| __loop__( 239| 12| assigns(ctr, state, memory_slice(entry, sizeof(mlk_poly)), object_whole(buf)) 240| 12| invariant(ctr <= MLKEM_N) 241| 12| invariant(array_bound(entry->coeffs, 0, ctr, 0, MLKEM_Q))) 242| 12| { 243| 12| mlk_xof_squeezeblocks(buf, 1, &state); ------------------ | | 56| 12| mlk_shake128_squeezeblocks((BUF), (NBLOCKS), (CTX)) | | ------------------ | | | | 15| 12|#define mlk_shake128_squeezeblocks shake128_squeezeblocks | | | | ------------------ | | | | | | 64| 12| OQS_SHA3_shake128_inc_squeeze(OUT, (NBLOCKS)*OQS_SHA3_SHAKE128_RATE, STATE) | | | | | | ------------------ | | | | | | | | 239| 12|#define OQS_SHA3_SHAKE128_RATE 168 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 244| 12| ctr = mlk_rej_uniform(entry->coeffs, MLKEM_N, ctr, buf, buflen); ------------------ | | 22| 12|#define MLKEM_N 256 ------------------ 245| 12| } 246| | 247| 90| mlk_xof_release(&state); ------------------ | | 57| 90|#define mlk_xof_release(CTX) mlk_shake128_release((CTX)) | | ------------------ | | | | 17| 90|#define mlk_shake128_release shake128_release | | | | ------------------ | | | | | | 55| 90|#define shake128_release shake128_inc_ctx_release | | | | | | ------------------ | | | | | | | | 43| 90|#define shake128_inc_ctx_release OQS_SHA3_shake128_inc_ctx_release | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 248| | 249| | /* Specification: Partially implements 250| | * @[FIPS203, Section 3.3, Destruction of intermediate values] */ 251| 90| mlk_zeroize(buf, sizeof(buf)); 252| 90|} PQCP_MLKEM_NATIVE_MLKEM768_X86_64_poly_cbd2: 276| 600|{ 277| 600| unsigned i; 278| 19.8k| for (i = 0; i < MLKEM_N / 8; i++) ------------------ | | 22| 19.8k|#define MLKEM_N 256 ------------------ | Branch (278:15): [True: 19.2k, False: 600] ------------------ 279| 19.2k| __loop__( 280| 19.2k| invariant(i <= MLKEM_N / 8) 281| 19.2k| invariant(array_abs_bound(r->coeffs, 0, 8 * i, 3)) 282| 19.2k| decreases(MLKEM_N / 8 - i)) 283| 19.2k| { 284| 19.2k| unsigned j; 285| 19.2k| uint32_t t = mlk_load32_littleendian(buf + 4 * i); 286| 19.2k| uint32_t d = t & 0x55555555; 287| 19.2k| d += (t >> 1) & 0x55555555; 288| | 289| 172k| for (j = 0; j < 8; j++) ------------------ | Branch (289:17): [True: 153k, False: 19.2k] ------------------ 290| 153k| __loop__( 291| 153k| invariant(i <= MLKEM_N / 8 && j <= 8) 292| 153k| invariant(array_abs_bound(r->coeffs, 0, 8 * i + j, 3)) 293| 153k| decreases(8 - j)) 294| 153k| { 295| | /* Safety: The & 0x3 masks each value to 2 bits (range [0, 3]), so the 296| | * truncation and subsequent subtraction in int16_t is lossless. */ 297| 153k| const int16_t a = (int16_t)((d >> (4 * j + 0)) & 0x3); 298| 153k| const int16_t b = (int16_t)((d >> (4 * j + 2)) & 0x3); 299| 153k| r->coeffs[8 * i + j] = (int16_t)(a - b); 300| 153k| } 301| 19.2k| } 302| 600|} OQS_KEM_ntru_hps2048509_new: 9| 191|OQS_KEM *OQS_KEM_ntru_hps2048509_new(void) { 10| | 11| 191| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 191| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 191] ------------------ 13| 0| return NULL; 14| 0| } 15| 191| kem->method_name = OQS_KEM_alg_ntru_hps2048509; ------------------ | | 81| 191|#define OQS_KEM_alg_ntru_hps2048509 "NTRU-HPS-2048-509" ------------------ 16| 191| kem->alg_version = "https://github.com/jschanck/ntru/tree/6d96ed37 reference implementation"; 17| | 18| 191| kem->claimed_nist_level = 1; 19| 191| kem->ind_cca = true; 20| | 21| 191| kem->length_public_key = OQS_KEM_ntru_hps2048509_length_public_key; ------------------ | | 9| 191|#define OQS_KEM_ntru_hps2048509_length_public_key 699 ------------------ 22| 191| kem->length_secret_key = OQS_KEM_ntru_hps2048509_length_secret_key; ------------------ | | 10| 191|#define OQS_KEM_ntru_hps2048509_length_secret_key 935 ------------------ 23| 191| kem->length_ciphertext = OQS_KEM_ntru_hps2048509_length_ciphertext; ------------------ | | 11| 191|#define OQS_KEM_ntru_hps2048509_length_ciphertext 699 ------------------ 24| 191| kem->length_shared_secret = OQS_KEM_ntru_hps2048509_length_shared_secret; ------------------ | | 12| 191|#define OQS_KEM_ntru_hps2048509_length_shared_secret 32 ------------------ 25| 191| kem->length_keypair_seed = OQS_KEM_ntru_hps2048509_length_keypair_seed; ------------------ | | 13| 191|#define OQS_KEM_ntru_hps2048509_length_keypair_seed 0 ------------------ 26| 191| kem->length_encaps_seed = OQS_KEM_ntru_hps2048509_length_encaps_seed; ------------------ | | 14| 191|#define OQS_KEM_ntru_hps2048509_length_encaps_seed 0 ------------------ 27| | 28| 191| kem->keypair = OQS_KEM_ntru_hps2048509_keypair; 29| 191| kem->keypair_derand = OQS_KEM_ntru_hps2048509_keypair_derand; 30| 191| kem->encaps = OQS_KEM_ntru_hps2048509_encaps; 31| 191| kem->encaps_derand = OQS_KEM_ntru_hps2048509_encaps_derand; 32| 191| kem->decaps = OQS_KEM_ntru_hps2048509_decaps; 33| | 34| 191| return kem; 35| 191|} OQS_KEM_ntru_hps2048509_keypair: 47| 191|OQS_API OQS_STATUS OQS_KEM_ntru_hps2048509_keypair(uint8_t *public_key, uint8_t *secret_key) { 48| 191|#if defined(OQS_ENABLE_KEM_ntru_hps2048509_avx2) 49| 191|#if defined(OQS_DIST_BUILD) 50| 191| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (50:6): [True: 191, False: 0] | Branch (50:49): [True: 191, False: 0] ------------------ 51| 191|#endif /* OQS_DIST_BUILD */ 52| 191| return (OQS_STATUS) PQCLEAN_NTRUHPS2048509_AVX2_crypto_kem_keypair(public_key, secret_key); 53| 191|#if defined(OQS_DIST_BUILD) 54| 191| } else { 55| 0| return (OQS_STATUS) PQCLEAN_NTRUHPS2048509_CLEAN_crypto_kem_keypair(public_key, secret_key); 56| 0| } 57| 191|#endif /* OQS_DIST_BUILD */ 58| |#else 59| | return (OQS_STATUS) PQCLEAN_NTRUHPS2048509_CLEAN_crypto_kem_keypair(public_key, secret_key); 60| |#endif 61| 191|} OQS_KEM_ntru_hps2048509_encaps: 78| 191|OQS_API OQS_STATUS OQS_KEM_ntru_hps2048509_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 191|#if defined(OQS_ENABLE_KEM_ntru_hps2048509_avx2) 80| 191|#if defined(OQS_DIST_BUILD) 81| 191| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (81:6): [True: 191, False: 0] | Branch (81:49): [True: 191, False: 0] ------------------ 82| 191|#endif /* OQS_DIST_BUILD */ 83| 191| return (OQS_STATUS) PQCLEAN_NTRUHPS2048509_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 191|#if defined(OQS_DIST_BUILD) 85| 191| } else { 86| 0| return (OQS_STATUS) PQCLEAN_NTRUHPS2048509_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 191|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_NTRUHPS2048509_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 191|} OQS_KEM_ntru_hps2048509_decaps: 94| 191|OQS_API OQS_STATUS OQS_KEM_ntru_hps2048509_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 191|#if defined(OQS_ENABLE_KEM_ntru_hps2048509_avx2) 96| 191|#if defined(OQS_DIST_BUILD) 97| 191| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (97:6): [True: 191, False: 0] | Branch (97:49): [True: 191, False: 0] ------------------ 98| 191|#endif /* OQS_DIST_BUILD */ 99| 191| return (OQS_STATUS) PQCLEAN_NTRUHPS2048509_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 191|#if defined(OQS_DIST_BUILD) 101| 191| } else { 102| 0| return (OQS_STATUS) PQCLEAN_NTRUHPS2048509_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 191|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_NTRUHPS2048509_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 191|} OQS_KEM_ntru_hps2048677_new: 9| 18|OQS_KEM *OQS_KEM_ntru_hps2048677_new(void) { 10| | 11| 18| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 18| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 18] ------------------ 13| 0| return NULL; 14| 0| } 15| 18| kem->method_name = OQS_KEM_alg_ntru_hps2048677; ------------------ | | 83| 18|#define OQS_KEM_alg_ntru_hps2048677 "NTRU-HPS-2048-677" ------------------ 16| 18| kem->alg_version = "https://github.com/jschanck/ntru/tree/6d96ed37 reference implementation"; 17| | 18| 18| kem->claimed_nist_level = 3; 19| 18| kem->ind_cca = true; 20| | 21| 18| kem->length_public_key = OQS_KEM_ntru_hps2048677_length_public_key; ------------------ | | 24| 18|#define OQS_KEM_ntru_hps2048677_length_public_key 930 ------------------ 22| 18| kem->length_secret_key = OQS_KEM_ntru_hps2048677_length_secret_key; ------------------ | | 25| 18|#define OQS_KEM_ntru_hps2048677_length_secret_key 1234 ------------------ 23| 18| kem->length_ciphertext = OQS_KEM_ntru_hps2048677_length_ciphertext; ------------------ | | 26| 18|#define OQS_KEM_ntru_hps2048677_length_ciphertext 930 ------------------ 24| 18| kem->length_shared_secret = OQS_KEM_ntru_hps2048677_length_shared_secret; ------------------ | | 27| 18|#define OQS_KEM_ntru_hps2048677_length_shared_secret 32 ------------------ 25| 18| kem->length_keypair_seed = OQS_KEM_ntru_hps2048677_length_keypair_seed; ------------------ | | 28| 18|#define OQS_KEM_ntru_hps2048677_length_keypair_seed 0 ------------------ 26| 18| kem->length_encaps_seed = OQS_KEM_ntru_hps2048677_length_encaps_seed; ------------------ | | 29| 18|#define OQS_KEM_ntru_hps2048677_length_encaps_seed 0 ------------------ 27| | 28| 18| kem->keypair = OQS_KEM_ntru_hps2048677_keypair; 29| 18| kem->keypair_derand = OQS_KEM_ntru_hps2048677_keypair_derand; 30| 18| kem->encaps = OQS_KEM_ntru_hps2048677_encaps; 31| 18| kem->encaps_derand = OQS_KEM_ntru_hps2048677_encaps_derand; 32| 18| kem->decaps = OQS_KEM_ntru_hps2048677_decaps; 33| | 34| 18| return kem; 35| 18|} OQS_KEM_ntru_hps2048677_keypair: 47| 18|OQS_API OQS_STATUS OQS_KEM_ntru_hps2048677_keypair(uint8_t *public_key, uint8_t *secret_key) { 48| 18|#if defined(OQS_ENABLE_KEM_ntru_hps2048677_avx2) 49| 18|#if defined(OQS_DIST_BUILD) 50| 18| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (50:6): [True: 18, False: 0] | Branch (50:49): [True: 18, False: 0] ------------------ 51| 18|#endif /* OQS_DIST_BUILD */ 52| 18| return (OQS_STATUS) PQCLEAN_NTRUHPS2048677_AVX2_crypto_kem_keypair(public_key, secret_key); 53| 18|#if defined(OQS_DIST_BUILD) 54| 18| } else { 55| 0| return (OQS_STATUS) PQCLEAN_NTRUHPS2048677_CLEAN_crypto_kem_keypair(public_key, secret_key); 56| 0| } 57| 18|#endif /* OQS_DIST_BUILD */ 58| |#else 59| | return (OQS_STATUS) PQCLEAN_NTRUHPS2048677_CLEAN_crypto_kem_keypair(public_key, secret_key); 60| |#endif 61| 18|} OQS_KEM_ntru_hps2048677_encaps: 78| 18|OQS_API OQS_STATUS OQS_KEM_ntru_hps2048677_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 18|#if defined(OQS_ENABLE_KEM_ntru_hps2048677_avx2) 80| 18|#if defined(OQS_DIST_BUILD) 81| 18| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (81:6): [True: 18, False: 0] | Branch (81:49): [True: 18, False: 0] ------------------ 82| 18|#endif /* OQS_DIST_BUILD */ 83| 18| return (OQS_STATUS) PQCLEAN_NTRUHPS2048677_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 18|#if defined(OQS_DIST_BUILD) 85| 18| } else { 86| 0| return (OQS_STATUS) PQCLEAN_NTRUHPS2048677_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 18|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_NTRUHPS2048677_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 18|} OQS_KEM_ntru_hps2048677_decaps: 94| 18|OQS_API OQS_STATUS OQS_KEM_ntru_hps2048677_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 18|#if defined(OQS_ENABLE_KEM_ntru_hps2048677_avx2) 96| 18|#if defined(OQS_DIST_BUILD) 97| 18| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (97:6): [True: 18, False: 0] | Branch (97:49): [True: 18, False: 0] ------------------ 98| 18|#endif /* OQS_DIST_BUILD */ 99| 18| return (OQS_STATUS) PQCLEAN_NTRUHPS2048677_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 18|#if defined(OQS_DIST_BUILD) 101| 18| } else { 102| 0| return (OQS_STATUS) PQCLEAN_NTRUHPS2048677_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 18|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_NTRUHPS2048677_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 18|} OQS_KEM_ntru_hps40961229_new: 9| 33|OQS_KEM *OQS_KEM_ntru_hps40961229_new(void) { 10| | 11| 33| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 33| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 33] ------------------ 13| 0| return NULL; 14| 0| } 15| 33| kem->method_name = OQS_KEM_alg_ntru_hps40961229; ------------------ | | 87| 33|#define OQS_KEM_alg_ntru_hps40961229 "NTRU-HPS-4096-1229" ------------------ 16| 33| kem->alg_version = "https://github.com/jschanck/ntru/tree/6d96ed37 reference implementation"; 17| | 18| 33| kem->claimed_nist_level = 5; 19| 33| kem->ind_cca = true; 20| | 21| 33| kem->length_public_key = OQS_KEM_ntru_hps40961229_length_public_key; ------------------ | | 54| 33|#define OQS_KEM_ntru_hps40961229_length_public_key 1842 ------------------ 22| 33| kem->length_secret_key = OQS_KEM_ntru_hps40961229_length_secret_key; ------------------ | | 55| 33|#define OQS_KEM_ntru_hps40961229_length_secret_key 2366 ------------------ 23| 33| kem->length_ciphertext = OQS_KEM_ntru_hps40961229_length_ciphertext; ------------------ | | 56| 33|#define OQS_KEM_ntru_hps40961229_length_ciphertext 1842 ------------------ 24| 33| kem->length_shared_secret = OQS_KEM_ntru_hps40961229_length_shared_secret; ------------------ | | 57| 33|#define OQS_KEM_ntru_hps40961229_length_shared_secret 32 ------------------ 25| 33| kem->length_keypair_seed = OQS_KEM_ntru_hps40961229_length_keypair_seed; ------------------ | | 58| 33|#define OQS_KEM_ntru_hps40961229_length_keypair_seed 0 ------------------ 26| 33| kem->length_encaps_seed = OQS_KEM_ntru_hps40961229_length_encaps_seed; ------------------ | | 59| 33|#define OQS_KEM_ntru_hps40961229_length_encaps_seed 0 ------------------ 27| | 28| 33| kem->keypair = OQS_KEM_ntru_hps40961229_keypair; 29| 33| kem->keypair_derand = OQS_KEM_ntru_hps40961229_keypair_derand; 30| 33| kem->encaps = OQS_KEM_ntru_hps40961229_encaps; 31| 33| kem->encaps_derand = OQS_KEM_ntru_hps40961229_encaps_derand; 32| 33| kem->decaps = OQS_KEM_ntru_hps40961229_decaps; 33| | 34| 33| return kem; 35| 33|} OQS_KEM_ntru_hps40961229_keypair: 41| 33|OQS_API OQS_STATUS OQS_KEM_ntru_hps40961229_keypair(uint8_t *public_key, uint8_t *secret_key) { 42| 33| return (OQS_STATUS) PQCLEAN_NTRUHPS40961229_CLEAN_crypto_kem_keypair(public_key, secret_key); 43| 33|} OQS_KEM_ntru_hps40961229_encaps: 60| 33|OQS_API OQS_STATUS OQS_KEM_ntru_hps40961229_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 61| 33| return (OQS_STATUS) PQCLEAN_NTRUHPS40961229_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 62| 33|} OQS_KEM_ntru_hps40961229_decaps: 64| 33|OQS_API OQS_STATUS OQS_KEM_ntru_hps40961229_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 65| 33| return (OQS_STATUS) PQCLEAN_NTRUHPS40961229_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 66| 33|} OQS_KEM_ntru_hps4096821_new: 9| 95|OQS_KEM *OQS_KEM_ntru_hps4096821_new(void) { 10| | 11| 95| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 95| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 95] ------------------ 13| 0| return NULL; 14| 0| } 15| 95| kem->method_name = OQS_KEM_alg_ntru_hps4096821; ------------------ | | 85| 95|#define OQS_KEM_alg_ntru_hps4096821 "NTRU-HPS-4096-821" ------------------ 16| 95| kem->alg_version = "https://github.com/jschanck/ntru/tree/6d96ed37 reference implementation"; 17| | 18| 95| kem->claimed_nist_level = 5; 19| 95| kem->ind_cca = true; 20| | 21| 95| kem->length_public_key = OQS_KEM_ntru_hps4096821_length_public_key; ------------------ | | 39| 95|#define OQS_KEM_ntru_hps4096821_length_public_key 1230 ------------------ 22| 95| kem->length_secret_key = OQS_KEM_ntru_hps4096821_length_secret_key; ------------------ | | 40| 95|#define OQS_KEM_ntru_hps4096821_length_secret_key 1590 ------------------ 23| 95| kem->length_ciphertext = OQS_KEM_ntru_hps4096821_length_ciphertext; ------------------ | | 41| 95|#define OQS_KEM_ntru_hps4096821_length_ciphertext 1230 ------------------ 24| 95| kem->length_shared_secret = OQS_KEM_ntru_hps4096821_length_shared_secret; ------------------ | | 42| 95|#define OQS_KEM_ntru_hps4096821_length_shared_secret 32 ------------------ 25| 95| kem->length_keypair_seed = OQS_KEM_ntru_hps4096821_length_keypair_seed; ------------------ | | 43| 95|#define OQS_KEM_ntru_hps4096821_length_keypair_seed 0 ------------------ 26| 95| kem->length_encaps_seed = OQS_KEM_ntru_hps4096821_length_encaps_seed; ------------------ | | 44| 95|#define OQS_KEM_ntru_hps4096821_length_encaps_seed 0 ------------------ 27| | 28| 95| kem->keypair = OQS_KEM_ntru_hps4096821_keypair; 29| 95| kem->keypair_derand = OQS_KEM_ntru_hps4096821_keypair_derand; 30| 95| kem->encaps = OQS_KEM_ntru_hps4096821_encaps; 31| 95| kem->encaps_derand = OQS_KEM_ntru_hps4096821_encaps_derand; 32| 95| kem->decaps = OQS_KEM_ntru_hps4096821_decaps; 33| | 34| 95| return kem; 35| 95|} OQS_KEM_ntru_hps4096821_keypair: 47| 95|OQS_API OQS_STATUS OQS_KEM_ntru_hps4096821_keypair(uint8_t *public_key, uint8_t *secret_key) { 48| 95|#if defined(OQS_ENABLE_KEM_ntru_hps4096821_avx2) 49| 95|#if defined(OQS_DIST_BUILD) 50| 95| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (50:6): [True: 95, False: 0] | Branch (50:49): [True: 95, False: 0] ------------------ 51| 95|#endif /* OQS_DIST_BUILD */ 52| 95| return (OQS_STATUS) PQCLEAN_NTRUHPS4096821_AVX2_crypto_kem_keypair(public_key, secret_key); 53| 95|#if defined(OQS_DIST_BUILD) 54| 95| } else { 55| 0| return (OQS_STATUS) PQCLEAN_NTRUHPS4096821_CLEAN_crypto_kem_keypair(public_key, secret_key); 56| 0| } 57| 95|#endif /* OQS_DIST_BUILD */ 58| |#else 59| | return (OQS_STATUS) PQCLEAN_NTRUHPS4096821_CLEAN_crypto_kem_keypair(public_key, secret_key); 60| |#endif 61| 95|} OQS_KEM_ntru_hps4096821_encaps: 78| 95|OQS_API OQS_STATUS OQS_KEM_ntru_hps4096821_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 95|#if defined(OQS_ENABLE_KEM_ntru_hps4096821_avx2) 80| 95|#if defined(OQS_DIST_BUILD) 81| 95| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (81:6): [True: 95, False: 0] | Branch (81:49): [True: 95, False: 0] ------------------ 82| 95|#endif /* OQS_DIST_BUILD */ 83| 95| return (OQS_STATUS) PQCLEAN_NTRUHPS4096821_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 95|#if defined(OQS_DIST_BUILD) 85| 95| } else { 86| 0| return (OQS_STATUS) PQCLEAN_NTRUHPS4096821_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 95|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_NTRUHPS4096821_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 95|} OQS_KEM_ntru_hps4096821_decaps: 94| 95|OQS_API OQS_STATUS OQS_KEM_ntru_hps4096821_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 95|#if defined(OQS_ENABLE_KEM_ntru_hps4096821_avx2) 96| 95|#if defined(OQS_DIST_BUILD) 97| 95| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (97:6): [True: 95, False: 0] | Branch (97:49): [True: 95, False: 0] ------------------ 98| 95|#endif /* OQS_DIST_BUILD */ 99| 95| return (OQS_STATUS) PQCLEAN_NTRUHPS4096821_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 95|#if defined(OQS_DIST_BUILD) 101| 95| } else { 102| 0| return (OQS_STATUS) PQCLEAN_NTRUHPS4096821_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 95|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_NTRUHPS4096821_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 95|} OQS_KEM_ntru_hrss1373_new: 9| 2|OQS_KEM *OQS_KEM_ntru_hrss1373_new(void) { 10| | 11| 2| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 2| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 2] ------------------ 13| 0| return NULL; 14| 0| } 15| 2| kem->method_name = OQS_KEM_alg_ntru_hrss1373; ------------------ | | 91| 2|#define OQS_KEM_alg_ntru_hrss1373 "NTRU-HRSS-1373" ------------------ 16| 2| kem->alg_version = "https://github.com/jschanck/ntru/tree/6d96ed37 reference implementation"; 17| | 18| 2| kem->claimed_nist_level = 5; 19| 2| kem->ind_cca = true; 20| | 21| 2| kem->length_public_key = OQS_KEM_ntru_hrss1373_length_public_key; ------------------ | | 84| 2|#define OQS_KEM_ntru_hrss1373_length_public_key 2401 ------------------ 22| 2| kem->length_secret_key = OQS_KEM_ntru_hrss1373_length_secret_key; ------------------ | | 85| 2|#define OQS_KEM_ntru_hrss1373_length_secret_key 2983 ------------------ 23| 2| kem->length_ciphertext = OQS_KEM_ntru_hrss1373_length_ciphertext; ------------------ | | 86| 2|#define OQS_KEM_ntru_hrss1373_length_ciphertext 2401 ------------------ 24| 2| kem->length_shared_secret = OQS_KEM_ntru_hrss1373_length_shared_secret; ------------------ | | 87| 2|#define OQS_KEM_ntru_hrss1373_length_shared_secret 32 ------------------ 25| 2| kem->length_keypair_seed = OQS_KEM_ntru_hrss1373_length_keypair_seed; ------------------ | | 88| 2|#define OQS_KEM_ntru_hrss1373_length_keypair_seed 0 ------------------ 26| 2| kem->length_encaps_seed = OQS_KEM_ntru_hrss1373_length_encaps_seed; ------------------ | | 89| 2|#define OQS_KEM_ntru_hrss1373_length_encaps_seed 0 ------------------ 27| | 28| 2| kem->keypair = OQS_KEM_ntru_hrss1373_keypair; 29| 2| kem->keypair_derand = OQS_KEM_ntru_hrss1373_keypair_derand; 30| 2| kem->encaps = OQS_KEM_ntru_hrss1373_encaps; 31| 2| kem->encaps_derand = OQS_KEM_ntru_hrss1373_encaps_derand; 32| 2| kem->decaps = OQS_KEM_ntru_hrss1373_decaps; 33| | 34| 2| return kem; 35| 2|} OQS_KEM_ntru_hrss1373_keypair: 41| 2|OQS_API OQS_STATUS OQS_KEM_ntru_hrss1373_keypair(uint8_t *public_key, uint8_t *secret_key) { 42| 2| return (OQS_STATUS) PQCLEAN_NTRUHRSS1373_CLEAN_crypto_kem_keypair(public_key, secret_key); 43| 2|} OQS_KEM_ntru_hrss1373_encaps: 60| 2|OQS_API OQS_STATUS OQS_KEM_ntru_hrss1373_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 61| 2| return (OQS_STATUS) PQCLEAN_NTRUHRSS1373_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 62| 2|} OQS_KEM_ntru_hrss1373_decaps: 64| 2|OQS_API OQS_STATUS OQS_KEM_ntru_hrss1373_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 65| 2| return (OQS_STATUS) PQCLEAN_NTRUHRSS1373_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 66| 2|} OQS_KEM_ntru_hrss701_new: 9| 9|OQS_KEM *OQS_KEM_ntru_hrss701_new(void) { 10| | 11| 9| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 9| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 9] ------------------ 13| 0| return NULL; 14| 0| } 15| 9| kem->method_name = OQS_KEM_alg_ntru_hrss701; ------------------ | | 89| 9|#define OQS_KEM_alg_ntru_hrss701 "NTRU-HRSS-701" ------------------ 16| 9| kem->alg_version = "https://github.com/jschanck/ntru/tree/6d96ed37 reference implementation"; 17| | 18| 9| kem->claimed_nist_level = 3; 19| 9| kem->ind_cca = true; 20| | 21| 9| kem->length_public_key = OQS_KEM_ntru_hrss701_length_public_key; ------------------ | | 69| 9|#define OQS_KEM_ntru_hrss701_length_public_key 1138 ------------------ 22| 9| kem->length_secret_key = OQS_KEM_ntru_hrss701_length_secret_key; ------------------ | | 70| 9|#define OQS_KEM_ntru_hrss701_length_secret_key 1450 ------------------ 23| 9| kem->length_ciphertext = OQS_KEM_ntru_hrss701_length_ciphertext; ------------------ | | 71| 9|#define OQS_KEM_ntru_hrss701_length_ciphertext 1138 ------------------ 24| 9| kem->length_shared_secret = OQS_KEM_ntru_hrss701_length_shared_secret; ------------------ | | 72| 9|#define OQS_KEM_ntru_hrss701_length_shared_secret 32 ------------------ 25| 9| kem->length_keypair_seed = OQS_KEM_ntru_hrss701_length_keypair_seed; ------------------ | | 73| 9|#define OQS_KEM_ntru_hrss701_length_keypair_seed 0 ------------------ 26| 9| kem->length_encaps_seed = OQS_KEM_ntru_hrss701_length_encaps_seed; ------------------ | | 74| 9|#define OQS_KEM_ntru_hrss701_length_encaps_seed 0 ------------------ 27| | 28| 9| kem->keypair = OQS_KEM_ntru_hrss701_keypair; 29| 9| kem->keypair_derand = OQS_KEM_ntru_hrss701_keypair_derand; 30| 9| kem->encaps = OQS_KEM_ntru_hrss701_encaps; 31| 9| kem->encaps_derand = OQS_KEM_ntru_hrss701_encaps_derand; 32| 9| kem->decaps = OQS_KEM_ntru_hrss701_decaps; 33| | 34| 9| return kem; 35| 9|} OQS_KEM_ntru_hrss701_keypair: 47| 9|OQS_API OQS_STATUS OQS_KEM_ntru_hrss701_keypair(uint8_t *public_key, uint8_t *secret_key) { 48| 9|#if defined(OQS_ENABLE_KEM_ntru_hrss701_avx2) 49| 9|#if defined(OQS_DIST_BUILD) 50| 9| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (50:6): [True: 9, False: 0] | Branch (50:49): [True: 9, False: 0] ------------------ 51| 9|#endif /* OQS_DIST_BUILD */ 52| 9| return (OQS_STATUS) PQCLEAN_NTRUHRSS701_AVX2_crypto_kem_keypair(public_key, secret_key); 53| 9|#if defined(OQS_DIST_BUILD) 54| 9| } else { 55| 0| return (OQS_STATUS) PQCLEAN_NTRUHRSS701_CLEAN_crypto_kem_keypair(public_key, secret_key); 56| 0| } 57| 9|#endif /* OQS_DIST_BUILD */ 58| |#else 59| | return (OQS_STATUS) PQCLEAN_NTRUHRSS701_CLEAN_crypto_kem_keypair(public_key, secret_key); 60| |#endif 61| 9|} OQS_KEM_ntru_hrss701_encaps: 78| 9|OQS_API OQS_STATUS OQS_KEM_ntru_hrss701_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 79| 9|#if defined(OQS_ENABLE_KEM_ntru_hrss701_avx2) 80| 9|#if defined(OQS_DIST_BUILD) 81| 9| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (81:6): [True: 9, False: 0] | Branch (81:49): [True: 9, False: 0] ------------------ 82| 9|#endif /* OQS_DIST_BUILD */ 83| 9| return (OQS_STATUS) PQCLEAN_NTRUHRSS701_AVX2_crypto_kem_enc(ciphertext, shared_secret, public_key); 84| 9|#if defined(OQS_DIST_BUILD) 85| 9| } else { 86| 0| return (OQS_STATUS) PQCLEAN_NTRUHRSS701_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 87| 0| } 88| 9|#endif /* OQS_DIST_BUILD */ 89| |#else 90| | return (OQS_STATUS) PQCLEAN_NTRUHRSS701_CLEAN_crypto_kem_enc(ciphertext, shared_secret, public_key); 91| |#endif 92| 9|} OQS_KEM_ntru_hrss701_decaps: 94| 9|OQS_API OQS_STATUS OQS_KEM_ntru_hrss701_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 95| 9|#if defined(OQS_ENABLE_KEM_ntru_hrss701_avx2) 96| 9|#if defined(OQS_DIST_BUILD) 97| 9| if (OQS_CPU_has_extension(OQS_CPU_EXT_AVX2) && OQS_CPU_has_extension(OQS_CPU_EXT_BMI2)) { ------------------ | Branch (97:6): [True: 9, False: 0] | Branch (97:49): [True: 9, False: 0] ------------------ 98| 9|#endif /* OQS_DIST_BUILD */ 99| 9| return (OQS_STATUS) PQCLEAN_NTRUHRSS701_AVX2_crypto_kem_dec(shared_secret, ciphertext, secret_key); 100| 9|#if defined(OQS_DIST_BUILD) 101| 9| } else { 102| 0| return (OQS_STATUS) PQCLEAN_NTRUHRSS701_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 103| 0| } 104| 9|#endif /* OQS_DIST_BUILD */ 105| |#else 106| | return (OQS_STATUS) PQCLEAN_NTRUHRSS701_CLEAN_crypto_kem_dec(shared_secret, ciphertext, secret_key); 107| |#endif 108| 9|} PQCLEAN_NTRUHPS2048509_AVX2_cmov: 4| 191|void PQCLEAN_NTRUHPS2048509_AVX2_cmov(unsigned char *r, const unsigned char *x, size_t len, unsigned char b) { 5| 191| size_t i; 6| | 7| 191| b = (~b + 1); 8| 6.30k| for (i = 0; i < len; i++) { ------------------ | Branch (8:17): [True: 6.11k, False: 191] ------------------ 9| 6.11k| r[i] ^= b & (x[i] ^ r[i]); 10| 6.11k| } 11| 191|} PQCLEAN_NTRUHPS2048509_AVX2_crypto_sort_int32: 903| 764|void PQCLEAN_NTRUHPS2048509_AVX2_crypto_sort_int32(int32 *x, size_t n) { 904| 764| size_t q, i, j; 905| | 906| 764| if (n <= 8) { ------------------ | Branch (906:9): [True: 0, False: 764] ------------------ 907| 0| if (n == 8) { ------------------ | Branch (907:13): [True: 0, False: 0] ------------------ 908| 0| int32_MINMAX(&x[0], &x[1]); 909| 0| int32_MINMAX(&x[1], &x[2]); 910| 0| int32_MINMAX(&x[2], &x[3]); 911| 0| int32_MINMAX(&x[3], &x[4]); 912| 0| int32_MINMAX(&x[4], &x[5]); 913| 0| int32_MINMAX(&x[5], &x[6]); 914| 0| int32_MINMAX(&x[6], &x[7]); 915| 0| } 916| 0| if (n >= 7) { ------------------ | Branch (916:13): [True: 0, False: 0] ------------------ 917| 0| int32_MINMAX(&x[0], &x[1]); 918| 0| int32_MINMAX(&x[1], &x[2]); 919| 0| int32_MINMAX(&x[2], &x[3]); 920| 0| int32_MINMAX(&x[3], &x[4]); 921| 0| int32_MINMAX(&x[4], &x[5]); 922| 0| int32_MINMAX(&x[5], &x[6]); 923| 0| } 924| 0| if (n >= 6) { ------------------ | Branch (924:13): [True: 0, False: 0] ------------------ 925| 0| int32_MINMAX(&x[0], &x[1]); 926| 0| int32_MINMAX(&x[1], &x[2]); 927| 0| int32_MINMAX(&x[2], &x[3]); 928| 0| int32_MINMAX(&x[3], &x[4]); 929| 0| int32_MINMAX(&x[4], &x[5]); 930| 0| } 931| 0| if (n >= 5) { ------------------ | Branch (931:13): [True: 0, False: 0] ------------------ 932| 0| int32_MINMAX(&x[0], &x[1]); 933| 0| int32_MINMAX(&x[1], &x[2]); 934| 0| int32_MINMAX(&x[2], &x[3]); 935| 0| int32_MINMAX(&x[3], &x[4]); 936| 0| } 937| 0| if (n >= 4) { ------------------ | Branch (937:13): [True: 0, False: 0] ------------------ 938| 0| int32_MINMAX(&x[0], &x[1]); 939| 0| int32_MINMAX(&x[1], &x[2]); 940| 0| int32_MINMAX(&x[2], &x[3]); 941| 0| } 942| 0| if (n >= 3) { ------------------ | Branch (942:13): [True: 0, False: 0] ------------------ 943| 0| int32_MINMAX(&x[0], &x[1]); 944| 0| int32_MINMAX(&x[1], &x[2]); 945| 0| } 946| 0| if (n >= 2) { ------------------ | Branch (946:13): [True: 0, False: 0] ------------------ 947| 0| int32_MINMAX(&x[0], &x[1]); 948| 0| } 949| 0| return; 950| 0| } 951| | 952| 764| if (!(n & (n - 1))) { ------------------ | Branch (952:9): [True: 0, False: 764] ------------------ 953| 0| int32_sort_2power(x, n, 0); 954| 0| return; 955| 0| } 956| | 957| 764| q = 8; 958| 4.20k| while (q < n - q) { ------------------ | Branch (958:12): [True: 3.43k, False: 764] ------------------ 959| 3.43k| q += q; 960| 3.43k| } 961| | /* n > q >= 8 */ 962| | 963| 764| if (q <= 128) { /* n <= 256 */ ------------------ | Branch (963:9): [True: 382, False: 382] ------------------ 964| 382| int32x8 y[32]; 965| 6.49k| for (i = q >> 3; i < q >> 2; ++i) { ------------------ | Branch (965:26): [True: 6.11k, False: 382] ------------------ 966| 6.11k| y[i] = _mm256_set1_epi32(0x7fffffff); 967| 6.11k| } 968| 96.6k| for (i = 0; i < n; ++i) { ------------------ | Branch (968:21): [True: 96.2k, False: 382] ------------------ 969| 96.2k| ((int32 *) y)[i] = x[i]; 970| 96.2k| } 971| 382| int32_sort_2power((int32 *) y, 2 * q, 0); 972| 96.6k| for (i = 0; i < n; ++i) { ------------------ | Branch (972:21): [True: 96.2k, False: 382] ------------------ 973| 96.2k| x[i] = ((int32 *) y)[i]; 974| 96.2k| } 975| 382| return; 976| 382| } 977| | 978| 382| int32_sort_2power(x, q, 1); 979| 382| PQCLEAN_NTRUHPS2048509_AVX2_crypto_sort_int32(x + q, n - q); 980| | 981| 764| while (q >= 64) { ------------------ | Branch (981:12): [True: 382, False: 382] ------------------ 982| 382| q >>= 2; 983| 382| j = int32_threestages(x, n, q); 984| 382| minmax_vector(x + j, x + j + 4 * q, n - 4 * q - j); 985| 382| if (j + 4 * q <= n) { ------------------ | Branch (985:13): [True: 382, False: 0] ------------------ 986| 3.43k| for (i = j; i < j + q; i += 8) { ------------------ | Branch (986:25): [True: 3.05k, False: 382] ------------------ 987| 3.05k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 3.05k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 988| 3.05k| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 3.05k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 989| 3.05k| int32x8 x2 = int32x8_load(&x[i + 2 * q]); ------------------ | | 9| 3.05k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 990| 3.05k| int32x8 x3 = int32x8_load(&x[i + 3 * q]); ------------------ | | 9| 3.05k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 991| 3.05k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 3.05k| do { \ | | 16| 3.05k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 3.05k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 3.05k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 3.05k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 3.05k| (a) = c; \ | | 19| 3.05k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.05k] | | ------------------ ------------------ 992| 3.05k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 3.05k| do { \ | | 16| 3.05k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 3.05k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 3.05k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 3.05k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 3.05k| (a) = c; \ | | 19| 3.05k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.05k] | | ------------------ ------------------ 993| 3.05k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 3.05k| do { \ | | 16| 3.05k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 3.05k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 3.05k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 3.05k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 3.05k| (a) = c; \ | | 19| 3.05k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.05k] | | ------------------ ------------------ 994| 3.05k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 3.05k| do { \ | | 16| 3.05k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 3.05k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 3.05k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 3.05k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 3.05k| (a) = c; \ | | 19| 3.05k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.05k] | | ------------------ ------------------ 995| 3.05k| int32x8_store(&x[i], x0); ------------------ | | 10| 3.05k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 996| 3.05k| int32x8_store(&x[i + q], x1); ------------------ | | 10| 3.05k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 997| 3.05k| int32x8_store(&x[i + 2 * q], x2); ------------------ | | 10| 3.05k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 998| 3.05k| int32x8_store(&x[i + 3 * q], x3); ------------------ | | 10| 3.05k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 999| 3.05k| } 1000| 382| j += 4 * q; 1001| 382| } 1002| 382| minmax_vector(x + j, x + j + 2 * q, n - 2 * q - j); 1003| 382| if (j + 2 * q <= n) { ------------------ | Branch (1003:13): [True: 382, False: 0] ------------------ 1004| 3.43k| for (i = j; i < j + q; i += 8) { ------------------ | Branch (1004:25): [True: 3.05k, False: 382] ------------------ 1005| 3.05k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 3.05k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1006| 3.05k| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 3.05k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1007| 3.05k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 3.05k| do { \ | | 16| 3.05k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 3.05k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 3.05k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 3.05k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 3.05k| (a) = c; \ | | 19| 3.05k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.05k] | | ------------------ ------------------ 1008| 3.05k| int32x8_store(&x[i], x0); ------------------ | | 10| 3.05k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1009| 3.05k| int32x8_store(&x[i + q], x1); ------------------ | | 10| 3.05k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1010| 3.05k| } 1011| 382| j += 2 * q; 1012| 382| } 1013| 382| minmax_vector(x + j, x + j + q, n - q - j); 1014| 382| q >>= 1; 1015| 382| } 1016| 382| if (q == 32) { ------------------ | Branch (1016:9): [True: 382, False: 0] ------------------ 1017| 382| j = 0; 1018| 3.05k| for (; j + 64 <= n; j += 64) { ------------------ | Branch (1018:16): [True: 2.67k, False: 382] ------------------ 1019| 2.67k| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 2.67k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1020| 2.67k| int32x8 x1 = int32x8_load(&x[j + 8]); ------------------ | | 9| 2.67k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1021| 2.67k| int32x8 x2 = int32x8_load(&x[j + 16]); ------------------ | | 9| 2.67k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1022| 2.67k| int32x8 x3 = int32x8_load(&x[j + 24]); ------------------ | | 9| 2.67k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1023| 2.67k| int32x8 x4 = int32x8_load(&x[j + 32]); ------------------ | | 9| 2.67k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1024| 2.67k| int32x8 x5 = int32x8_load(&x[j + 40]); ------------------ | | 9| 2.67k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1025| 2.67k| int32x8 x6 = int32x8_load(&x[j + 48]); ------------------ | | 9| 2.67k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1026| 2.67k| int32x8 x7 = int32x8_load(&x[j + 56]); ------------------ | | 9| 2.67k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1027| 2.67k| int32x8_MINMAX(x0, x4); ------------------ | | 15| 2.67k| do { \ | | 16| 2.67k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.67k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.67k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.67k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.67k| (a) = c; \ | | 19| 2.67k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.67k] | | ------------------ ------------------ 1028| 2.67k| int32x8_MINMAX(x1, x5); ------------------ | | 15| 2.67k| do { \ | | 16| 2.67k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.67k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.67k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.67k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.67k| (a) = c; \ | | 19| 2.67k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.67k] | | ------------------ ------------------ 1029| 2.67k| int32x8_MINMAX(x2, x6); ------------------ | | 15| 2.67k| do { \ | | 16| 2.67k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.67k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.67k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.67k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.67k| (a) = c; \ | | 19| 2.67k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.67k] | | ------------------ ------------------ 1030| 2.67k| int32x8_MINMAX(x3, x7); ------------------ | | 15| 2.67k| do { \ | | 16| 2.67k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.67k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.67k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.67k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.67k| (a) = c; \ | | 19| 2.67k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.67k] | | ------------------ ------------------ 1031| 2.67k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 2.67k| do { \ | | 16| 2.67k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.67k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.67k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.67k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.67k| (a) = c; \ | | 19| 2.67k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.67k] | | ------------------ ------------------ 1032| 2.67k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 2.67k| do { \ | | 16| 2.67k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.67k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.67k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.67k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.67k| (a) = c; \ | | 19| 2.67k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.67k] | | ------------------ ------------------ 1033| 2.67k| int32x8_MINMAX(x4, x6); ------------------ | | 15| 2.67k| do { \ | | 16| 2.67k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.67k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.67k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.67k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.67k| (a) = c; \ | | 19| 2.67k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.67k] | | ------------------ ------------------ 1034| 2.67k| int32x8_MINMAX(x5, x7); ------------------ | | 15| 2.67k| do { \ | | 16| 2.67k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.67k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.67k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.67k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.67k| (a) = c; \ | | 19| 2.67k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.67k] | | ------------------ ------------------ 1035| 2.67k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 2.67k| do { \ | | 16| 2.67k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.67k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.67k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.67k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.67k| (a) = c; \ | | 19| 2.67k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.67k] | | ------------------ ------------------ 1036| 2.67k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 2.67k| do { \ | | 16| 2.67k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.67k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.67k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.67k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.67k| (a) = c; \ | | 19| 2.67k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.67k] | | ------------------ ------------------ 1037| 2.67k| int32x8_MINMAX(x4, x5); ------------------ | | 15| 2.67k| do { \ | | 16| 2.67k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.67k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.67k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.67k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.67k| (a) = c; \ | | 19| 2.67k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.67k] | | ------------------ ------------------ 1038| 2.67k| int32x8_MINMAX(x6, x7); ------------------ | | 15| 2.67k| do { \ | | 16| 2.67k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.67k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.67k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.67k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.67k| (a) = c; \ | | 19| 2.67k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.67k] | | ------------------ ------------------ 1039| 2.67k| int32x8 a0 = _mm256_permute2x128_si256(x0, x1, 0x20); 1040| 2.67k| int32x8 a1 = _mm256_permute2x128_si256(x0, x1, 0x31); 1041| 2.67k| int32x8 a2 = _mm256_permute2x128_si256(x2, x3, 0x20); 1042| 2.67k| int32x8 a3 = _mm256_permute2x128_si256(x2, x3, 0x31); 1043| 2.67k| int32x8 a4 = _mm256_permute2x128_si256(x4, x5, 0x20); 1044| 2.67k| int32x8 a5 = _mm256_permute2x128_si256(x4, x5, 0x31); 1045| 2.67k| int32x8 a6 = _mm256_permute2x128_si256(x6, x7, 0x20); 1046| 2.67k| int32x8 a7 = _mm256_permute2x128_si256(x6, x7, 0x31); 1047| 2.67k| int32x8_MINMAX(a0, a1); ------------------ | | 15| 2.67k| do { \ | | 16| 2.67k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.67k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.67k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.67k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.67k| (a) = c; \ | | 19| 2.67k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.67k] | | ------------------ ------------------ 1048| 2.67k| int32x8_MINMAX(a2, a3); ------------------ | | 15| 2.67k| do { \ | | 16| 2.67k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.67k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.67k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.67k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.67k| (a) = c; \ | | 19| 2.67k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.67k] | | ------------------ ------------------ 1049| 2.67k| int32x8_MINMAX(a4, a5); ------------------ | | 15| 2.67k| do { \ | | 16| 2.67k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.67k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.67k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.67k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.67k| (a) = c; \ | | 19| 2.67k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.67k] | | ------------------ ------------------ 1050| 2.67k| int32x8_MINMAX(a6, a7); ------------------ | | 15| 2.67k| do { \ | | 16| 2.67k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.67k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.67k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.67k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.67k| (a) = c; \ | | 19| 2.67k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.67k] | | ------------------ ------------------ 1051| 2.67k| int32x8 b0 = _mm256_permute2x128_si256(a0, a1, 0x20); 1052| 2.67k| int32x8 b1 = _mm256_permute2x128_si256(a0, a1, 0x31); 1053| 2.67k| int32x8 b2 = _mm256_permute2x128_si256(a2, a3, 0x20); 1054| 2.67k| int32x8 b3 = _mm256_permute2x128_si256(a2, a3, 0x31); 1055| 2.67k| int32x8 b4 = _mm256_permute2x128_si256(a4, a5, 0x20); 1056| 2.67k| int32x8 b5 = _mm256_permute2x128_si256(a4, a5, 0x31); 1057| 2.67k| int32x8 b6 = _mm256_permute2x128_si256(a6, a7, 0x20); 1058| 2.67k| int32x8 b7 = _mm256_permute2x128_si256(a6, a7, 0x31); 1059| 2.67k| int32x8 c0 = _mm256_unpacklo_epi64(b0, b1); 1060| 2.67k| int32x8 c1 = _mm256_unpackhi_epi64(b0, b1); 1061| 2.67k| int32x8 c2 = _mm256_unpacklo_epi64(b2, b3); 1062| 2.67k| int32x8 c3 = _mm256_unpackhi_epi64(b2, b3); 1063| 2.67k| int32x8 c4 = _mm256_unpacklo_epi64(b4, b5); 1064| 2.67k| int32x8 c5 = _mm256_unpackhi_epi64(b4, b5); 1065| 2.67k| int32x8 c6 = _mm256_unpacklo_epi64(b6, b7); 1066| 2.67k| int32x8 c7 = _mm256_unpackhi_epi64(b6, b7); 1067| 2.67k| int32x8_MINMAX(c0, c1); ------------------ | | 15| 2.67k| do { \ | | 16| 2.67k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.67k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.67k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.67k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.67k| (a) = c; \ | | 19| 2.67k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.67k] | | ------------------ ------------------ 1068| 2.67k| int32x8_MINMAX(c2, c3); ------------------ | | 15| 2.67k| do { \ | | 16| 2.67k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.67k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.67k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.67k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.67k| (a) = c; \ | | 19| 2.67k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.67k] | | ------------------ ------------------ 1069| 2.67k| int32x8_MINMAX(c4, c5); ------------------ | | 15| 2.67k| do { \ | | 16| 2.67k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.67k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.67k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.67k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.67k| (a) = c; \ | | 19| 2.67k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.67k] | | ------------------ ------------------ 1070| 2.67k| int32x8_MINMAX(c6, c7); ------------------ | | 15| 2.67k| do { \ | | 16| 2.67k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.67k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.67k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.67k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.67k| (a) = c; \ | | 19| 2.67k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.67k] | | ------------------ ------------------ 1071| 2.67k| int32x8 d0 = _mm256_unpacklo_epi32(c0, c1); 1072| 2.67k| int32x8 d1 = _mm256_unpackhi_epi32(c0, c1); 1073| 2.67k| int32x8 d2 = _mm256_unpacklo_epi32(c2, c3); 1074| 2.67k| int32x8 d3 = _mm256_unpackhi_epi32(c2, c3); 1075| 2.67k| int32x8 d4 = _mm256_unpacklo_epi32(c4, c5); 1076| 2.67k| int32x8 d5 = _mm256_unpackhi_epi32(c4, c5); 1077| 2.67k| int32x8 d6 = _mm256_unpacklo_epi32(c6, c7); 1078| 2.67k| int32x8 d7 = _mm256_unpackhi_epi32(c6, c7); 1079| 2.67k| int32x8 e0 = _mm256_unpacklo_epi64(d0, d1); 1080| 2.67k| int32x8 e1 = _mm256_unpackhi_epi64(d0, d1); 1081| 2.67k| int32x8 e2 = _mm256_unpacklo_epi64(d2, d3); 1082| 2.67k| int32x8 e3 = _mm256_unpackhi_epi64(d2, d3); 1083| 2.67k| int32x8 e4 = _mm256_unpacklo_epi64(d4, d5); 1084| 2.67k| int32x8 e5 = _mm256_unpackhi_epi64(d4, d5); 1085| 2.67k| int32x8 e6 = _mm256_unpacklo_epi64(d6, d7); 1086| 2.67k| int32x8 e7 = _mm256_unpackhi_epi64(d6, d7); 1087| 2.67k| int32x8_MINMAX(e0, e1); ------------------ | | 15| 2.67k| do { \ | | 16| 2.67k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.67k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.67k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.67k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.67k| (a) = c; \ | | 19| 2.67k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.67k] | | ------------------ ------------------ 1088| 2.67k| int32x8_MINMAX(e2, e3); ------------------ | | 15| 2.67k| do { \ | | 16| 2.67k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.67k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.67k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.67k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.67k| (a) = c; \ | | 19| 2.67k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.67k] | | ------------------ ------------------ 1089| 2.67k| int32x8_MINMAX(e4, e5); ------------------ | | 15| 2.67k| do { \ | | 16| 2.67k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.67k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.67k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.67k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.67k| (a) = c; \ | | 19| 2.67k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.67k] | | ------------------ ------------------ 1090| 2.67k| int32x8_MINMAX(e6, e7); ------------------ | | 15| 2.67k| do { \ | | 16| 2.67k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.67k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.67k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.67k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.67k| (a) = c; \ | | 19| 2.67k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.67k] | | ------------------ ------------------ 1091| 2.67k| int32x8 f0 = _mm256_unpacklo_epi32(e0, e1); 1092| 2.67k| int32x8 f1 = _mm256_unpackhi_epi32(e0, e1); 1093| 2.67k| int32x8 f2 = _mm256_unpacklo_epi32(e2, e3); 1094| 2.67k| int32x8 f3 = _mm256_unpackhi_epi32(e2, e3); 1095| 2.67k| int32x8 f4 = _mm256_unpacklo_epi32(e4, e5); 1096| 2.67k| int32x8 f5 = _mm256_unpackhi_epi32(e4, e5); 1097| 2.67k| int32x8 f6 = _mm256_unpacklo_epi32(e6, e7); 1098| 2.67k| int32x8 f7 = _mm256_unpackhi_epi32(e6, e7); 1099| 2.67k| int32x8_store(&x[j], f0); ------------------ | | 10| 2.67k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1100| 2.67k| int32x8_store(&x[j + 8], f1); ------------------ | | 10| 2.67k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1101| 2.67k| int32x8_store(&x[j + 16], f2); ------------------ | | 10| 2.67k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1102| 2.67k| int32x8_store(&x[j + 24], f3); ------------------ | | 10| 2.67k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1103| 2.67k| int32x8_store(&x[j + 32], f4); ------------------ | | 10| 2.67k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1104| 2.67k| int32x8_store(&x[j + 40], f5); ------------------ | | 10| 2.67k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1105| 2.67k| int32x8_store(&x[j + 48], f6); ------------------ | | 10| 2.67k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1106| 2.67k| int32x8_store(&x[j + 56], f7); ------------------ | | 10| 2.67k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1107| 2.67k| } 1108| 382| minmax_vector(x + j, x + j + 32, n - 32 - j); 1109| 382| goto continue16; 1110| 382| } 1111| 0| if (q == 16) { ------------------ | Branch (1111:9): [True: 0, False: 0] ------------------ 1112| 0| j = 0; 1113| 382|continue16: 1114| 764| for (; j + 32 <= n; j += 32) { ------------------ | Branch (1114:16): [True: 382, False: 382] ------------------ 1115| 382| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 382|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1116| 382| int32x8 x1 = int32x8_load(&x[j + 8]); ------------------ | | 9| 382|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1117| 382| int32x8 x2 = int32x8_load(&x[j + 16]); ------------------ | | 9| 382|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1118| 382| int32x8 x3 = int32x8_load(&x[j + 24]); ------------------ | | 9| 382|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1119| 382| int32x8_MINMAX(x0, x2); ------------------ | | 15| 382| do { \ | | 16| 382| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 382|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 382| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 382|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 382| (a) = c; \ | | 19| 382| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 382] | | ------------------ ------------------ 1120| 382| int32x8_MINMAX(x1, x3); ------------------ | | 15| 382| do { \ | | 16| 382| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 382|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 382| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 382|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 382| (a) = c; \ | | 19| 382| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 382] | | ------------------ ------------------ 1121| 382| int32x8_MINMAX(x0, x1); ------------------ | | 15| 382| do { \ | | 16| 382| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 382|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 382| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 382|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 382| (a) = c; \ | | 19| 382| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 382] | | ------------------ ------------------ 1122| 382| int32x8_MINMAX(x2, x3); ------------------ | | 15| 382| do { \ | | 16| 382| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 382|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 382| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 382|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 382| (a) = c; \ | | 19| 382| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 382] | | ------------------ ------------------ 1123| 382| int32x8 a0 = _mm256_permute2x128_si256(x0, x1, 0x20); 1124| 382| int32x8 a1 = _mm256_permute2x128_si256(x0, x1, 0x31); 1125| 382| int32x8 a2 = _mm256_permute2x128_si256(x2, x3, 0x20); 1126| 382| int32x8 a3 = _mm256_permute2x128_si256(x2, x3, 0x31); 1127| 382| int32x8_MINMAX(a0, a1); ------------------ | | 15| 382| do { \ | | 16| 382| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 382|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 382| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 382|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 382| (a) = c; \ | | 19| 382| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 382] | | ------------------ ------------------ 1128| 382| int32x8_MINMAX(a2, a3); ------------------ | | 15| 382| do { \ | | 16| 382| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 382|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 382| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 382|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 382| (a) = c; \ | | 19| 382| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 382] | | ------------------ ------------------ 1129| 382| int32x8 b0 = _mm256_permute2x128_si256(a0, a1, 0x20); 1130| 382| int32x8 b1 = _mm256_permute2x128_si256(a0, a1, 0x31); 1131| 382| int32x8 b2 = _mm256_permute2x128_si256(a2, a3, 0x20); 1132| 382| int32x8 b3 = _mm256_permute2x128_si256(a2, a3, 0x31); 1133| 382| int32x8 c0 = _mm256_unpacklo_epi64(b0, b1); 1134| 382| int32x8 c1 = _mm256_unpackhi_epi64(b0, b1); 1135| 382| int32x8 c2 = _mm256_unpacklo_epi64(b2, b3); 1136| 382| int32x8 c3 = _mm256_unpackhi_epi64(b2, b3); 1137| 382| int32x8_MINMAX(c0, c1); ------------------ | | 15| 382| do { \ | | 16| 382| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 382|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 382| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 382|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 382| (a) = c; \ | | 19| 382| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 382] | | ------------------ ------------------ 1138| 382| int32x8_MINMAX(c2, c3); ------------------ | | 15| 382| do { \ | | 16| 382| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 382|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 382| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 382|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 382| (a) = c; \ | | 19| 382| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 382] | | ------------------ ------------------ 1139| 382| int32x8 d0 = _mm256_unpacklo_epi32(c0, c1); 1140| 382| int32x8 d1 = _mm256_unpackhi_epi32(c0, c1); 1141| 382| int32x8 d2 = _mm256_unpacklo_epi32(c2, c3); 1142| 382| int32x8 d3 = _mm256_unpackhi_epi32(c2, c3); 1143| 382| int32x8 e0 = _mm256_unpacklo_epi64(d0, d1); 1144| 382| int32x8 e1 = _mm256_unpackhi_epi64(d0, d1); 1145| 382| int32x8 e2 = _mm256_unpacklo_epi64(d2, d3); 1146| 382| int32x8 e3 = _mm256_unpackhi_epi64(d2, d3); 1147| 382| int32x8_MINMAX(e0, e1); ------------------ | | 15| 382| do { \ | | 16| 382| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 382|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 382| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 382|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 382| (a) = c; \ | | 19| 382| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 382] | | ------------------ ------------------ 1148| 382| int32x8_MINMAX(e2, e3); ------------------ | | 15| 382| do { \ | | 16| 382| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 382|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 382| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 382|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 382| (a) = c; \ | | 19| 382| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 382] | | ------------------ ------------------ 1149| 382| int32x8 f0 = _mm256_unpacklo_epi32(e0, e1); 1150| 382| int32x8 f1 = _mm256_unpackhi_epi32(e0, e1); 1151| 382| int32x8 f2 = _mm256_unpacklo_epi32(e2, e3); 1152| 382| int32x8 f3 = _mm256_unpackhi_epi32(e2, e3); 1153| 382| int32x8_store(&x[j], f0); ------------------ | | 10| 382|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1154| 382| int32x8_store(&x[j + 8], f1); ------------------ | | 10| 382|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1155| 382| int32x8_store(&x[j + 16], f2); ------------------ | | 10| 382|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1156| 382| int32x8_store(&x[j + 24], f3); ------------------ | | 10| 382|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1157| 382| } 1158| 382| minmax_vector(x + j, x + j + 16, n - 16 - j); 1159| 382| goto continue8; 1160| 0| } 1161| | /* q == 8 */ 1162| 0| j = 0; 1163| 382|continue8: 1164| 764| for (; j + 16 <= n; j += 16) { ------------------ | Branch (1164:12): [True: 382, False: 382] ------------------ 1165| 382| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 382|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1166| 382| int32x8 x1 = int32x8_load(&x[j + 8]); ------------------ | | 9| 382|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1167| 382| int32x8_MINMAX(x0, x1); ------------------ | | 15| 382| do { \ | | 16| 382| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 382|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 382| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 382|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 382| (a) = c; \ | | 19| 382| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 382] | | ------------------ ------------------ 1168| 382| int32x8_store(&x[j], x0); ------------------ | | 10| 382|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1169| 382| int32x8_store(&x[j + 8], x1); ------------------ | | 10| 382|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1170| 382| int32x8 a0 = _mm256_permute2x128_si256(x0, x1, 0x20); /* x0123y0123 */ 1171| 382| int32x8 a1 = _mm256_permute2x128_si256(x0, x1, 0x31); /* x4567y4567 */ 1172| 382| int32x8_MINMAX(a0, a1); ------------------ | | 15| 382| do { \ | | 16| 382| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 382|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 382| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 382|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 382| (a) = c; \ | | 19| 382| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 382] | | ------------------ ------------------ 1173| 382| int32x8 b0 = _mm256_permute2x128_si256(a0, a1, 0x20); /* x01234567 */ 1174| 382| int32x8 b1 = _mm256_permute2x128_si256(a0, a1, 0x31); /* y01234567 */ 1175| 382| int32x8 c0 = _mm256_unpacklo_epi64(b0, b1); /* x01y01x45y45 */ 1176| 382| int32x8 c1 = _mm256_unpackhi_epi64(b0, b1); /* x23y23x67y67 */ 1177| 382| int32x8_MINMAX(c0, c1); ------------------ | | 15| 382| do { \ | | 16| 382| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 382|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 382| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 382|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 382| (a) = c; \ | | 19| 382| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 382] | | ------------------ ------------------ 1178| 382| int32x8 d0 = _mm256_unpacklo_epi32(c0, c1); /* x02x13x46x57 */ 1179| 382| int32x8 d1 = _mm256_unpackhi_epi32(c0, c1); /* y02y13y46y57 */ 1180| 382| int32x8 e0 = _mm256_unpacklo_epi64(d0, d1); /* x02y02x46y46 */ 1181| 382| int32x8 e1 = _mm256_unpackhi_epi64(d0, d1); /* x13y13x57y57 */ 1182| 382| int32x8_MINMAX(e0, e1); ------------------ | | 15| 382| do { \ | | 16| 382| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 382|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 382| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 382|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 382| (a) = c; \ | | 19| 382| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 382] | | ------------------ ------------------ 1183| 382| int32x8 f0 = _mm256_unpacklo_epi32(e0, e1); /* x01234567 */ 1184| 382| int32x8 f1 = _mm256_unpackhi_epi32(e0, e1); /* y01234567 */ 1185| 382| int32x8_store(&x[j], f0); ------------------ | | 10| 382|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1186| 382| int32x8_store(&x[j + 8], f1); ------------------ | | 10| 382|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1187| 382| } 1188| 382| minmax_vector(x + j, x + j + 8, n - 8 - j); 1189| 382| if (j + 8 <= n) { ------------------ | Branch (1189:9): [True: 382, False: 0] ------------------ 1190| 382| int32_MINMAX(&x[j], &x[j + 4]); 1191| 382| int32_MINMAX(&x[j + 1], &x[j + 5]); 1192| 382| int32_MINMAX(&x[j + 2], &x[j + 6]); 1193| 382| int32_MINMAX(&x[j + 3], &x[j + 7]); 1194| 382| int32_MINMAX(&x[j], &x[j + 2]); 1195| 382| int32_MINMAX(&x[j + 1], &x[j + 3]); 1196| 382| int32_MINMAX(&x[j], &x[j + 1]); 1197| 382| int32_MINMAX(&x[j + 2], &x[j + 3]); 1198| 382| int32_MINMAX(&x[j + 4], &x[j + 6]); 1199| 382| int32_MINMAX(&x[j + 5], &x[j + 7]); 1200| 382| int32_MINMAX(&x[j + 4], &x[j + 5]); 1201| 382| int32_MINMAX(&x[j + 6], &x[j + 7]); 1202| 382| j += 8; 1203| 382| } 1204| 382| minmax_vector(x + j, x + j + 4, n - 4 - j); 1205| 382| if (j + 4 <= n) { ------------------ | Branch (1205:9): [True: 382, False: 0] ------------------ 1206| 382| int32_MINMAX(&x[j], &x[j + 2]); 1207| 382| int32_MINMAX(&x[j + 1], &x[j + 3]); 1208| 382| int32_MINMAX(&x[j], &x[j + 1]); 1209| 382| int32_MINMAX(&x[j + 2], &x[j + 3]); 1210| 382| j += 4; 1211| 382| } 1212| 382| if (j + 3 <= n) { ------------------ | Branch (1212:9): [True: 0, False: 382] ------------------ 1213| 0| int32_MINMAX(&x[j], &x[j + 2]); 1214| 0| } 1215| 382| if (j + 2 <= n) { ------------------ | Branch (1215:9): [True: 0, False: 382] ------------------ 1216| 0| int32_MINMAX(&x[j], &x[j + 1]); 1217| 0| } 1218| 382|} crypto_sort_int32.c:int32_MINMAX: 21| 10.9k|static inline void int32_MINMAX(int32 *a, int32 *b) { 22| 10.9k| int32 ab = *b ^ *a; ------------------ | | 6| 10.9k|#define int32 int32_t ------------------ 23| 10.9k| int32 c = (int32)((int64_t) * b - (int64_t) * a); ------------------ | | 6| 10.9k|#define int32 int32_t ------------------ 24| 10.9k| c ^= ab & (c ^ *b); 25| 10.9k| c >>= 31; 26| 10.9k| c &= ab; 27| 10.9k| *a ^= c; 28| 10.9k| *b ^= c; 29| 10.9k|} crypto_sort_int32.c:int32_sort_2power: 176| 1.40k|static void int32_sort_2power(int32 *x, size_t n, int flagdown) { 177| 1.40k| size_t p, q, i, j, k; 178| 1.40k| int32x8 mask; 179| | 180| 1.40k| if (n == 8) { ------------------ | Branch (180:9): [True: 0, False: 1.40k] ------------------ 181| 0| int32 x0 = x[0]; ------------------ | | 6| 0|#define int32 int32_t ------------------ 182| 0| int32 x1 = x[1]; ------------------ | | 6| 0|#define int32 int32_t ------------------ 183| 0| int32 x2 = x[2]; ------------------ | | 6| 0|#define int32 int32_t ------------------ 184| 0| int32 x3 = x[3]; ------------------ | | 6| 0|#define int32 int32_t ------------------ 185| 0| int32 x4 = x[4]; ------------------ | | 6| 0|#define int32 int32_t ------------------ 186| 0| int32 x5 = x[5]; ------------------ | | 6| 0|#define int32 int32_t ------------------ 187| 0| int32 x6 = x[6]; ------------------ | | 6| 0|#define int32 int32_t ------------------ 188| 0| int32 x7 = x[7]; ------------------ | | 6| 0|#define int32 int32_t ------------------ 189| | 190| | /* odd-even sort instead of bitonic sort */ 191| | 192| 0| int32_MINMAX(&x1, &x0); 193| 0| int32_MINMAX(&x3, &x2); 194| 0| int32_MINMAX(&x2, &x0); 195| 0| int32_MINMAX(&x3, &x1); 196| 0| int32_MINMAX(&x2, &x1); 197| | 198| 0| int32_MINMAX(&x5, &x4); 199| 0| int32_MINMAX(&x7, &x6); 200| 0| int32_MINMAX(&x6, &x4); 201| 0| int32_MINMAX(&x7, &x5); 202| 0| int32_MINMAX(&x6, &x5); 203| | 204| 0| int32_MINMAX(&x4, &x0); 205| 0| int32_MINMAX(&x6, &x2); 206| 0| int32_MINMAX(&x4, &x2); 207| | 208| 0| int32_MINMAX(&x5, &x1); 209| 0| int32_MINMAX(&x7, &x3); 210| 0| int32_MINMAX(&x5, &x3); 211| | 212| 0| int32_MINMAX(&x2, &x1); 213| 0| int32_MINMAX(&x4, &x3); 214| 0| int32_MINMAX(&x6, &x5); 215| | 216| 0| x[0] = x0; 217| 0| x[1] = x1; 218| 0| x[2] = x2; 219| 0| x[3] = x3; 220| 0| x[4] = x4; 221| 0| x[5] = x5; 222| 0| x[6] = x6; 223| 0| x[7] = x7; 224| 0| return; 225| 0| } 226| | 227| 1.40k| if (n == 16) { ------------------ | Branch (227:9): [True: 0, False: 1.40k] ------------------ 228| 0| int32x8 x0, x1, b0, b1, c0, c1; 229| | 230| 0| x0 = int32x8_load(&x[0]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 231| 0| x1 = int32x8_load(&x[8]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 232| | 233| 0| mask = _mm256_set_epi32(0, 0, -1, -1, 0, 0, -1, -1); 234| | 235| 0| x0 ^= mask; /* A01234567 */ 236| 0| x1 ^= mask; /* B01234567 */ 237| | 238| 0| b0 = _mm256_unpacklo_epi32(x0, x1); /* AB0AB1AB4AB5 */ 239| 0| b1 = _mm256_unpackhi_epi32(x0, x1); /* AB2AB3AB6AB7 */ 240| | 241| 0| c0 = _mm256_unpacklo_epi64(b0, b1); /* AB0AB2AB4AB6 */ 242| 0| c1 = _mm256_unpackhi_epi64(b0, b1); /* AB1AB3AB5AB7 */ 243| | 244| 0| int32x8_MINMAX(c0, c1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 245| | 246| 0| mask = _mm256_set_epi32(0, 0, -1, -1, -1, -1, 0, 0); 247| 0| c0 ^= mask; 248| 0| c1 ^= mask; 249| | 250| 0| b0 = _mm256_unpacklo_epi32(c0, c1); /* A01B01A45B45 */ 251| 0| b1 = _mm256_unpackhi_epi32(c0, c1); /* A23B23A67B67 */ 252| | 253| 0| int32x8_MINMAX(b0, b1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 254| | 255| 0| x0 = _mm256_unpacklo_epi64(b0, b1); /* A01234567 */ 256| 0| x1 = _mm256_unpackhi_epi64(b0, b1); /* B01234567 */ 257| | 258| 0| b0 = _mm256_unpacklo_epi32(x0, x1); /* AB0AB1AB4AB5 */ 259| 0| b1 = _mm256_unpackhi_epi32(x0, x1); /* AB2AB3AB6AB7 */ 260| | 261| 0| c0 = _mm256_unpacklo_epi64(b0, b1); /* AB0AB2AB4AB6 */ 262| 0| c1 = _mm256_unpackhi_epi64(b0, b1); /* AB1AB3AB5AB7 */ 263| | 264| 0| int32x8_MINMAX(c0, c1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 265| | 266| 0| b0 = _mm256_unpacklo_epi32(c0, c1); /* A01B01A45B45 */ 267| 0| b1 = _mm256_unpackhi_epi32(c0, c1); /* A23B23A67B67 */ 268| | 269| 0| b0 ^= mask; 270| 0| b1 ^= mask; 271| | 272| 0| c0 = _mm256_permute2x128_si256(b0, b1, 0x20); /* A01B01A23B23 */ 273| 0| c1 = _mm256_permute2x128_si256(b0, b1, 0x31); /* A45B45A67B67 */ 274| | 275| 0| int32x8_MINMAX(c0, c1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 276| | 277| 0| b0 = _mm256_permute2x128_si256(c0, c1, 0x20); /* A01B01A45B45 */ 278| 0| b1 = _mm256_permute2x128_si256(c0, c1, 0x31); /* A23B23A67B67 */ 279| | 280| 0| int32x8_MINMAX(b0, b1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 281| | 282| 0| x0 = _mm256_unpacklo_epi64(b0, b1); /* A01234567 */ 283| 0| x1 = _mm256_unpackhi_epi64(b0, b1); /* B01234567 */ 284| | 285| 0| b0 = _mm256_unpacklo_epi32(x0, x1); /* AB0AB1AB4AB5 */ 286| 0| b1 = _mm256_unpackhi_epi32(x0, x1); /* AB2AB3AB6AB7 */ 287| | 288| 0| c0 = _mm256_unpacklo_epi64(b0, b1); /* AB0AB2AB4AB6 */ 289| 0| c1 = _mm256_unpackhi_epi64(b0, b1); /* AB1AB3AB5AB7 */ 290| | 291| 0| int32x8_MINMAX(c0, c1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 292| | 293| 0| b0 = _mm256_unpacklo_epi32(c0, c1); /* A01B01A45B45 */ 294| 0| b1 = _mm256_unpackhi_epi32(c0, c1); /* A23B23A67B67 */ 295| | 296| 0| x0 = _mm256_unpacklo_epi64(b0, b1); /* A01234567 */ 297| 0| x1 = _mm256_unpackhi_epi64(b0, b1); /* B01234567 */ 298| | 299| 0| mask = _mm256_set1_epi32(-1); 300| 0| if (flagdown) { ------------------ | Branch (300:13): [True: 0, False: 0] ------------------ 301| 0| x1 ^= mask; 302| 0| } else { 303| 0| x0 ^= mask; 304| 0| } 305| | 306| 0| merge16_finish(x, x0, x1, flagdown); 307| 0| return; 308| 0| } 309| | 310| 1.40k| if (n == 32) { ------------------ | Branch (310:9): [True: 0, False: 1.40k] ------------------ 311| 0| int32x8 x0, x1, x2, x3; 312| | 313| 0| int32_sort_2power(x, 16, 1); 314| 0| int32_sort_2power(x + 16, 16, 0); 315| | 316| 0| x0 = int32x8_load(&x[0]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 317| 0| x1 = int32x8_load(&x[8]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 318| 0| x2 = int32x8_load(&x[16]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 319| 0| x3 = int32x8_load(&x[24]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 320| | 321| 0| if (flagdown) { ------------------ | Branch (321:13): [True: 0, False: 0] ------------------ 322| 0| mask = _mm256_set1_epi32(-1); 323| 0| x0 ^= mask; 324| 0| x1 ^= mask; 325| 0| x2 ^= mask; 326| 0| x3 ^= mask; 327| 0| } 328| | 329| 0| int32x8_MINMAX(x0, x2); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 330| 0| int32x8_MINMAX(x1, x3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 331| | 332| 0| merge16_finish(x, x0, x1, flagdown); 333| 0| merge16_finish(x + 16, x2, x3, flagdown); 334| 0| return; 335| 0| } 336| | 337| 1.40k| p = n >> 3; 338| 7.36k| for (i = 0; i < p; i += 8) { ------------------ | Branch (338:17): [True: 5.95k, False: 1.40k] ------------------ 339| 5.95k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 5.95k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 340| 5.95k| int32x8 x2 = int32x8_load(&x[i + 2 * p]); ------------------ | | 9| 5.95k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 341| 5.95k| int32x8 x4 = int32x8_load(&x[i + 4 * p]); ------------------ | | 9| 5.95k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 342| 5.95k| int32x8 x6 = int32x8_load(&x[i + 6 * p]); ------------------ | | 9| 5.95k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 343| | 344| | /* odd-even stage instead of bitonic stage */ 345| | 346| 5.95k| int32x8_MINMAX(x4, x0); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 347| 5.95k| int32x8_MINMAX(x6, x2); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 348| 5.95k| int32x8_MINMAX(x2, x0); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 349| 5.95k| int32x8_MINMAX(x6, x4); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 350| 5.95k| int32x8_MINMAX(x2, x4); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 351| | 352| 5.95k| int32x8_store(&x[i], x0); ------------------ | | 10| 5.95k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 353| 5.95k| int32x8_store(&x[i + 2 * p], x2); ------------------ | | 10| 5.95k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 354| 5.95k| int32x8_store(&x[i + 4 * p], x4); ------------------ | | 10| 5.95k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 355| 5.95k| int32x8_store(&x[i + 6 * p], x6); ------------------ | | 10| 5.95k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 356| | 357| 5.95k| int32x8 x1 = int32x8_load(&x[i + p]); ------------------ | | 9| 5.95k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 358| 5.95k| int32x8 x3 = int32x8_load(&x[i + 3 * p]); ------------------ | | 9| 5.95k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 359| 5.95k| int32x8 x5 = int32x8_load(&x[i + 5 * p]); ------------------ | | 9| 5.95k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 360| 5.95k| int32x8 x7 = int32x8_load(&x[i + 7 * p]); ------------------ | | 9| 5.95k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 361| | 362| 5.95k| int32x8_MINMAX(x1, x5); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 363| 5.95k| int32x8_MINMAX(x3, x7); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 364| 5.95k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 365| 5.95k| int32x8_MINMAX(x5, x7); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 366| 5.95k| int32x8_MINMAX(x5, x3); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 367| | 368| 5.95k| int32x8_store(&x[i + p], x1); ------------------ | | 10| 5.95k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 369| 5.95k| int32x8_store(&x[i + 3 * p], x3); ------------------ | | 10| 5.95k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 370| 5.95k| int32x8_store(&x[i + 5 * p], x5); ------------------ | | 10| 5.95k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 371| 5.95k| int32x8_store(&x[i + 7 * p], x7); ------------------ | | 10| 5.95k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 372| 5.95k| } 373| | 374| 1.40k| if (n >= 128) { ------------------ | Branch (374:9): [True: 1.21k, False: 190] ------------------ 375| 1.21k| int flip, flipflip; 376| | 377| 1.21k| mask = _mm256_set1_epi32(-1); 378| | 379| 12.7k| for (j = 0; j < n; j += 32) { ------------------ | Branch (379:21): [True: 11.5k, False: 1.21k] ------------------ 380| 11.5k| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 11.5k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 381| 11.5k| int32x8 x1 = int32x8_load(&x[j + 16]); ------------------ | | 9| 11.5k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 382| 11.5k| x0 ^= mask; 383| 11.5k| x1 ^= mask; 384| 11.5k| int32x8_store(&x[j], x0); ------------------ | | 10| 11.5k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 385| 11.5k| int32x8_store(&x[j + 16], x1); ------------------ | | 10| 11.5k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 386| 11.5k| } 387| | 388| 1.21k| p = 8; 389| 2.65k| for (;;) { /* for p in [8, 16, ..., n/16] */ 390| 2.65k| q = p >> 1; 391| 2.65k| while (q >= 128) { ------------------ | Branch (391:20): [True: 0, False: 2.65k] ------------------ 392| 0| int32_threestages(x, n, q >> 2); 393| 0| q >>= 3; 394| 0| } 395| 2.65k| if (q == 64) { ------------------ | Branch (395:17): [True: 0, False: 2.65k] ------------------ 396| 0| int32_twostages_32(x, n); 397| 0| q = 16; 398| 0| } 399| 2.65k| if (q == 32) { ------------------ | Branch (399:17): [True: 0, False: 2.65k] ------------------ 400| 0| q = 8; 401| 0| for (k = 0; k < n; k += 8 * q) { ------------------ | Branch (401:29): [True: 0, False: 0] ------------------ 402| 0| for (i = k; i < k + q; i += 8) { ------------------ | Branch (402:33): [True: 0, False: 0] ------------------ 403| 0| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 404| 0| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 405| 0| int32x8 x2 = int32x8_load(&x[i + 2 * q]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 406| 0| int32x8 x3 = int32x8_load(&x[i + 3 * q]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 407| 0| int32x8 x4 = int32x8_load(&x[i + 4 * q]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 408| 0| int32x8 x5 = int32x8_load(&x[i + 5 * q]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 409| 0| int32x8 x6 = int32x8_load(&x[i + 6 * q]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 410| 0| int32x8 x7 = int32x8_load(&x[i + 7 * q]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 411| | 412| 0| int32x8_MINMAX(x0, x4); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 413| 0| int32x8_MINMAX(x1, x5); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 414| 0| int32x8_MINMAX(x2, x6); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 415| 0| int32x8_MINMAX(x3, x7); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 416| 0| int32x8_MINMAX(x0, x2); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 417| 0| int32x8_MINMAX(x1, x3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 418| 0| int32x8_MINMAX(x4, x6); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 419| 0| int32x8_MINMAX(x5, x7); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 420| 0| int32x8_MINMAX(x0, x1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 421| 0| int32x8_MINMAX(x2, x3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 422| 0| int32x8_MINMAX(x4, x5); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 423| 0| int32x8_MINMAX(x6, x7); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 424| | 425| 0| int32x8_store(&x[i], x0); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 426| 0| int32x8_store(&x[i + q], x1); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 427| 0| int32x8_store(&x[i + 2 * q], x2); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 428| 0| int32x8_store(&x[i + 3 * q], x3); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 429| 0| int32x8_store(&x[i + 4 * q], x4); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 430| 0| int32x8_store(&x[i + 5 * q], x5); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 431| 0| int32x8_store(&x[i + 6 * q], x6); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 432| 0| int32x8_store(&x[i + 7 * q], x7); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 433| 0| } 434| 0| } 435| 0| q = 4; 436| 0| } 437| 2.65k| if (q == 16) { ------------------ | Branch (437:17): [True: 226, False: 2.43k] ------------------ 438| 226| q = 8; 439| 3.84k| for (k = 0; k < n; k += 4 * q) { ------------------ | Branch (439:29): [True: 3.61k, False: 226] ------------------ 440| 7.23k| for (i = k; i < k + q; i += 8) { ------------------ | Branch (440:33): [True: 3.61k, False: 3.61k] ------------------ 441| 3.61k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 3.61k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 442| 3.61k| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 3.61k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 443| 3.61k| int32x8 x2 = int32x8_load(&x[i + 2 * q]); ------------------ | | 9| 3.61k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 444| 3.61k| int32x8 x3 = int32x8_load(&x[i + 3 * q]); ------------------ | | 9| 3.61k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 445| | 446| 3.61k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 3.61k| do { \ | | 16| 3.61k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 3.61k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 3.61k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 3.61k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 3.61k| (a) = c; \ | | 19| 3.61k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.61k] | | ------------------ ------------------ 447| 3.61k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 3.61k| do { \ | | 16| 3.61k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 3.61k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 3.61k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 3.61k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 3.61k| (a) = c; \ | | 19| 3.61k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.61k] | | ------------------ ------------------ 448| 3.61k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 3.61k| do { \ | | 16| 3.61k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 3.61k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 3.61k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 3.61k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 3.61k| (a) = c; \ | | 19| 3.61k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.61k] | | ------------------ ------------------ 449| 3.61k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 3.61k| do { \ | | 16| 3.61k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 3.61k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 3.61k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 3.61k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 3.61k| (a) = c; \ | | 19| 3.61k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.61k] | | ------------------ ------------------ 450| | 451| 3.61k| int32x8_store(&x[i], x0); ------------------ | | 10| 3.61k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 452| 3.61k| int32x8_store(&x[i + q], x1); ------------------ | | 10| 3.61k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 453| 3.61k| int32x8_store(&x[i + 2 * q], x2); ------------------ | | 10| 3.61k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 454| 3.61k| int32x8_store(&x[i + 3 * q], x3); ------------------ | | 10| 3.61k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 455| 3.61k| } 456| 3.61k| } 457| 226| q = 4; 458| 226| } 459| 2.65k| if (q == 8) { ------------------ | Branch (459:17): [True: 1.21k, False: 1.44k] ------------------ 460| 24.2k| for (k = 0; k < n; k += q + q) { ------------------ | Branch (460:29): [True: 23.0k, False: 1.21k] ------------------ 461| 23.0k| int32x8 x0 = int32x8_load(&x[k]); ------------------ | | 9| 23.0k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 462| 23.0k| int32x8 x1 = int32x8_load(&x[k + q]); ------------------ | | 9| 23.0k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 463| | 464| 23.0k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 23.0k| do { \ | | 16| 23.0k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 23.0k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 23.0k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 23.0k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 23.0k| (a) = c; \ | | 19| 23.0k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 23.0k] | | ------------------ ------------------ 465| | 466| 23.0k| int32x8_store(&x[k], x0); ------------------ | | 10| 23.0k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 467| 23.0k| int32x8_store(&x[k + q], x1); ------------------ | | 10| 23.0k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 468| 23.0k| } 469| 1.21k| } 470| | 471| 2.65k| q = n >> 3; 472| 2.65k| flip = 0; 473| 2.65k| if (p << 1 == q) { ------------------ | Branch (473:17): [True: 1.21k, False: 1.44k] ------------------ 474| 1.21k| flip = 1; 475| 1.21k| } 476| 2.65k| flipflip = 1 - flip; 477| 7.21k| for (j = 0; j < q; j += p + p) { ------------------ | Branch (477:25): [True: 4.55k, False: 2.65k] ------------------ 478| 13.6k| for (k = j; k < j + p + p; k += p) { ------------------ | Branch (478:29): [True: 9.10k, False: 4.55k] ------------------ 479| 22.4k| for (i = k; i < k + p; i += 8) { ------------------ | Branch (479:33): [True: 13.3k, False: 9.10k] ------------------ 480| 13.3k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 13.3k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 481| 13.3k| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 13.3k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 482| 13.3k| int32x8 x2 = int32x8_load(&x[i + 2 * q]); ------------------ | | 9| 13.3k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 483| 13.3k| int32x8 x3 = int32x8_load(&x[i + 3 * q]); ------------------ | | 9| 13.3k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 484| 13.3k| int32x8 x4 = int32x8_load(&x[i + 4 * q]); ------------------ | | 9| 13.3k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 485| 13.3k| int32x8 x5 = int32x8_load(&x[i + 5 * q]); ------------------ | | 9| 13.3k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 486| 13.3k| int32x8 x6 = int32x8_load(&x[i + 6 * q]); ------------------ | | 9| 13.3k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 487| 13.3k| int32x8 x7 = int32x8_load(&x[i + 7 * q]); ------------------ | | 9| 13.3k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 488| | 489| 13.3k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 13.3k| do { \ | | 16| 13.3k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 13.3k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 13.3k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 13.3k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 13.3k| (a) = c; \ | | 19| 13.3k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 13.3k] | | ------------------ ------------------ 490| 13.3k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 13.3k| do { \ | | 16| 13.3k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 13.3k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 13.3k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 13.3k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 13.3k| (a) = c; \ | | 19| 13.3k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 13.3k] | | ------------------ ------------------ 491| 13.3k| int32x8_MINMAX(x4, x5); ------------------ | | 15| 13.3k| do { \ | | 16| 13.3k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 13.3k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 13.3k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 13.3k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 13.3k| (a) = c; \ | | 19| 13.3k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 13.3k] | | ------------------ ------------------ 492| 13.3k| int32x8_MINMAX(x6, x7); ------------------ | | 15| 13.3k| do { \ | | 16| 13.3k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 13.3k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 13.3k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 13.3k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 13.3k| (a) = c; \ | | 19| 13.3k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 13.3k] | | ------------------ ------------------ 493| 13.3k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 13.3k| do { \ | | 16| 13.3k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 13.3k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 13.3k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 13.3k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 13.3k| (a) = c; \ | | 19| 13.3k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 13.3k] | | ------------------ ------------------ 494| 13.3k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 13.3k| do { \ | | 16| 13.3k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 13.3k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 13.3k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 13.3k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 13.3k| (a) = c; \ | | 19| 13.3k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 13.3k] | | ------------------ ------------------ 495| 13.3k| int32x8_MINMAX(x4, x6); ------------------ | | 15| 13.3k| do { \ | | 16| 13.3k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 13.3k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 13.3k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 13.3k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 13.3k| (a) = c; \ | | 19| 13.3k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 13.3k] | | ------------------ ------------------ 496| 13.3k| int32x8_MINMAX(x5, x7); ------------------ | | 15| 13.3k| do { \ | | 16| 13.3k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 13.3k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 13.3k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 13.3k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 13.3k| (a) = c; \ | | 19| 13.3k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 13.3k] | | ------------------ ------------------ 497| 13.3k| int32x8_MINMAX(x0, x4); ------------------ | | 15| 13.3k| do { \ | | 16| 13.3k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 13.3k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 13.3k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 13.3k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 13.3k| (a) = c; \ | | 19| 13.3k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 13.3k] | | ------------------ ------------------ 498| 13.3k| int32x8_MINMAX(x1, x5); ------------------ | | 15| 13.3k| do { \ | | 16| 13.3k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 13.3k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 13.3k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 13.3k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 13.3k| (a) = c; \ | | 19| 13.3k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 13.3k] | | ------------------ ------------------ 499| 13.3k| int32x8_MINMAX(x2, x6); ------------------ | | 15| 13.3k| do { \ | | 16| 13.3k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 13.3k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 13.3k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 13.3k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 13.3k| (a) = c; \ | | 19| 13.3k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 13.3k] | | ------------------ ------------------ 500| 13.3k| int32x8_MINMAX(x3, x7); ------------------ | | 15| 13.3k| do { \ | | 16| 13.3k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 13.3k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 13.3k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 13.3k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 13.3k| (a) = c; \ | | 19| 13.3k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 13.3k] | | ------------------ ------------------ 501| | 502| 13.3k| if (flip) { ------------------ | Branch (502:29): [True: 6.67k, False: 6.67k] ------------------ 503| 6.67k| x0 ^= mask; 504| 6.67k| x1 ^= mask; 505| 6.67k| x2 ^= mask; 506| 6.67k| x3 ^= mask; 507| 6.67k| x4 ^= mask; 508| 6.67k| x5 ^= mask; 509| 6.67k| x6 ^= mask; 510| 6.67k| x7 ^= mask; 511| 6.67k| } 512| | 513| 13.3k| int32x8_store(&x[i], x0); ------------------ | | 10| 13.3k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 514| 13.3k| int32x8_store(&x[i + q], x1); ------------------ | | 10| 13.3k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 515| 13.3k| int32x8_store(&x[i + 2 * q], x2); ------------------ | | 10| 13.3k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 516| 13.3k| int32x8_store(&x[i + 3 * q], x3); ------------------ | | 10| 13.3k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 517| 13.3k| int32x8_store(&x[i + 4 * q], x4); ------------------ | | 10| 13.3k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 518| 13.3k| int32x8_store(&x[i + 5 * q], x5); ------------------ | | 10| 13.3k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 519| 13.3k| int32x8_store(&x[i + 6 * q], x6); ------------------ | | 10| 13.3k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 520| 13.3k| int32x8_store(&x[i + 7 * q], x7); ------------------ | | 10| 13.3k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 521| 13.3k| } 522| 9.10k| flip ^= 1; 523| 9.10k| } 524| 4.55k| flip ^= flipflip; 525| 4.55k| } 526| | 527| 2.65k| if (p << 4 == n) { ------------------ | Branch (527:17): [True: 1.21k, False: 1.44k] ------------------ 528| 1.21k| break; 529| 1.21k| } 530| 1.44k| p <<= 1; 531| 1.44k| } 532| 1.21k| } 533| | 534| 5.62k| for (p = 4; p >= 1; p >>= 1) { ------------------ | Branch (534:17): [True: 4.21k, False: 1.40k] ------------------ 535| 4.21k| int32 *z = x; ------------------ | | 6| 4.21k|#define int32 int32_t ------------------ 536| 4.21k| int32 *target = x + n; ------------------ | | 6| 4.21k|#define int32 int32_t ------------------ 537| 4.21k| if (p == 4) { ------------------ | Branch (537:13): [True: 1.40k, False: 2.81k] ------------------ 538| 1.40k| mask = _mm256_set_epi32(0, 0, 0, 0, -1, -1, -1, -1); 539| 25.2k| while (z != target) { ------------------ | Branch (539:20): [True: 23.8k, False: 1.40k] ------------------ 540| 23.8k| int32x8 x0 = int32x8_load(&z[0]); ------------------ | | 9| 23.8k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 541| 23.8k| int32x8 x1 = int32x8_load(&z[8]); ------------------ | | 9| 23.8k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 542| 23.8k| x0 ^= mask; 543| 23.8k| x1 ^= mask; 544| 23.8k| int32x8_store(&z[0], x0); ------------------ | | 10| 23.8k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 545| 23.8k| int32x8_store(&z[8], x1); ------------------ | | 10| 23.8k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 546| 23.8k| z += 16; 547| 23.8k| } 548| 2.81k| } else if (p == 2) { ------------------ | Branch (548:20): [True: 1.40k, False: 1.40k] ------------------ 549| 1.40k| mask = _mm256_set_epi32(0, 0, -1, -1, -1, -1, 0, 0); 550| 25.2k| while (z != target) { ------------------ | Branch (550:20): [True: 23.8k, False: 1.40k] ------------------ 551| 23.8k| int32x8 x0 = int32x8_load(&z[0]); ------------------ | | 9| 23.8k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 552| 23.8k| int32x8 x1 = int32x8_load(&z[8]); ------------------ | | 9| 23.8k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 553| 23.8k| x0 ^= mask; 554| 23.8k| x1 ^= mask; 555| 23.8k| int32x8 b0 = _mm256_permute2x128_si256(x0, x1, 0x20); 556| 23.8k| int32x8 b1 = _mm256_permute2x128_si256(x0, x1, 0x31); 557| 23.8k| int32x8_MINMAX(b0, b1); ------------------ | | 15| 23.8k| do { \ | | 16| 23.8k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 23.8k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 23.8k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 23.8k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 23.8k| (a) = c; \ | | 19| 23.8k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 23.8k] | | ------------------ ------------------ 558| 23.8k| int32x8 c0 = _mm256_permute2x128_si256(b0, b1, 0x20); 559| 23.8k| int32x8 c1 = _mm256_permute2x128_si256(b0, b1, 0x31); 560| 23.8k| int32x8_store(&z[0], c0); ------------------ | | 10| 23.8k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 561| 23.8k| int32x8_store(&z[8], c1); ------------------ | | 10| 23.8k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 562| 23.8k| z += 16; 563| 23.8k| } 564| 1.40k| } else { /* p == 1 */ 565| 1.40k| mask = _mm256_set_epi32(0, -1, -1, 0, 0, -1, -1, 0); 566| 25.2k| while (z != target) { ------------------ | Branch (566:20): [True: 23.8k, False: 1.40k] ------------------ 567| 23.8k| int32x8 x0 = int32x8_load(&z[0]); ------------------ | | 9| 23.8k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 568| 23.8k| int32x8 x1 = int32x8_load(&z[8]); ------------------ | | 9| 23.8k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 569| 23.8k| x0 ^= mask; 570| 23.8k| x1 ^= mask; 571| 23.8k| int32x8 b0 = _mm256_permute2x128_si256(x0, x1, 0x20); /* A0123B0123 */ 572| 23.8k| int32x8 b1 = _mm256_permute2x128_si256(x0, x1, 0x31); /* A4567B4567 */ 573| 23.8k| int32x8 c0 = _mm256_unpacklo_epi64(b0, b1); /* A0145B0145 */ 574| 23.8k| int32x8 c1 = _mm256_unpackhi_epi64(b0, b1); /* A2367B2367 */ 575| 23.8k| int32x8_MINMAX(c0, c1); ------------------ | | 15| 23.8k| do { \ | | 16| 23.8k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 23.8k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 23.8k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 23.8k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 23.8k| (a) = c; \ | | 19| 23.8k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 23.8k] | | ------------------ ------------------ 576| 23.8k| int32x8 d0 = _mm256_unpacklo_epi64(c0, c1); /* A0123B0123 */ 577| 23.8k| int32x8 d1 = _mm256_unpackhi_epi64(c0, c1); /* A4567B4567 */ 578| 23.8k| int32x8_MINMAX(d0, d1); ------------------ | | 15| 23.8k| do { \ | | 16| 23.8k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 23.8k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 23.8k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 23.8k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 23.8k| (a) = c; \ | | 19| 23.8k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 23.8k] | | ------------------ ------------------ 579| 23.8k| int32x8 e0 = _mm256_permute2x128_si256(d0, d1, 0x20); 580| 23.8k| int32x8 e1 = _mm256_permute2x128_si256(d0, d1, 0x31); 581| 23.8k| int32x8_store(&z[0], e0); ------------------ | | 10| 23.8k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 582| 23.8k| int32x8_store(&z[8], e1); ------------------ | | 10| 23.8k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 583| 23.8k| z += 16; 584| 23.8k| } 585| 1.40k| } 586| | 587| 4.21k| q = n >> 4; 588| 4.89k| while (q >= 128 || q == 32) { ------------------ | Branch (588:16): [True: 0, False: 4.89k] | Branch (588:28): [True: 678, False: 4.21k] ------------------ 589| 678| int32_threestages(x, n, q >> 2); 590| 678| q >>= 3; 591| 678| } 592| 7.18k| while (q >= 16) { ------------------ | Branch (592:16): [True: 2.97k, False: 4.21k] ------------------ 593| 2.97k| q >>= 1; 594| 26.7k| for (j = 0; j < n; j += 4 * q) { ------------------ | Branch (594:25): [True: 23.7k, False: 2.97k] ------------------ 595| 47.5k| for (k = j; k < j + q; k += 8) { ------------------ | Branch (595:29): [True: 23.7k, False: 23.7k] ------------------ 596| 23.7k| int32x8 x0 = int32x8_load(&x[k]); ------------------ | | 9| 23.7k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 597| 23.7k| int32x8 x1 = int32x8_load(&x[k + q]); ------------------ | | 9| 23.7k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 598| 23.7k| int32x8 x2 = int32x8_load(&x[k + 2 * q]); ------------------ | | 9| 23.7k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 599| 23.7k| int32x8 x3 = int32x8_load(&x[k + 3 * q]); ------------------ | | 9| 23.7k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 600| | 601| 23.7k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 23.7k| do { \ | | 16| 23.7k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 23.7k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 23.7k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 23.7k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 23.7k| (a) = c; \ | | 19| 23.7k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 23.7k] | | ------------------ ------------------ 602| 23.7k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 23.7k| do { \ | | 16| 23.7k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 23.7k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 23.7k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 23.7k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 23.7k| (a) = c; \ | | 19| 23.7k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 23.7k] | | ------------------ ------------------ 603| 23.7k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 23.7k| do { \ | | 16| 23.7k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 23.7k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 23.7k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 23.7k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 23.7k| (a) = c; \ | | 19| 23.7k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 23.7k] | | ------------------ ------------------ 604| 23.7k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 23.7k| do { \ | | 16| 23.7k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 23.7k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 23.7k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 23.7k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 23.7k| (a) = c; \ | | 19| 23.7k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 23.7k] | | ------------------ ------------------ 605| | 606| 23.7k| int32x8_store(&x[k], x0); ------------------ | | 10| 23.7k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 607| 23.7k| int32x8_store(&x[k + q], x1); ------------------ | | 10| 23.7k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 608| 23.7k| int32x8_store(&x[k + 2 * q], x2); ------------------ | | 10| 23.7k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 609| 23.7k| int32x8_store(&x[k + 3 * q], x3); ------------------ | | 10| 23.7k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 610| 23.7k| } 611| 23.7k| } 612| 2.97k| q >>= 1; 613| 2.97k| } 614| 4.21k| if (q == 8) { ------------------ | Branch (614:13): [True: 0, False: 4.21k] ------------------ 615| 0| for (j = 0; j < n; j += 2 * q) { ------------------ | Branch (615:25): [True: 0, False: 0] ------------------ 616| 0| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 617| 0| int32x8 x1 = int32x8_load(&x[j + q]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 618| | 619| 0| int32x8_MINMAX(x0, x1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 620| | 621| 0| int32x8_store(&x[j], x0); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 622| 0| int32x8_store(&x[j + q], x1); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 623| 0| } 624| 0| } 625| | 626| 4.21k| q = n >> 3; 627| 22.0k| for (k = 0; k < q; k += 8) { ------------------ | Branch (627:21): [True: 17.8k, False: 4.21k] ------------------ 628| 17.8k| int32x8 x0 = int32x8_load(&x[k]); ------------------ | | 9| 17.8k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 629| 17.8k| int32x8 x1 = int32x8_load(&x[k + q]); ------------------ | | 9| 17.8k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 630| 17.8k| int32x8 x2 = int32x8_load(&x[k + 2 * q]); ------------------ | | 9| 17.8k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 631| 17.8k| int32x8 x3 = int32x8_load(&x[k + 3 * q]); ------------------ | | 9| 17.8k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 632| 17.8k| int32x8 x4 = int32x8_load(&x[k + 4 * q]); ------------------ | | 9| 17.8k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 633| 17.8k| int32x8 x5 = int32x8_load(&x[k + 5 * q]); ------------------ | | 9| 17.8k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 634| 17.8k| int32x8 x6 = int32x8_load(&x[k + 6 * q]); ------------------ | | 9| 17.8k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 635| 17.8k| int32x8 x7 = int32x8_load(&x[k + 7 * q]); ------------------ | | 9| 17.8k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 636| | 637| 17.8k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 17.8k| do { \ | | 16| 17.8k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 17.8k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 17.8k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 17.8k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 17.8k| (a) = c; \ | | 19| 17.8k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 17.8k] | | ------------------ ------------------ 638| 17.8k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 17.8k| do { \ | | 16| 17.8k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 17.8k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 17.8k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 17.8k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 17.8k| (a) = c; \ | | 19| 17.8k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 17.8k] | | ------------------ ------------------ 639| 17.8k| int32x8_MINMAX(x4, x5); ------------------ | | 15| 17.8k| do { \ | | 16| 17.8k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 17.8k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 17.8k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 17.8k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 17.8k| (a) = c; \ | | 19| 17.8k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 17.8k] | | ------------------ ------------------ 640| 17.8k| int32x8_MINMAX(x6, x7); ------------------ | | 15| 17.8k| do { \ | | 16| 17.8k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 17.8k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 17.8k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 17.8k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 17.8k| (a) = c; \ | | 19| 17.8k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 17.8k] | | ------------------ ------------------ 641| 17.8k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 17.8k| do { \ | | 16| 17.8k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 17.8k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 17.8k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 17.8k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 17.8k| (a) = c; \ | | 19| 17.8k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 17.8k] | | ------------------ ------------------ 642| 17.8k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 17.8k| do { \ | | 16| 17.8k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 17.8k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 17.8k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 17.8k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 17.8k| (a) = c; \ | | 19| 17.8k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 17.8k] | | ------------------ ------------------ 643| 17.8k| int32x8_MINMAX(x4, x6); ------------------ | | 15| 17.8k| do { \ | | 16| 17.8k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 17.8k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 17.8k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 17.8k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 17.8k| (a) = c; \ | | 19| 17.8k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 17.8k] | | ------------------ ------------------ 644| 17.8k| int32x8_MINMAX(x5, x7); ------------------ | | 15| 17.8k| do { \ | | 16| 17.8k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 17.8k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 17.8k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 17.8k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 17.8k| (a) = c; \ | | 19| 17.8k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 17.8k] | | ------------------ ------------------ 645| 17.8k| int32x8_MINMAX(x0, x4); ------------------ | | 15| 17.8k| do { \ | | 16| 17.8k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 17.8k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 17.8k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 17.8k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 17.8k| (a) = c; \ | | 19| 17.8k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 17.8k] | | ------------------ ------------------ 646| 17.8k| int32x8_MINMAX(x1, x5); ------------------ | | 15| 17.8k| do { \ | | 16| 17.8k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 17.8k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 17.8k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 17.8k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 17.8k| (a) = c; \ | | 19| 17.8k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 17.8k] | | ------------------ ------------------ 647| 17.8k| int32x8_MINMAX(x2, x6); ------------------ | | 15| 17.8k| do { \ | | 16| 17.8k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 17.8k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 17.8k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 17.8k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 17.8k| (a) = c; \ | | 19| 17.8k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 17.8k] | | ------------------ ------------------ 648| 17.8k| int32x8_MINMAX(x3, x7); ------------------ | | 15| 17.8k| do { \ | | 16| 17.8k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 17.8k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 17.8k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 17.8k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 17.8k| (a) = c; \ | | 19| 17.8k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 17.8k] | | ------------------ ------------------ 649| | 650| 17.8k| int32x8_store(&x[k], x0); ------------------ | | 10| 17.8k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 651| 17.8k| int32x8_store(&x[k + q], x1); ------------------ | | 10| 17.8k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 652| 17.8k| int32x8_store(&x[k + 2 * q], x2); ------------------ | | 10| 17.8k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 653| 17.8k| int32x8_store(&x[k + 3 * q], x3); ------------------ | | 10| 17.8k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 654| 17.8k| int32x8_store(&x[k + 4 * q], x4); ------------------ | | 10| 17.8k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 655| 17.8k| int32x8_store(&x[k + 5 * q], x5); ------------------ | | 10| 17.8k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 656| 17.8k| int32x8_store(&x[k + 6 * q], x6); ------------------ | | 10| 17.8k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 657| 17.8k| int32x8_store(&x[k + 7 * q], x7); ------------------ | | 10| 17.8k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 658| 17.8k| } 659| 4.21k| } 660| | 661| | /* everything is still masked with _mm256_set_epi32(0,-1,0,-1,0,-1,0,-1); */ 662| 1.40k| mask = _mm256_set1_epi32(-1); 663| | 664| 7.36k| for (i = 0; i < n; i += 64) { ------------------ | Branch (664:17): [True: 5.95k, False: 1.40k] ------------------ 665| 5.95k| int32x8 a0 = int32x8_load(&x[i]); ------------------ | | 9| 5.95k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 666| 5.95k| int32x8 a1 = int32x8_load(&x[i + 8]); ------------------ | | 9| 5.95k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 667| 5.95k| int32x8 a2 = int32x8_load(&x[i + 16]); ------------------ | | 9| 5.95k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 668| 5.95k| int32x8 a3 = int32x8_load(&x[i + 24]); ------------------ | | 9| 5.95k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 669| 5.95k| int32x8 a4 = int32x8_load(&x[i + 32]); ------------------ | | 9| 5.95k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 670| 5.95k| int32x8 a5 = int32x8_load(&x[i + 40]); ------------------ | | 9| 5.95k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 671| 5.95k| int32x8 a6 = int32x8_load(&x[i + 48]); ------------------ | | 9| 5.95k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 672| 5.95k| int32x8 a7 = int32x8_load(&x[i + 56]); ------------------ | | 9| 5.95k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 673| | 674| 5.95k| int32x8 b0 = _mm256_unpacklo_epi32(a0, a1); /* AB0AB1AB4AB5 */ 675| 5.95k| int32x8 b1 = _mm256_unpackhi_epi32(a0, a1); /* AB2AB3AB6AB7 */ 676| 5.95k| int32x8 b2 = _mm256_unpacklo_epi32(a2, a3); /* CD0CD1CD4CD5 */ 677| 5.95k| int32x8 b3 = _mm256_unpackhi_epi32(a2, a3); /* CD2CD3CD6CD7 */ 678| 5.95k| int32x8 b4 = _mm256_unpacklo_epi32(a4, a5); /* EF0EF1EF4EF5 */ 679| 5.95k| int32x8 b5 = _mm256_unpackhi_epi32(a4, a5); /* EF2EF3EF6EF7 */ 680| 5.95k| int32x8 b6 = _mm256_unpacklo_epi32(a6, a7); /* GH0GH1GH4GH5 */ 681| 5.95k| int32x8 b7 = _mm256_unpackhi_epi32(a6, a7); /* GH2GH3GH6GH7 */ 682| | 683| 5.95k| int32x8 c0 = _mm256_unpacklo_epi64(b0, b2); /* ABCD0ABCD4 */ 684| 5.95k| int32x8 c1 = _mm256_unpacklo_epi64(b1, b3); /* ABCD2ABCD6 */ 685| 5.95k| int32x8 c2 = _mm256_unpackhi_epi64(b0, b2); /* ABCD1ABCD5 */ 686| 5.95k| int32x8 c3 = _mm256_unpackhi_epi64(b1, b3); /* ABCD3ABCD7 */ 687| 5.95k| int32x8 c4 = _mm256_unpacklo_epi64(b4, b6); /* EFGH0EFGH4 */ 688| 5.95k| int32x8 c5 = _mm256_unpacklo_epi64(b5, b7); /* EFGH2EFGH6 */ 689| 5.95k| int32x8 c6 = _mm256_unpackhi_epi64(b4, b6); /* EFGH1EFGH5 */ 690| 5.95k| int32x8 c7 = _mm256_unpackhi_epi64(b5, b7); /* EFGH3EFGH7 */ 691| | 692| 5.95k| if (flagdown) { ------------------ | Branch (692:13): [True: 4.09k, False: 1.86k] ------------------ 693| 4.09k| c2 ^= mask; 694| 4.09k| c3 ^= mask; 695| 4.09k| c6 ^= mask; 696| 4.09k| c7 ^= mask; 697| 4.09k| } else { 698| 1.86k| c0 ^= mask; 699| 1.86k| c1 ^= mask; 700| 1.86k| c4 ^= mask; 701| 1.86k| c5 ^= mask; 702| 1.86k| } 703| | 704| 5.95k| int32x8 d0 = _mm256_permute2x128_si256(c0, c4, 0x20); /* ABCDEFGH0 */ 705| 5.95k| int32x8 d1 = _mm256_permute2x128_si256(c2, c6, 0x20); /* ABCDEFGH1 */ 706| 5.95k| int32x8 d2 = _mm256_permute2x128_si256(c1, c5, 0x20); /* ABCDEFGH2 */ 707| 5.95k| int32x8 d3 = _mm256_permute2x128_si256(c3, c7, 0x20); /* ABCDEFGH5 */ 708| 5.95k| int32x8 d4 = _mm256_permute2x128_si256(c0, c4, 0x31); /* ABCDEFGH4 */ 709| 5.95k| int32x8 d5 = _mm256_permute2x128_si256(c2, c6, 0x31); /* ABCDEFGH3 */ 710| 5.95k| int32x8 d6 = _mm256_permute2x128_si256(c1, c5, 0x31); /* ABCDEFGH6 */ 711| 5.95k| int32x8 d7 = _mm256_permute2x128_si256(c3, c7, 0x31); /* ABCDEFGH7 */ 712| | 713| 5.95k| int32x8_MINMAX(d0, d1); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 714| 5.95k| int32x8_MINMAX(d2, d3); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 715| 5.95k| int32x8_MINMAX(d4, d5); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 716| 5.95k| int32x8_MINMAX(d6, d7); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 717| 5.95k| int32x8_MINMAX(d0, d2); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 718| 5.95k| int32x8_MINMAX(d1, d3); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 719| 5.95k| int32x8_MINMAX(d4, d6); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 720| 5.95k| int32x8_MINMAX(d5, d7); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 721| 5.95k| int32x8_MINMAX(d0, d4); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 722| 5.95k| int32x8_MINMAX(d1, d5); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 723| 5.95k| int32x8_MINMAX(d2, d6); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 724| 5.95k| int32x8_MINMAX(d3, d7); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 725| | 726| 5.95k| int32x8 e0 = _mm256_unpacklo_epi32(d0, d1); 727| 5.95k| int32x8 e1 = _mm256_unpackhi_epi32(d0, d1); 728| 5.95k| int32x8 e2 = _mm256_unpacklo_epi32(d2, d3); 729| 5.95k| int32x8 e3 = _mm256_unpackhi_epi32(d2, d3); 730| 5.95k| int32x8 e4 = _mm256_unpacklo_epi32(d4, d5); 731| 5.95k| int32x8 e5 = _mm256_unpackhi_epi32(d4, d5); 732| 5.95k| int32x8 e6 = _mm256_unpacklo_epi32(d6, d7); 733| 5.95k| int32x8 e7 = _mm256_unpackhi_epi32(d6, d7); 734| | 735| 5.95k| int32x8 f0 = _mm256_unpacklo_epi64(e0, e2); 736| 5.95k| int32x8 f1 = _mm256_unpacklo_epi64(e1, e3); 737| 5.95k| int32x8 f2 = _mm256_unpackhi_epi64(e0, e2); 738| 5.95k| int32x8 f3 = _mm256_unpackhi_epi64(e1, e3); 739| 5.95k| int32x8 f4 = _mm256_unpacklo_epi64(e4, e6); 740| 5.95k| int32x8 f5 = _mm256_unpacklo_epi64(e5, e7); 741| 5.95k| int32x8 f6 = _mm256_unpackhi_epi64(e4, e6); 742| 5.95k| int32x8 f7 = _mm256_unpackhi_epi64(e5, e7); 743| | 744| 5.95k| int32x8 g0 = _mm256_permute2x128_si256(f0, f4, 0x20); 745| 5.95k| int32x8 g1 = _mm256_permute2x128_si256(f2, f6, 0x20); 746| 5.95k| int32x8 g2 = _mm256_permute2x128_si256(f1, f5, 0x20); 747| 5.95k| int32x8 g3 = _mm256_permute2x128_si256(f3, f7, 0x20); 748| 5.95k| int32x8 g4 = _mm256_permute2x128_si256(f0, f4, 0x31); 749| 5.95k| int32x8 g5 = _mm256_permute2x128_si256(f2, f6, 0x31); 750| 5.95k| int32x8 g6 = _mm256_permute2x128_si256(f1, f5, 0x31); 751| 5.95k| int32x8 g7 = _mm256_permute2x128_si256(f3, f7, 0x31); 752| | 753| 5.95k| int32x8_store(&x[i], g0); ------------------ | | 10| 5.95k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 754| 5.95k| int32x8_store(&x[i + 8], g1); ------------------ | | 10| 5.95k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 755| 5.95k| int32x8_store(&x[i + 16], g2); ------------------ | | 10| 5.95k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 756| 5.95k| int32x8_store(&x[i + 24], g3); ------------------ | | 10| 5.95k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 757| 5.95k| int32x8_store(&x[i + 32], g4); ------------------ | | 10| 5.95k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 758| 5.95k| int32x8_store(&x[i + 40], g5); ------------------ | | 10| 5.95k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 759| 5.95k| int32x8_store(&x[i + 48], g6); ------------------ | | 10| 5.95k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 760| 5.95k| int32x8_store(&x[i + 56], g7); ------------------ | | 10| 5.95k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 761| 5.95k| } 762| | 763| 1.40k| q = n >> 4; 764| 1.63k| while (q >= 128 || q == 32) { ------------------ | Branch (764:12): [True: 0, False: 1.63k] | Branch (764:24): [True: 226, False: 1.40k] ------------------ 765| 226| q >>= 2; 766| 2.03k| for (j = 0; j < n; j += 8 * q) { ------------------ | Branch (766:21): [True: 1.80k, False: 226] ------------------ 767| 3.61k| for (i = j; i < j + q; i += 8) { ------------------ | Branch (767:25): [True: 1.80k, False: 1.80k] ------------------ 768| 1.80k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 1.80k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 769| 1.80k| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 1.80k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 770| 1.80k| int32x8 x2 = int32x8_load(&x[i + 2 * q]); ------------------ | | 9| 1.80k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 771| 1.80k| int32x8 x3 = int32x8_load(&x[i + 3 * q]); ------------------ | | 9| 1.80k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 772| 1.80k| int32x8 x4 = int32x8_load(&x[i + 4 * q]); ------------------ | | 9| 1.80k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 773| 1.80k| int32x8 x5 = int32x8_load(&x[i + 5 * q]); ------------------ | | 9| 1.80k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 774| 1.80k| int32x8 x6 = int32x8_load(&x[i + 6 * q]); ------------------ | | 9| 1.80k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 775| 1.80k| int32x8 x7 = int32x8_load(&x[i + 7 * q]); ------------------ | | 9| 1.80k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 776| 1.80k| int32x8_MINMAX(x0, x4); ------------------ | | 15| 1.80k| do { \ | | 16| 1.80k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.80k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.80k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.80k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.80k| (a) = c; \ | | 19| 1.80k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.80k] | | ------------------ ------------------ 777| 1.80k| int32x8_MINMAX(x1, x5); ------------------ | | 15| 1.80k| do { \ | | 16| 1.80k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.80k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.80k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.80k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.80k| (a) = c; \ | | 19| 1.80k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.80k] | | ------------------ ------------------ 778| 1.80k| int32x8_MINMAX(x2, x6); ------------------ | | 15| 1.80k| do { \ | | 16| 1.80k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.80k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.80k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.80k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.80k| (a) = c; \ | | 19| 1.80k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.80k] | | ------------------ ------------------ 779| 1.80k| int32x8_MINMAX(x3, x7); ------------------ | | 15| 1.80k| do { \ | | 16| 1.80k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.80k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.80k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.80k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.80k| (a) = c; \ | | 19| 1.80k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.80k] | | ------------------ ------------------ 780| 1.80k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 1.80k| do { \ | | 16| 1.80k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.80k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.80k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.80k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.80k| (a) = c; \ | | 19| 1.80k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.80k] | | ------------------ ------------------ 781| 1.80k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 1.80k| do { \ | | 16| 1.80k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.80k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.80k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.80k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.80k| (a) = c; \ | | 19| 1.80k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.80k] | | ------------------ ------------------ 782| 1.80k| int32x8_MINMAX(x4, x6); ------------------ | | 15| 1.80k| do { \ | | 16| 1.80k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.80k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.80k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.80k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.80k| (a) = c; \ | | 19| 1.80k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.80k] | | ------------------ ------------------ 783| 1.80k| int32x8_MINMAX(x5, x7); ------------------ | | 15| 1.80k| do { \ | | 16| 1.80k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.80k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.80k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.80k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.80k| (a) = c; \ | | 19| 1.80k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.80k] | | ------------------ ------------------ 784| 1.80k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 1.80k| do { \ | | 16| 1.80k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.80k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.80k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.80k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.80k| (a) = c; \ | | 19| 1.80k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.80k] | | ------------------ ------------------ 785| 1.80k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 1.80k| do { \ | | 16| 1.80k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.80k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.80k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.80k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.80k| (a) = c; \ | | 19| 1.80k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.80k] | | ------------------ ------------------ 786| 1.80k| int32x8_MINMAX(x4, x5); ------------------ | | 15| 1.80k| do { \ | | 16| 1.80k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.80k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.80k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.80k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.80k| (a) = c; \ | | 19| 1.80k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.80k] | | ------------------ ------------------ 787| 1.80k| int32x8_MINMAX(x6, x7); ------------------ | | 15| 1.80k| do { \ | | 16| 1.80k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.80k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.80k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.80k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.80k| (a) = c; \ | | 19| 1.80k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.80k] | | ------------------ ------------------ 788| 1.80k| int32x8_store(&x[i], x0); ------------------ | | 10| 1.80k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 789| 1.80k| int32x8_store(&x[i + q], x1); ------------------ | | 10| 1.80k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 790| 1.80k| int32x8_store(&x[i + 2 * q], x2); ------------------ | | 10| 1.80k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 791| 1.80k| int32x8_store(&x[i + 3 * q], x3); ------------------ | | 10| 1.80k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 792| 1.80k| int32x8_store(&x[i + 4 * q], x4); ------------------ | | 10| 1.80k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 793| 1.80k| int32x8_store(&x[i + 5 * q], x5); ------------------ | | 10| 1.80k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 794| 1.80k| int32x8_store(&x[i + 6 * q], x6); ------------------ | | 10| 1.80k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 795| 1.80k| int32x8_store(&x[i + 7 * q], x7); ------------------ | | 10| 1.80k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 796| 1.80k| } 797| 1.80k| } 798| 226| q >>= 1; 799| 226| } 800| 2.39k| while (q >= 16) { ------------------ | Branch (800:12): [True: 990, False: 1.40k] ------------------ 801| 990| q >>= 1; 802| 8.91k| for (j = 0; j < n; j += 4 * q) { ------------------ | Branch (802:21): [True: 7.92k, False: 990] ------------------ 803| 15.8k| for (i = j; i < j + q; i += 8) { ------------------ | Branch (803:25): [True: 7.92k, False: 7.92k] ------------------ 804| 7.92k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 7.92k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 805| 7.92k| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 7.92k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 806| 7.92k| int32x8 x2 = int32x8_load(&x[i + 2 * q]); ------------------ | | 9| 7.92k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 807| 7.92k| int32x8 x3 = int32x8_load(&x[i + 3 * q]); ------------------ | | 9| 7.92k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 808| 7.92k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 7.92k| do { \ | | 16| 7.92k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.92k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.92k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.92k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.92k| (a) = c; \ | | 19| 7.92k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.92k] | | ------------------ ------------------ 809| 7.92k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 7.92k| do { \ | | 16| 7.92k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.92k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.92k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.92k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.92k| (a) = c; \ | | 19| 7.92k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.92k] | | ------------------ ------------------ 810| 7.92k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 7.92k| do { \ | | 16| 7.92k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.92k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.92k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.92k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.92k| (a) = c; \ | | 19| 7.92k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.92k] | | ------------------ ------------------ 811| 7.92k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 7.92k| do { \ | | 16| 7.92k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 7.92k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 7.92k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 7.92k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 7.92k| (a) = c; \ | | 19| 7.92k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 7.92k] | | ------------------ ------------------ 812| 7.92k| int32x8_store(&x[i], x0); ------------------ | | 10| 7.92k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 813| 7.92k| int32x8_store(&x[i + q], x1); ------------------ | | 10| 7.92k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 814| 7.92k| int32x8_store(&x[i + 2 * q], x2); ------------------ | | 10| 7.92k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 815| 7.92k| int32x8_store(&x[i + 3 * q], x3); ------------------ | | 10| 7.92k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 816| 7.92k| } 817| 7.92k| } 818| 990| q >>= 1; 819| 990| } 820| 1.40k| if (q == 8) { ------------------ | Branch (820:9): [True: 0, False: 1.40k] ------------------ 821| 0| for (j = 0; j < n; j += q + q) { ------------------ | Branch (821:21): [True: 0, False: 0] ------------------ 822| 0| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 823| 0| int32x8 x1 = int32x8_load(&x[j + q]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 824| 0| int32x8_MINMAX(x0, x1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 825| 0| int32x8_store(&x[j], x0); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 826| 0| int32x8_store(&x[j + q], x1); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 827| 0| } 828| 0| } 829| | 830| 1.40k| q = n >> 3; 831| 7.36k| for (i = 0; i < q; i += 8) { ------------------ | Branch (831:17): [True: 5.95k, False: 1.40k] ------------------ 832| 5.95k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 5.95k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 833| 5.95k| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 5.95k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 834| 5.95k| int32x8 x2 = int32x8_load(&x[i + 2 * q]); ------------------ | | 9| 5.95k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 835| 5.95k| int32x8 x3 = int32x8_load(&x[i + 3 * q]); ------------------ | | 9| 5.95k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 836| 5.95k| int32x8 x4 = int32x8_load(&x[i + 4 * q]); ------------------ | | 9| 5.95k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 837| 5.95k| int32x8 x5 = int32x8_load(&x[i + 5 * q]); ------------------ | | 9| 5.95k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 838| 5.95k| int32x8 x6 = int32x8_load(&x[i + 6 * q]); ------------------ | | 9| 5.95k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 839| 5.95k| int32x8 x7 = int32x8_load(&x[i + 7 * q]); ------------------ | | 9| 5.95k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 840| | 841| 5.95k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 842| 5.95k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 843| 5.95k| int32x8_MINMAX(x4, x5); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 844| 5.95k| int32x8_MINMAX(x6, x7); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 845| 5.95k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 846| 5.95k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 847| 5.95k| int32x8_MINMAX(x4, x6); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 848| 5.95k| int32x8_MINMAX(x5, x7); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 849| 5.95k| int32x8_MINMAX(x0, x4); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 850| 5.95k| int32x8_MINMAX(x1, x5); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 851| 5.95k| int32x8_MINMAX(x2, x6); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 852| 5.95k| int32x8_MINMAX(x3, x7); ------------------ | | 15| 5.95k| do { \ | | 16| 5.95k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 5.95k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 5.95k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 5.95k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 5.95k| (a) = c; \ | | 19| 5.95k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 5.95k] | | ------------------ ------------------ 853| | 854| 5.95k| int32x8 b0 = _mm256_unpacklo_epi32(x0, x4); /* AE0AE1AE4AE5 */ 855| 5.95k| int32x8 b1 = _mm256_unpackhi_epi32(x0, x4); /* AE2AE3AE6AE7 */ 856| 5.95k| int32x8 b2 = _mm256_unpacklo_epi32(x1, x5); /* BF0BF1BF4BF5 */ 857| 5.95k| int32x8 b3 = _mm256_unpackhi_epi32(x1, x5); /* BF2BF3BF6BF7 */ 858| 5.95k| int32x8 b4 = _mm256_unpacklo_epi32(x2, x6); /* CG0CG1CG4CG5 */ 859| 5.95k| int32x8 b5 = _mm256_unpackhi_epi32(x2, x6); /* CG2CG3CG6CG7 */ 860| 5.95k| int32x8 b6 = _mm256_unpacklo_epi32(x3, x7); /* DH0DH1DH4DH5 */ 861| 5.95k| int32x8 b7 = _mm256_unpackhi_epi32(x3, x7); /* DH2DH3DH6DH7 */ 862| | 863| 5.95k| int32x8 c0 = _mm256_unpacklo_epi64(b0, b4); /* AECG0AECG4 */ 864| 5.95k| int32x8 c1 = _mm256_unpacklo_epi64(b1, b5); /* AECG2AECG6 */ 865| 5.95k| int32x8 c2 = _mm256_unpackhi_epi64(b0, b4); /* AECG1AECG5 */ 866| 5.95k| int32x8 c3 = _mm256_unpackhi_epi64(b1, b5); /* AECG3AECG7 */ 867| 5.95k| int32x8 c4 = _mm256_unpacklo_epi64(b2, b6); /* BFDH0BFDH4 */ 868| 5.95k| int32x8 c5 = _mm256_unpacklo_epi64(b3, b7); /* BFDH2BFDH6 */ 869| 5.95k| int32x8 c6 = _mm256_unpackhi_epi64(b2, b6); /* BFDH1BFDH5 */ 870| 5.95k| int32x8 c7 = _mm256_unpackhi_epi64(b3, b7); /* BFDH3BFDH7 */ 871| | 872| 5.95k| int32x8 d0 = _mm256_permute2x128_si256(c0, c4, 0x20); /* AECGBFDH0 */ 873| 5.95k| int32x8 d1 = _mm256_permute2x128_si256(c1, c5, 0x20); /* AECGBFDH2 */ 874| 5.95k| int32x8 d2 = _mm256_permute2x128_si256(c2, c6, 0x20); /* AECGBFDH1 */ 875| 5.95k| int32x8 d3 = _mm256_permute2x128_si256(c3, c7, 0x20); /* AECGBFDH3 */ 876| 5.95k| int32x8 d4 = _mm256_permute2x128_si256(c0, c4, 0x31); /* AECGBFDH4 */ 877| 5.95k| int32x8 d5 = _mm256_permute2x128_si256(c1, c5, 0x31); /* AECGBFDH6 */ 878| 5.95k| int32x8 d6 = _mm256_permute2x128_si256(c2, c6, 0x31); /* AECGBFDH5 */ 879| 5.95k| int32x8 d7 = _mm256_permute2x128_si256(c3, c7, 0x31); /* AECGBFDH7 */ 880| | 881| 5.95k| if (flagdown) { ------------------ | Branch (881:13): [True: 4.09k, False: 1.86k] ------------------ 882| 4.09k| d0 ^= mask; 883| 4.09k| d1 ^= mask; 884| 4.09k| d2 ^= mask; 885| 4.09k| d3 ^= mask; 886| 4.09k| d4 ^= mask; 887| 4.09k| d5 ^= mask; 888| 4.09k| d6 ^= mask; 889| 4.09k| d7 ^= mask; 890| 4.09k| } 891| | 892| 5.95k| int32x8_store(&x[i], d0); ------------------ | | 10| 5.95k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 893| 5.95k| int32x8_store(&x[i + q], d4); ------------------ | | 10| 5.95k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 894| 5.95k| int32x8_store(&x[i + 2 * q], d1); ------------------ | | 10| 5.95k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 895| 5.95k| int32x8_store(&x[i + 3 * q], d5); ------------------ | | 10| 5.95k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 896| 5.95k| int32x8_store(&x[i + 4 * q], d2); ------------------ | | 10| 5.95k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 897| 5.95k| int32x8_store(&x[i + 5 * q], d6); ------------------ | | 10| 5.95k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 898| 5.95k| int32x8_store(&x[i + 6 * q], d3); ------------------ | | 10| 5.95k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 899| 5.95k| int32x8_store(&x[i + 7 * q], d7); ------------------ | | 10| 5.95k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 900| 5.95k| } 901| 1.40k|} crypto_sort_int32.c:int32_threestages: 132| 1.70k|static size_t int32_threestages(int32 *x, size_t n, size_t q) { 133| 1.70k| size_t k, i; 134| | 135| 8.44k| for (k = 0; k + 8 * q <= n; k += 8 * q) { ------------------ | Branch (135:17): [True: 6.74k, False: 1.70k] ------------------ 136| 14.8k| for (i = k; i < k + q; i += 8) { ------------------ | Branch (136:21): [True: 8.06k, False: 6.74k] ------------------ 137| 8.06k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 8.06k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 138| 8.06k| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 8.06k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 139| 8.06k| int32x8 x2 = int32x8_load(&x[i + 2 * q]); ------------------ | | 9| 8.06k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 140| 8.06k| int32x8 x3 = int32x8_load(&x[i + 3 * q]); ------------------ | | 9| 8.06k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 141| 8.06k| int32x8 x4 = int32x8_load(&x[i + 4 * q]); ------------------ | | 9| 8.06k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 142| 8.06k| int32x8 x5 = int32x8_load(&x[i + 5 * q]); ------------------ | | 9| 8.06k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 143| 8.06k| int32x8 x6 = int32x8_load(&x[i + 6 * q]); ------------------ | | 9| 8.06k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 144| 8.06k| int32x8 x7 = int32x8_load(&x[i + 7 * q]); ------------------ | | 9| 8.06k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 145| | 146| 8.06k| int32x8_MINMAX(x0, x4); ------------------ | | 15| 8.06k| do { \ | | 16| 8.06k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 8.06k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 8.06k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 8.06k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 8.06k| (a) = c; \ | | 19| 8.06k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 8.06k] | | ------------------ ------------------ 147| 8.06k| int32x8_MINMAX(x1, x5); ------------------ | | 15| 8.06k| do { \ | | 16| 8.06k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 8.06k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 8.06k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 8.06k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 8.06k| (a) = c; \ | | 19| 8.06k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 8.06k] | | ------------------ ------------------ 148| 8.06k| int32x8_MINMAX(x2, x6); ------------------ | | 15| 8.06k| do { \ | | 16| 8.06k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 8.06k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 8.06k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 8.06k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 8.06k| (a) = c; \ | | 19| 8.06k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 8.06k] | | ------------------ ------------------ 149| 8.06k| int32x8_MINMAX(x3, x7); ------------------ | | 15| 8.06k| do { \ | | 16| 8.06k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 8.06k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 8.06k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 8.06k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 8.06k| (a) = c; \ | | 19| 8.06k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 8.06k] | | ------------------ ------------------ 150| 8.06k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 8.06k| do { \ | | 16| 8.06k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 8.06k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 8.06k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 8.06k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 8.06k| (a) = c; \ | | 19| 8.06k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 8.06k] | | ------------------ ------------------ 151| 8.06k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 8.06k| do { \ | | 16| 8.06k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 8.06k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 8.06k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 8.06k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 8.06k| (a) = c; \ | | 19| 8.06k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 8.06k] | | ------------------ ------------------ 152| 8.06k| int32x8_MINMAX(x4, x6); ------------------ | | 15| 8.06k| do { \ | | 16| 8.06k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 8.06k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 8.06k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 8.06k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 8.06k| (a) = c; \ | | 19| 8.06k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 8.06k] | | ------------------ ------------------ 153| 8.06k| int32x8_MINMAX(x5, x7); ------------------ | | 15| 8.06k| do { \ | | 16| 8.06k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 8.06k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 8.06k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 8.06k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 8.06k| (a) = c; \ | | 19| 8.06k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 8.06k] | | ------------------ ------------------ 154| 8.06k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 8.06k| do { \ | | 16| 8.06k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 8.06k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 8.06k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 8.06k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 8.06k| (a) = c; \ | | 19| 8.06k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 8.06k] | | ------------------ ------------------ 155| 8.06k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 8.06k| do { \ | | 16| 8.06k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 8.06k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 8.06k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 8.06k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 8.06k| (a) = c; \ | | 19| 8.06k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 8.06k] | | ------------------ ------------------ 156| 8.06k| int32x8_MINMAX(x4, x5); ------------------ | | 15| 8.06k| do { \ | | 16| 8.06k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 8.06k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 8.06k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 8.06k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 8.06k| (a) = c; \ | | 19| 8.06k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 8.06k] | | ------------------ ------------------ 157| 8.06k| int32x8_MINMAX(x6, x7); ------------------ | | 15| 8.06k| do { \ | | 16| 8.06k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 8.06k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 8.06k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 8.06k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 8.06k| (a) = c; \ | | 19| 8.06k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 8.06k] | | ------------------ ------------------ 158| | 159| 8.06k| int32x8_store(&x[i], x0); ------------------ | | 10| 8.06k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 160| 8.06k| int32x8_store(&x[i + q], x1); ------------------ | | 10| 8.06k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 161| 8.06k| int32x8_store(&x[i + 2 * q], x2); ------------------ | | 10| 8.06k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 162| 8.06k| int32x8_store(&x[i + 3 * q], x3); ------------------ | | 10| 8.06k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 163| 8.06k| int32x8_store(&x[i + 4 * q], x4); ------------------ | | 10| 8.06k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 164| 8.06k| int32x8_store(&x[i + 5 * q], x5); ------------------ | | 10| 8.06k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 165| 8.06k| int32x8_store(&x[i + 6 * q], x6); ------------------ | | 10| 8.06k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 166| 8.06k| int32x8_store(&x[i + 7 * q], x7); ------------------ | | 10| 8.06k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 167| 8.06k| } 168| 6.74k| } 169| | 170| 1.70k| return k; 171| 1.70k|} crypto_sort_int32.c:minmax_vector: 32| 5.81k|static void minmax_vector(int32 *x, int32 *y, size_t n) { 33| 5.81k| if ((long long) n < 8) { ------------------ | Branch (33:9): [True: 2.88k, False: 2.93k] ------------------ 34| 6.07k| while ((long long) n > 0) { ------------------ | Branch (34:16): [True: 3.19k, False: 2.88k] ------------------ 35| 3.19k| int32_MINMAX(x, y); 36| 3.19k| ++x; 37| 3.19k| ++y; 38| 3.19k| --n; 39| 3.19k| } 40| 2.88k| return; 41| 2.88k| } 42| 2.93k| if (n & 7) { ------------------ | Branch (42:9): [True: 2.93k, False: 0] ------------------ 43| 2.93k| int32x8 x0 = int32x8_load(x + n - 8); ------------------ | | 9| 2.93k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 44| 2.93k| int32x8 y0 = int32x8_load(y + n - 8); ------------------ | | 9| 2.93k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 45| 2.93k| int32x8_MINMAX(x0, y0); ------------------ | | 15| 2.93k| do { \ | | 16| 2.93k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 2.93k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 2.93k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 2.93k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 2.93k| (a) = c; \ | | 19| 2.93k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 2.93k] | | ------------------ ------------------ 46| 2.93k| int32x8_store(x + n - 8, x0); ------------------ | | 10| 2.93k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 47| 2.93k| int32x8_store(y + n - 8, y0); ------------------ | | 10| 2.93k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 48| 2.93k| n &= ~7; 49| 2.93k| } 50| 32.8k| do { 51| 32.8k| int32x8 x0 = int32x8_load(x); ------------------ | | 9| 32.8k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 52| 32.8k| int32x8 y0 = int32x8_load(y); ------------------ | | 9| 32.8k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 53| 32.8k| int32x8_MINMAX(x0, y0); ------------------ | | 15| 32.8k| do { \ | | 16| 32.8k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 32.8k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 32.8k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 32.8k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 32.8k| (a) = c; \ | | 19| 32.8k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 32.8k] | | ------------------ ------------------ 54| 32.8k| int32x8_store(x, x0); ------------------ | | 10| 32.8k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 55| 32.8k| int32x8_store(y, y0); ------------------ | | 10| 32.8k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 56| 32.8k| x += 8; 57| 32.8k| y += 8; 58| 32.8k| n -= 8; 59| 32.8k| } while (n); ------------------ | Branch (59:14): [True: 29.9k, False: 2.93k] ------------------ 60| 2.93k|} PQCLEAN_NTRUHPS2048509_AVX2_crypto_kem_keypair: 10| 191|int PQCLEAN_NTRUHPS2048509_AVX2_crypto_kem_keypair(uint8_t *pk, uint8_t *sk) { 11| 191| uint8_t seed[NTRU_SAMPLE_FG_BYTES]; 12| | 13| 191| randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 8| 191|#define randombytes OQS_randombytes ------------------ randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 22| 191|#define NTRU_SAMPLE_FG_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 20| 191|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 191|#define NTRU_N 509 | | | | ------------------ | | ------------------ | | #define NTRU_SAMPLE_FG_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 21| 191|#define NTRU_SAMPLE_FT_BYTES ((30*(NTRU_N-1)+7)/8) | | | | ------------------ | | | | | | 5| 191|#define NTRU_N 509 | | | | ------------------ | | ------------------ ------------------ 14| 191| PQCLEAN_NTRUHPS2048509_AVX2_owcpa_keypair(pk, sk, seed); 15| | 16| 191| randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 8| 191|#define randombytes OQS_randombytes ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 30| 191|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 26| 191|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 191|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 191|#define NTRU_N 509 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 29| 191|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 191|#define NTRU_LOGQ 11 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 191|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 191|#define NTRU_N 509 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 17| 191|#define NTRU_PRFKEYBYTES 32 ------------------ 17| | 18| 191| return 0; 19| 191|} PQCLEAN_NTRUHPS2048509_AVX2_crypto_kem_enc: 21| 191|int PQCLEAN_NTRUHPS2048509_AVX2_crypto_kem_enc(uint8_t *c, uint8_t *k, const uint8_t *pk) { 22| 191| poly r, m; 23| 191| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 24| 191| uint8_t rm_seed[NTRU_SAMPLE_RM_BYTES]; 25| | 26| 191| randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 8| 191|#define randombytes OQS_randombytes ------------------ randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 23| 191|#define NTRU_SAMPLE_RM_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 20| 191|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 191|#define NTRU_N 509 | | | | ------------------ | | ------------------ | | #define NTRU_SAMPLE_RM_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 21| 191|#define NTRU_SAMPLE_FT_BYTES ((30*(NTRU_N-1)+7)/8) | | | | ------------------ | | | | | | 5| 191|#define NTRU_N 509 | | | | ------------------ | | ------------------ ------------------ 27| | 28| 191| PQCLEAN_NTRUHPS2048509_AVX2_sample_rm(&r, &m, rm_seed); 29| | 30| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_tobytes(rm, &r); 31| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, &m); ------------------ | | 26| 191|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 191|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 191|#define NTRU_N 509 | | | | ------------------ | | ------------------ ------------------ 32| 191| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 191|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 28| 191|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 26| 191|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 191|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 191|#define NTRU_N 509 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 33| | 34| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_Z3_to_Zq(&r); 35| 191| PQCLEAN_NTRUHPS2048509_AVX2_owcpa_enc(c, &r, &m, pk); 36| | 37| 191| return 0; 38| 191|} PQCLEAN_NTRUHPS2048509_AVX2_crypto_kem_dec: 40| 191|int PQCLEAN_NTRUHPS2048509_AVX2_crypto_kem_dec(uint8_t *k, const uint8_t *c, const uint8_t *sk) { 41| 191| int i, fail; 42| 191| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 43| 191| uint8_t buf[NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES]; 44| | 45| 191| fail = PQCLEAN_NTRUHPS2048509_AVX2_owcpa_dec(rm, c, sk); 46| | /* If fail = 0 then c = Enc(h, rm). There is no need to re-encapsulate. */ 47| | /* See comment in PQCLEAN_NTRUHPS2048509_AVX2_owcpa_dec for details. */ 48| | 49| 191| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 191|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 28| 191|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 26| 191|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 191|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 191|#define NTRU_N 509 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 50| | 51| | /* shake(secret PRF key || input ciphertext) */ 52| 6.30k| for (i = 0; i < NTRU_PRFKEYBYTES; i++) { ------------------ | | 17| 6.30k|#define NTRU_PRFKEYBYTES 32 ------------------ | Branch (52:17): [True: 6.11k, False: 191] ------------------ 53| 6.11k| buf[i] = sk[i + NTRU_OWCPA_SECRETKEYBYTES]; ------------------ | | 30| 6.11k|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 26| 6.11k|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 6.11k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 6.11k|#define NTRU_N 509 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 29| 6.11k|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 6.11k|#define NTRU_LOGQ 11 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 6.11k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 6.11k|#define NTRU_N 509 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 6.11k| } 55| 133k| for (i = 0; i < NTRU_CIPHERTEXTBYTES; i++) { ------------------ | | 35| 133k|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 31| 133k|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 133k|#define NTRU_LOGQ 11 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 133k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 133k|#define NTRU_N 509 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (55:17): [True: 133k, False: 191] ------------------ 56| 133k| buf[NTRU_PRFKEYBYTES + i] = c[i]; ------------------ | | 17| 133k|#define NTRU_PRFKEYBYTES 32 ------------------ 57| 133k| } 58| 191| sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 15| 191|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 17| 191|#define NTRU_PRFKEYBYTES 32 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 35| 191|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 31| 191|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 191|#define NTRU_LOGQ 11 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 191|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 191|#define NTRU_N 509 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 59| | 60| 191| PQCLEAN_NTRUHPS2048509_AVX2_cmov(k, rm, NTRU_SHAREDKEYBYTES, (unsigned char) fail); ------------------ | | 18| 191|#define NTRU_SHAREDKEYBYTES 32 ------------------ 61| | 62| 191| return 0; 63| 191|} PQCLEAN_NTRUHPS2048509_AVX2_owcpa_keypair: 62| 191| const unsigned char seed[NTRU_SAMPLE_FG_BYTES]) { 63| 191| int i; 64| | 65| 191| poly x1, x2, x3, x4, x5; 66| | 67| 191| poly *f = &x1, *g = &x2, *invf_mod3 = &x3; 68| 191| poly *gf = &x3, *invgf = &x4, *tmp = &x5; 69| 191| poly *invh = &x3, *h = &x3; 70| | 71| 191| PQCLEAN_NTRUHPS2048509_AVX2_sample_fg(f, g, seed); 72| | 73| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_inv(invf_mod3, f); 74| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_tobytes(sk, f); 75| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_tobytes(sk + NTRU_PACK_TRINARY_BYTES, invf_mod3); ------------------ | | 26| 191|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 191|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 191|#define NTRU_N 509 | | | | ------------------ | | ------------------ ------------------ 76| | 77| | /* Lift coeffs of f and g from Z_p to Z_q */ 78| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_Z3_to_Zq(f); 79| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_Z3_to_Zq(g); 80| | 81| | 82| | /* g = 3*g */ 83| 97.4k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 97.4k|#define NTRU_N 509 ------------------ | Branch (83:17): [True: 97.2k, False: 191] ------------------ 84| 97.2k| g->coeffs[i] = 3 * g->coeffs[i]; 85| 97.2k| } 86| | 87| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(gf, g, f); 88| | 89| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_inv(invgf, gf); 90| | 91| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(tmp, invgf, f); 92| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_mul(invh, tmp, f); 93| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_tobytes(sk + 2 * NTRU_PACK_TRINARY_BYTES, invh); ------------------ | | 26| 191|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 191|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 191|#define NTRU_N 509 | | | | ------------------ | | ------------------ ------------------ 94| | 95| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(tmp, invgf, g); 96| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(h, tmp, g); 97| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_sum_zero_tobytes(pk, h); 98| 191|} PQCLEAN_NTRUHPS2048509_AVX2_owcpa_enc: 104| 191| const unsigned char *pk) { 105| 191| int i; 106| 191| poly x1, x2; 107| 191| poly *h = &x1, *liftm = &x1; 108| 191| poly *ct = &x2; 109| | 110| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_sum_zero_frombytes(h, pk); 111| | 112| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(ct, r, h); 113| | 114| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_lift(liftm, m); 115| 97.4k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 97.4k|#define NTRU_N 509 ------------------ | Branch (115:17): [True: 97.2k, False: 191] ------------------ 116| 97.2k| ct->coeffs[i] = ct->coeffs[i] + liftm->coeffs[i]; 117| 97.2k| } 118| | 119| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_sum_zero_tobytes(c, ct); 120| 191|} PQCLEAN_NTRUHPS2048509_AVX2_owcpa_dec: 124| 191| const unsigned char *secretkey) { 125| 191| int i; 126| 191| int fail; 127| 191| poly x1, x2, x3, x4; 128| | 129| 191| poly *c = &x1, *f = &x2, *cf = &x3; 130| 191| poly *mf = &x2, *finv3 = &x3, *m = &x4; 131| 191| poly *liftm = &x2, *invh = &x3, *r = &x4; 132| 191| poly *b = &x1; 133| | 134| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_sum_zero_frombytes(c, ciphertext); 135| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_frombytes(f, secretkey); 136| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_Z3_to_Zq(f); 137| | 138| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(cf, c, f); 139| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_to_S3(mf, cf); 140| | 141| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_frombytes(finv3, secretkey + NTRU_PACK_TRINARY_BYTES); ------------------ | | 26| 191|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 191|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 191|#define NTRU_N 509 | | | | ------------------ | | ------------------ ------------------ 142| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_mul(m, mf, finv3); 143| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, m); ------------------ | | 26| 191|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 191|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 191|#define NTRU_N 509 | | | | ------------------ | | ------------------ ------------------ 144| | 145| 191| fail = 0; 146| | 147| | /* Check that the unused bits of the last byte of the ciphertext are zero */ 148| 191| fail |= owcpa_check_ciphertext(ciphertext); 149| | 150| | /* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */ 151| | /* We can avoid re-computing r*h + Lift(m) as long as we check that */ 152| | /* r (defined as b/h mod (q, Phi_n)) and m are in the message space. */ 153| | /* (m can take any value in S3 in NTRU_HRSS) */ 154| 191| fail |= owcpa_check_m(m); 155| | 156| | /* b = c - Lift(m) mod (q, x^n - 1) */ 157| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_lift(liftm, m); 158| 97.4k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 97.4k|#define NTRU_N 509 ------------------ | Branch (158:17): [True: 97.2k, False: 191] ------------------ 159| 97.2k| b->coeffs[i] = c->coeffs[i] - liftm->coeffs[i]; 160| 97.2k| } 161| | 162| | /* r = b / h mod (q, Phi_n) */ 163| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_frombytes(invh, secretkey + 2 * NTRU_PACK_TRINARY_BYTES); ------------------ | | 26| 191|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 191|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 191|#define NTRU_N 509 | | | | ------------------ | | ------------------ ------------------ 164| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_mul(r, b, invh); 165| | 166| | /* NOTE: Our definition of r as b/h mod (q, Phi_n) follows Figure 4 of */ 167| | /* [Sch18] https://eprint.iacr.org/2018/1174/20181203:032458. */ 168| | /* This differs from Figure 10 of Saito--Xagawa--Yamakawa */ 169| | /* [SXY17] https://eprint.iacr.org/2017/1005/20180516:055500 */ 170| | /* where r gets a final reduction modulo p. */ 171| | /* We need this change to use Proposition 1 of [Sch18]. */ 172| | 173| | /* Proposition 1 of [Sch18] shows that re-encryption with (r,m) yields c. */ 174| | /* if and only if fail==0 after the following call to owcpa_check_r */ 175| | /* The procedure given in Fig. 8 of [Sch18] can be skipped because we have */ 176| | /* c(1) = 0 due to the use of poly_Rq_sum_zero_{to,from}bytes. */ 177| 191| fail |= owcpa_check_r(r); 178| | 179| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_trinary_Zq_to_Z3(r); 180| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_tobytes(rm, r); 181| | 182| 191| return fail; 183| 191|} PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_tobytes: 3| 1.14k|void PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_tobytes(unsigned char msg[NTRU_PACK_TRINARY_BYTES], const poly *a) { 4| 1.14k| int i; 5| 1.14k| unsigned char c; 6| 1.14k| int j; 7| | 8| 116k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 25| 116k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 116k|#define NTRU_N 509 | | ------------------ ------------------ | Branch (8:17): [True: 115k, False: 1.14k] ------------------ 9| 115k| c = a->coeffs[5 * i + 4] & 255; 10| 115k| c = (3 * c + a->coeffs[5 * i + 3]) & 255; 11| 115k| c = (3 * c + a->coeffs[5 * i + 2]) & 255; 12| 115k| c = (3 * c + a->coeffs[5 * i + 1]) & 255; 13| 115k| c = (3 * c + a->coeffs[5 * i + 0]) & 255; 14| 115k| msg[i] = c; 15| 115k| } 16| 1.14k| i = NTRU_PACK_DEG / 5; ------------------ | | 25| 1.14k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 1.14k|#define NTRU_N 509 | | ------------------ ------------------ 17| 1.14k| c = 0; 18| 4.58k| for (j = NTRU_PACK_DEG - (5 * i) - 1; j >= 0; j--) { ------------------ | | 25| 1.14k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 1.14k|#define NTRU_N 509 | | ------------------ ------------------ | Branch (18:43): [True: 3.43k, False: 1.14k] ------------------ 19| 3.43k| c = (3 * c + a->coeffs[5 * i + j]) & 255; 20| 3.43k| } 21| 1.14k| msg[i] = c; 22| 1.14k|} PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_frombytes: 24| 382|void PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_frombytes(poly *r, const unsigned char msg[NTRU_PACK_TRINARY_BYTES]) { 25| 382| int i; 26| 382| unsigned char c; 27| 382| int j; 28| | 29| 38.9k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 25| 38.9k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 38.9k|#define NTRU_N 509 | | ------------------ ------------------ | Branch (29:17): [True: 38.5k, False: 382] ------------------ 30| 38.5k| c = msg[i]; 31| 38.5k| r->coeffs[5 * i + 0] = c; 32| 38.5k| r->coeffs[5 * i + 1] = c * 171 >> 9; // this is division by 3 33| 38.5k| r->coeffs[5 * i + 2] = c * 57 >> 9; // division by 3^2 34| 38.5k| r->coeffs[5 * i + 3] = c * 19 >> 9; // division by 3^3 35| 38.5k| r->coeffs[5 * i + 4] = c * 203 >> 14; // etc. 36| 38.5k| } 37| 382| i = NTRU_PACK_DEG / 5; ------------------ | | 25| 382|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 382|#define NTRU_N 509 | | ------------------ ------------------ 38| 382| c = msg[i]; 39| 1.52k| for (j = 0; (5 * i + j) < NTRU_PACK_DEG; j++) { ------------------ | | 25| 1.52k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 1.52k|#define NTRU_N 509 | | ------------------ ------------------ | Branch (39:17): [True: 1.14k, False: 382] ------------------ 40| 1.14k| r->coeffs[5 * i + j] = c; 41| 1.14k| c = c * 171 >> 9; 42| 1.14k| } 43| 382| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 382|#define NTRU_N 509 ------------------ 44| 382| PQCLEAN_NTRUHPS2048509_AVX2_poly_mod_3_Phi_n(r); 45| 382|} PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_tobytes: 3| 573|void PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_tobytes(unsigned char *r, const poly *a) { 4| 573| int i, j; 5| 573| uint16_t t[8]; 6| | 7| 36.6k| for (i = 0; i < NTRU_PACK_DEG / 8; i++) { ------------------ | | 25| 36.6k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 36.6k|#define NTRU_N 509 | | ------------------ ------------------ | Branch (7:17): [True: 36.0k, False: 573] ------------------ 8| 324k| for (j = 0; j < 8; j++) { ------------------ | Branch (8:21): [True: 288k, False: 36.0k] ------------------ 9| 288k| t[j] = MODQ(a->coeffs[8 * i + j]); ------------------ | | 9| 288k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 288k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 288k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ 10| 288k| } 11| | 12| 36.0k| r[11 * i + 0] = (unsigned char) ( t[0] & 0xff); 13| 36.0k| r[11 * i + 1] = (unsigned char) ((t[0] >> 8) | ((t[1] & 0x1f) << 3)); 14| 36.0k| r[11 * i + 2] = (unsigned char) ((t[1] >> 5) | ((t[2] & 0x03) << 6)); 15| 36.0k| r[11 * i + 3] = (unsigned char) ((t[2] >> 2) & 0xff); 16| 36.0k| r[11 * i + 4] = (unsigned char) ((t[2] >> 10) | ((t[3] & 0x7f) << 1)); 17| 36.0k| r[11 * i + 5] = (unsigned char) ((t[3] >> 7) | ((t[4] & 0x0f) << 4)); 18| 36.0k| r[11 * i + 6] = (unsigned char) ((t[4] >> 4) | ((t[5] & 0x01) << 7)); 19| 36.0k| r[11 * i + 7] = (unsigned char) ((t[5] >> 1) & 0xff); 20| 36.0k| r[11 * i + 8] = (unsigned char) ((t[5] >> 9) | ((t[6] & 0x3f) << 2)); 21| 36.0k| r[11 * i + 9] = (unsigned char) ((t[6] >> 6) | ((t[7] & 0x07) << 5)); 22| 36.0k| r[11 * i + 10] = (unsigned char) ((t[7] >> 3)); 23| 36.0k| } 24| | 25| 2.86k| for (j = 0; j < NTRU_PACK_DEG - 8 * i; j++) { ------------------ | | 25| 2.86k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 2.86k|#define NTRU_N 509 | | ------------------ ------------------ | Branch (25:17): [True: 2.29k, False: 573] ------------------ 26| 2.29k| t[j] = MODQ(a->coeffs[8 * i + j]); ------------------ | | 9| 2.29k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 2.29k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 2.29k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ 27| 2.29k| } 28| 2.86k| for (; j < 8; j++) { ------------------ | Branch (28:12): [True: 2.29k, False: 573] ------------------ 29| 2.29k| t[j] = 0; 30| 2.29k| } 31| | 32| 573| switch (NTRU_PACK_DEG & 0x07) { ------------------ | | 25| 573|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 573|#define NTRU_N 509 | | ------------------ ------------------ | Branch (32:13): [True: 573, Folded] ------------------ 33| | // cases 0 and 6 are impossible since 2 generates (Z/n)* and 34| | // p mod 8 in {1, 7} implies that 2 is a quadratic residue. 35| 573| case 4: ------------------ | Branch (35:5): [True: 573, False: 0] ------------------ 36| 573| r[11 * i + 0] = (unsigned char) (t[0] & 0xff); 37| 573| r[11 * i + 1] = (unsigned char) (t[0] >> 8) | ((t[1] & 0x1f) << 3); 38| 573| r[11 * i + 2] = (unsigned char) (t[1] >> 5) | ((t[2] & 0x03) << 6); 39| 573| r[11 * i + 3] = (unsigned char) (t[2] >> 2) & 0xff; 40| 573| r[11 * i + 4] = (unsigned char) (t[2] >> 10) | ((t[3] & 0x7f) << 1); 41| 573| r[11 * i + 5] = (unsigned char) (t[3] >> 7) | ((t[4] & 0x0f) << 4); 42| 573| break; 43| 0| case 2: ------------------ | Branch (43:5): [True: 0, False: 573] ------------------ 44| 0| r[11 * i + 0] = (unsigned char) (t[0] & 0xff); 45| 0| r[11 * i + 1] = (unsigned char) (t[0] >> 8) | ((t[1] & 0x1f) << 3); 46| 0| r[11 * i + 2] = (unsigned char) (t[1] >> 5) | ((t[2] & 0x03) << 6); 47| 0| break; 48| 573| } 49| 573|} PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_frombytes: 51| 573|void PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_frombytes(poly *r, const unsigned char *a) { 52| 573| int i; 53| 36.6k| for (i = 0; i < NTRU_PACK_DEG / 8; i++) { ------------------ | | 25| 36.6k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 36.6k|#define NTRU_N 509 | | ------------------ ------------------ | Branch (53:17): [True: 36.0k, False: 573] ------------------ 54| 36.0k| r->coeffs[8 * i + 0] = (a[11 * i + 0] >> 0) | (((uint16_t)a[11 * i + 1] & 0x07) << 8); 55| 36.0k| r->coeffs[8 * i + 1] = (a[11 * i + 1] >> 3) | (((uint16_t)a[11 * i + 2] & 0x3f) << 5); 56| 36.0k| r->coeffs[8 * i + 2] = (a[11 * i + 2] >> 6) | (((uint16_t)a[11 * i + 3] & 0xff) << 2) | (((uint16_t)a[11 * i + 4] & 0x01) << 10); 57| 36.0k| r->coeffs[8 * i + 3] = (a[11 * i + 4] >> 1) | (((uint16_t)a[11 * i + 5] & 0x0f) << 7); 58| 36.0k| r->coeffs[8 * i + 4] = (a[11 * i + 5] >> 4) | (((uint16_t)a[11 * i + 6] & 0x7f) << 4); 59| 36.0k| r->coeffs[8 * i + 5] = (a[11 * i + 6] >> 7) | (((uint16_t)a[11 * i + 7] & 0xff) << 1) | (((uint16_t)a[11 * i + 8] & 0x03) << 9); 60| 36.0k| r->coeffs[8 * i + 6] = (a[11 * i + 8] >> 2) | (((uint16_t)a[11 * i + 9] & 0x1f) << 6); 61| 36.0k| r->coeffs[8 * i + 7] = (a[11 * i + 9] >> 5) | (((uint16_t)a[11 * i + 10] & 0xff) << 3); 62| 36.0k| } 63| 573| switch (NTRU_PACK_DEG & 0x07) { ------------------ | | 25| 573|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 573|#define NTRU_N 509 | | ------------------ ------------------ | Branch (63:13): [True: 573, Folded] ------------------ 64| | // cases 0 and 6 are impossible since 2 generates (Z/n)* and 65| | // p mod 8 in {1, 7} implies that 2 is a quadratic residue. 66| 573| case 4: ------------------ | Branch (66:5): [True: 573, False: 0] ------------------ 67| 573| r->coeffs[8 * i + 0] = (a[11 * i + 0] >> 0) | (((uint16_t)a[11 * i + 1] & 0x07) << 8); 68| 573| r->coeffs[8 * i + 1] = (a[11 * i + 1] >> 3) | (((uint16_t)a[11 * i + 2] & 0x3f) << 5); 69| 573| r->coeffs[8 * i + 2] = (a[11 * i + 2] >> 6) | (((uint16_t)a[11 * i + 3] & 0xff) << 2) | (((uint16_t)a[11 * i + 4] & 0x01) << 10); 70| 573| r->coeffs[8 * i + 3] = (a[11 * i + 4] >> 1) | (((uint16_t)a[11 * i + 5] & 0x0f) << 7); 71| 573| break; 72| 0| case 2: ------------------ | Branch (72:5): [True: 0, False: 573] ------------------ 73| 0| r->coeffs[8 * i + 0] = (a[11 * i + 0] >> 0) | (((uint16_t)a[11 * i + 1] & 0x07) << 8); 74| 0| r->coeffs[8 * i + 1] = (a[11 * i + 1] >> 3) | (((uint16_t)a[11 * i + 2] & 0x3f) << 5); 75| 0| break; 76| 573| } 77| 573| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 573|#define NTRU_N 509 ------------------ 78| 573|} PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_sum_zero_tobytes: 80| 382|void PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_sum_zero_tobytes(unsigned char *r, const poly *a) { 81| 382| PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_tobytes(r, a); 82| 382|} PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_sum_zero_frombytes: 84| 382|void PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_sum_zero_frombytes(poly *r, const unsigned char *a) { 85| 382| int i; 86| 382| PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_frombytes(r, a); 87| | 88| | /* Set r[n-1] so that the sum of coefficients is zero mod q */ 89| 382| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 382|#define NTRU_N 509 ------------------ 90| 194k| for (i = 0; i < NTRU_PACK_DEG; i++) { ------------------ | | 25| 194k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 194k|#define NTRU_N 509 | | ------------------ ------------------ | Branch (90:17): [True: 194k, False: 382] ------------------ 91| 194k| r->coeffs[NTRU_N - 1] -= r->coeffs[i]; ------------------ | | 5| 194k|#define NTRU_N 509 ------------------ 92| 194k| } 93| 382|} PQCLEAN_NTRUHPS2048509_AVX2_poly_Z3_to_Zq: 4| 1.14k|void PQCLEAN_NTRUHPS2048509_AVX2_poly_Z3_to_Zq(poly *r) { 5| 1.14k| int i; 6| 584k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 584k|#define NTRU_N 509 ------------------ | Branch (6:17): [True: 583k, False: 1.14k] ------------------ 7| 583k| r->coeffs[i] = r->coeffs[i] | ((-(r->coeffs[i] >> 1)) & (NTRU_Q - 1)); ------------------ | | 13| 583k|#define NTRU_Q (1 << NTRU_LOGQ) | | ------------------ | | | | 6| 583k|#define NTRU_LOGQ 11 | | ------------------ ------------------ 8| 583k| } 9| 1.14k|} PQCLEAN_NTRUHPS2048509_AVX2_poly_trinary_Zq_to_Z3: 12| 191|void PQCLEAN_NTRUHPS2048509_AVX2_poly_trinary_Zq_to_Z3(poly *r) { 13| 191| int i; 14| 97.4k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 97.4k|#define NTRU_N 509 ------------------ | Branch (14:17): [True: 97.2k, False: 191] ------------------ 15| 97.2k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 97.2k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 97.2k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 97.2k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ 16| 97.2k| r->coeffs[i] = 3 & (r->coeffs[i] ^ (r->coeffs[i] >> (NTRU_LOGQ - 1))); ------------------ | | 6| 97.2k|#define NTRU_LOGQ 11 ------------------ 17| 97.2k| } 18| 191|} PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_mul: 20| 382|void PQCLEAN_NTRUHPS2048509_AVX2_poly_Sq_mul(poly *r, const poly *a, const poly *b) { 21| 382| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(r, a, b); 22| 382| PQCLEAN_NTRUHPS2048509_AVX2_poly_mod_q_Phi_n(r); 23| 382|} PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_mul: 25| 191|void PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_mul(poly *r, const poly *a, const poly *b) { 26| 191| int i; 27| | 28| | /* Our S3 multiplications do not overflow mod q, */ 29| | /* so we can re-purpose PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul, as long as we */ 30| | /* follow with an explicit reduction mod q. */ 31| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(r, a, b); 32| 97.4k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 97.4k|#define NTRU_N 509 ------------------ | Branch (32:17): [True: 97.2k, False: 191] ------------------ 33| 97.2k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 97.2k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 97.2k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 97.2k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ 34| 97.2k| } 35| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_mod_3_Phi_n(r); 36| 191|} PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_inv: 71| 191|void PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_inv(poly *r, const poly *a) { 72| 191| poly ai2; 73| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_inv(&ai2, a); 74| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_inv_to_Rq_inv(r, &ai2, a); 75| 191|} poly.c:PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_inv_to_Rq_inv: 38| 191|static void PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_inv_to_Rq_inv(poly *r, const poly *ai, const poly *a) { 39| | 40| 191| int i; 41| 191| poly b, c; 42| 191| poly s; 43| | 44| | // for 0..4 45| | // ai = ai * (2 - a*ai) mod q 46| 97.4k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 97.4k|#define NTRU_N 509 ------------------ | Branch (46:17): [True: 97.2k, False: 191] ------------------ 47| 97.2k| b.coeffs[i] = -(a->coeffs[i]); 48| 97.2k| } 49| | 50| 97.4k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 97.4k|#define NTRU_N 509 ------------------ | Branch (50:17): [True: 97.2k, False: 191] ------------------ 51| 97.2k| r->coeffs[i] = ai->coeffs[i]; 52| 97.2k| } 53| | 54| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(&c, r, &b); 55| 191| c.coeffs[0] += 2; // c = 2 - a*ai 56| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(&s, &c, r); // s = ai*c 57| | 58| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(&c, &s, &b); 59| 191| c.coeffs[0] += 2; // c = 2 - a*s 60| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(r, &c, &s); // r = s*c 61| | 62| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(&c, r, &b); 63| 191| c.coeffs[0] += 2; // c = 2 - a*r 64| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(&s, &c, r); // s = r*c 65| | 66| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(&c, &s, &b); 67| 191| c.coeffs[0] += 2; // c = 2 - a*s 68| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_Rq_mul(r, &c, &s); // r = s*c 69| 191|} PQCLEAN_NTRUHPS2048509_AVX2_poly_lift: 3| 382|void PQCLEAN_NTRUHPS2048509_AVX2_poly_lift(poly *r, const poly *a) { 4| 382| int i; 5| 194k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 194k|#define NTRU_N 509 ------------------ | Branch (5:17): [True: 194k, False: 382] ------------------ 6| 194k| r->coeffs[i] = a->coeffs[i]; 7| 194k| } 8| 382| PQCLEAN_NTRUHPS2048509_AVX2_poly_Z3_to_Zq(r); 9| 382|} PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_tobytes: 11| 191|void PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_tobytes(unsigned char *out, const poly *a) { 12| | // Since pext works on a uint64_t we view the coefficient pointer as a 64-bit pointer 13| | // so that we can extract 4 coefficient at a time. It also makes arithmetic a little easier. 14| 191| uint64_t *coeff_pointer = (void *) a->coeffs; 15| | 16| 191| int i; 17| 12.2k| for (i = 0; i < 63; i++) { ------------------ | Branch (17:17): [True: 12.0k, False: 191] ------------------ 18| 12.0k| out[i] = _pext_u64(coeff_pointer[2 * i], 0x1000100010001); 19| 12.0k| out[i] |= _pext_u64(coeff_pointer[2 * i + 1], 0x1000100010001) << 4; 20| 12.0k| } 21| 191| out[i] = _pext_u64(coeff_pointer[2 * 63], 0x1000100010001); 22| 191| out[i] |= _pext_u64(coeff_pointer[2 * 63 + 1], 0x1) << 4; 23| 191|} PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_frombytes: 25| 191|void PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_frombytes(poly *a, const unsigned char *in) { 26| | // Since pdep results in a uint64_t we view the coefficient pointer as a 64-bit pointer 27| | // so that we can store 4 coefficient at a time. It also makes arithmetic a little easier. 28| 191| uint64_t *coeff_pointer = (void *) a->coeffs; 29| | 30| 191| int i; 31| 12.2k| for (i = 0; i < 63; i++) { ------------------ | Branch (31:17): [True: 12.0k, False: 191] ------------------ 32| 12.0k| coeff_pointer[2 * i] = _pdep_u64(in[i], 0x1000100010001); 33| 12.0k| coeff_pointer[2 * i + 1] = _pdep_u64(in[i] >> 4, 0x1000100010001); 34| 12.0k| } 35| | // From the last byte we only want 5 bits (since we have 509 total, not 512). 36| 191| coeff_pointer[2 * 63] = _pdep_u64(in[i], 0x1000100010001); 37| 191| coeff_pointer[2 * 63 + 1] = _pdep_u64(in[i] >> 4, 0x1); 38| 191|} PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_inv: 40| 191|void PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_inv(poly *r, const poly *a) { 41| 191| union { 42| 191| unsigned char s[64]; 43| 191| __m256i s_x32[2]; 44| 191| } squares[13]; 45| 191|#define s(x) squares[(x)].s 46| | 47| | // This relies on the following addition chain: 48| | // 1, 2, 3, 6, 12, 15, 30, 60, 63, 126, 252, 504, 507 49| | 50| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_tobytes(s(0), a); // TODO alignment ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ 51| | 52| 191| PQCLEAN_NTRUHPS2048509_AVX2_square_1_509(s(1), s(0)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_1_509(s(1), s(0)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ 53| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ 54| 191| PQCLEAN_NTRUHPS2048509_AVX2_square_1_509(s(2), s(1)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_1_509(s(2), s(1)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ 55| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ 56| 191| PQCLEAN_NTRUHPS2048509_AVX2_square_3_509(s(3), s(2)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_3_509(s(3), s(2)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ 57| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(3), s(3), s(2)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(3), s(3), s(2)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(3), s(3), s(2)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ 58| 191| PQCLEAN_NTRUHPS2048509_AVX2_square_6_509(s(4), s(3)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_6_509(s(4), s(3)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ 59| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ 60| 191| PQCLEAN_NTRUHPS2048509_AVX2_square_3_509(s(5), s(4)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_3_509(s(5), s(4)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ 61| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(5), s(5), s(2)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(5), s(5), s(2)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(5), s(5), s(2)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ 62| 191| PQCLEAN_NTRUHPS2048509_AVX2_square_15_509(s(6), s(5)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_15_509(s(6), s(5)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ 63| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(6), s(6), s(5)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(6), s(6), s(5)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(6), s(6), s(5)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ 64| 191| PQCLEAN_NTRUHPS2048509_AVX2_square_30_509(s(7), s(6)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_30_509(s(7), s(6)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ 65| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(7), s(7), s(6)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(7), s(7), s(6)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(7), s(7), s(6)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ 66| 191| PQCLEAN_NTRUHPS2048509_AVX2_square_3_509(s(8), s(7)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_3_509(s(8), s(7)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ 67| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(8), s(8), s(2)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(8), s(8), s(2)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(8), s(8), s(2)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ 68| 191| PQCLEAN_NTRUHPS2048509_AVX2_square_63_509(s(9), s(8)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_63_509(s(9), s(8)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ 69| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ 70| 191| PQCLEAN_NTRUHPS2048509_AVX2_square_126_509(s(10), s(9)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_126_509(s(10), s(9)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ 71| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ 72| 191| PQCLEAN_NTRUHPS2048509_AVX2_square_252_509(s(11), s(10)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_252_509(s(11), s(10)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ 73| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ 74| 191| PQCLEAN_NTRUHPS2048509_AVX2_square_3_509(s(12), s(11)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_3_509(s(12), s(11)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ 75| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(12), s(12), s(2)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(12), s(12), s(2)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_mul(s(12), s(12), s(2)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ 76| 191| PQCLEAN_NTRUHPS2048509_AVX2_square_1_509(s(0), s(12)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048509_AVX2_square_1_509(s(0), s(12)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ 77| | 78| 191| PQCLEAN_NTRUHPS2048509_AVX2_poly_R2_frombytes(r, s(0)); ------------------ | | 45| 191|#define s(x) squares[(x)].s ------------------ 79| 191|#undef s 80| 191|} PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_inv: 439| 191|void PQCLEAN_NTRUHPS2048509_AVX2_poly_S3_inv(poly *r_out, const poly *a) { 440| 191| const unsigned char *in = (void *) a; 441| 191| unsigned char *out = (void *) r_out; 442| | 443| 191| small input[ppad]; 444| 191| small output[ppad]; 445| 191| int i; 446| | 447| | /* XXX: obviously input/output format should be packed into bytes */ 448| | 449| 97.2k| for (i = 0; i < p; ++i) { ------------------ | | 7| 97.2k|#define p 508 ------------------ | Branch (449:17): [True: 97.0k, False: 191] ------------------ 450| 97.0k| small x = in[2 * i] & 3; /* 0 1 2 3 */ 451| 97.0k| x += 1; /* 0 1 2 3 4 5 6, offset by 1 */ 452| 97.0k| x &= (x - 3) >> 5; /* 0 1 2, offset by 1 */ 453| 97.0k| input[i] = x - 1; 454| 97.0k| } 455| | /* XXX: merge with vec256_init */ 456| | 457| 191| __poly_S3_inv((unsigned char *)output, (unsigned char *)input); 458| | 459| 97.2k| for (i = 0; i < p; ++i) { ------------------ | | 7| 97.2k|#define p 508 ------------------ | Branch (459:17): [True: 97.0k, False: 191] ------------------ 460| 97.0k| out[2 * i] = (3 & output[i]) ^ ((3 & output[i]) >> 1); 461| 97.0k| out[2 * i + 1] = 0; 462| 97.0k| } 463| 191|} poly_s3_inv.c:__poly_S3_inv: 310| 191|static int __poly_S3_inv(unsigned char *outbytes, const unsigned char *inbytes) { 311| 191| small *out = (void *) outbytes; 312| 191| small *in = (void *) inbytes; 313| 191| vec256 F0[numvec]; 314| 191| vec256 F1[numvec]; 315| 191| vec256 G0[numvec]; 316| 191| vec256 G1[numvec]; 317| 191| vec256 V0[numvec]; 318| 191| vec256 V1[numvec]; 319| 191| vec256 R0[numvec]; 320| 191| vec256 R1[numvec]; 321| 191| vec256 c0vec, c1vec; 322| 191| int loop; 323| 191| int c0, c1; 324| 191| int minusdelta = -1; 325| 191| int swapmask; 326| 191| vec256 swapvec; 327| | 328| 191| vec256_init(G0, G1, in); 329| 191| F0[0] = _mm256_set_epi32(-1, -1, -1, -1, -1, -1, -1, -1); 330| 191| F0[1] = _mm256_set_epi32(2147483647, -1, 2147483647, -1, 2147483647, -1, -1, -1); 331| 191| F1[0] = _mm256_set1_epi32(0); 332| 191| F1[1] = _mm256_set1_epi32(0); 333| | 334| 191| V0[0] = _mm256_set1_epi32(0); 335| 191| V1[0] = _mm256_set1_epi32(0); 336| 191| V0[1] = _mm256_set1_epi32(0); 337| 191| V1[1] = _mm256_set1_epi32(0); 338| | 339| 191| R0[0] = _mm256_set_epi32(0, 0, 0, 0, 0, 0, 0, 1); 340| 191| R1[0] = _mm256_set1_epi32(0); 341| 191| R0[1] = _mm256_set1_epi32(0); 342| 191| R1[1] = _mm256_set1_epi32(0); 343| | 344| 49.0k| for (loop = 256; loop > 0; --loop) { ------------------ | Branch (344:22): [True: 48.8k, False: 191] ------------------ 345| 48.8k| vec256_timesx_1(V0); 346| 48.8k| vec256_timesx_1(V1); 347| 48.8k| swapmask = negative_mask(minusdelta) & vec256_bit0mask(G0); 348| | 349| 48.8k| c0 = vec256_bit0mask(F0) & vec256_bit0mask(G0); 350| 48.8k| c1 = vec256_bit0mask(F1) ^ vec256_bit0mask(G1); 351| 48.8k| c1 &= c0; 352| | 353| 48.8k| minusdelta ^= swapmask & (minusdelta ^ -minusdelta); 354| 48.8k| minusdelta -= 1; 355| | 356| 48.8k| swapvec = _mm256_set1_epi32(swapmask); 357| 48.8k| vec256_swap(F0, G0, 2, swapvec); 358| 48.8k| vec256_swap(F1, G1, 2, swapvec); 359| | 360| 48.8k| c0vec = _mm256_set1_epi32(c0); 361| 48.8k| c1vec = _mm256_set1_epi32(c1); 362| | 363| 48.8k| vec256_eliminate(F0, F1, G0, G1, 2, c0vec, c1vec); 364| 48.8k| vec256_divx_2(G0); 365| 48.8k| vec256_divx_2(G1); 366| | 367| 48.8k| vec256_swap(V0, R0, 1, swapvec); 368| 48.8k| vec256_swap(V1, R1, 1, swapvec); 369| 48.8k| vec256_eliminate(V0, V1, R0, R1, 1, c0vec, c1vec); 370| 48.8k| } 371| | 372| 96.2k| for (loop = 503; loop > 0; --loop) { ------------------ | Branch (372:22): [True: 96.0k, False: 191] ------------------ 373| 96.0k| vec256_timesx_2(V0); 374| 96.0k| vec256_timesx_2(V1); 375| 96.0k| swapmask = negative_mask(minusdelta) & vec256_bit0mask(G0); 376| | 377| 96.0k| c0 = vec256_bit0mask(F0) & vec256_bit0mask(G0); 378| 96.0k| c1 = vec256_bit0mask(F1) ^ vec256_bit0mask(G1); 379| 96.0k| c1 &= c0; 380| | 381| 96.0k| minusdelta ^= swapmask & (minusdelta ^ -minusdelta); 382| 96.0k| minusdelta -= 1; 383| | 384| 96.0k| swapvec = _mm256_set1_epi32(swapmask); 385| 96.0k| vec256_swap(F0, G0, 2, swapvec); 386| 96.0k| vec256_swap(F1, G1, 2, swapvec); 387| | 388| 96.0k| c0vec = _mm256_set1_epi32(c0); 389| 96.0k| c1vec = _mm256_set1_epi32(c1); 390| | 391| 96.0k| vec256_eliminate(F0, F1, G0, G1, 2, c0vec, c1vec); 392| 96.0k| vec256_divx_2(G0); 393| 96.0k| vec256_divx_2(G1); 394| | 395| 96.0k| vec256_swap(V0, R0, 2, swapvec); 396| 96.0k| vec256_swap(V1, R1, 2, swapvec); 397| 96.0k| vec256_eliminate(V0, V1, R0, R1, 2, c0vec, c1vec); 398| 96.0k| } 399| | 400| 49.0k| for (loop = 256; loop > 0; --loop) { ------------------ | Branch (400:22): [True: 48.8k, False: 191] ------------------ 401| 48.8k| vec256_timesx_2(V0); 402| 48.8k| vec256_timesx_2(V1); 403| 48.8k| swapmask = negative_mask(minusdelta) & vec256_bit0mask(G0); 404| | 405| 48.8k| c0 = vec256_bit0mask(F0) & vec256_bit0mask(G0); 406| 48.8k| c1 = vec256_bit0mask(F1) ^ vec256_bit0mask(G1); 407| 48.8k| c1 &= c0; 408| | 409| 48.8k| minusdelta ^= swapmask & (minusdelta ^ -minusdelta); 410| 48.8k| minusdelta -= 1; 411| | 412| 48.8k| swapvec = _mm256_set1_epi32(swapmask); 413| 48.8k| vec256_swap(F0, G0, 1, swapvec); 414| 48.8k| vec256_swap(F1, G1, 1, swapvec); 415| | 416| 48.8k| c0vec = _mm256_set1_epi32(c0); 417| 48.8k| c1vec = _mm256_set1_epi32(c1); 418| | 419| 48.8k| vec256_eliminate(F0, F1, G0, G1, 1, c0vec, c1vec); 420| 48.8k| vec256_divx_1(G0); 421| 48.8k| vec256_divx_1(G1); 422| | 423| 48.8k| vec256_swap(V0, R0, 2, swapvec); 424| 48.8k| vec256_swap(V1, R1, 2, swapvec); 425| 48.8k| vec256_eliminate(V0, V1, R0, R1, 2, c0vec, c1vec); 426| 48.8k| } 427| | 428| 191| c0vec = _mm256_set1_epi32(vec256_bit0mask(F0)); 429| 191| c1vec = _mm256_set1_epi32(vec256_bit0mask(F1)); 430| 191| vec256_scale(V0, V1, c0vec, c1vec); 431| | 432| 191| vec256_final(out, V0, V1); 433| 191| out[p] = negative_mask(minusdelta); ------------------ | | 7| 191|#define p 508 ------------------ 434| 191| return 0; 435| 191|} poly_s3_inv.c:vec256_init: 143| 313|static void vec256_init(vec256 *G0, vec256 *G1, const small *s) { 144| 313| int i; 145| 313| small srev[ppad + (ppad - p)]; 146| 313| small si; 147| 313| small g0[ppad]; 148| 313| small g1[ppad]; 149| | 150| 193k| for (i = 0; i < p; ++i) { ------------------ | | 7| 193k|#define p 508 ------------------ | Branch (150:17): [True: 193k, False: 313] ------------------ 151| 193k| srev[ppad - 1 - i] = s[i]; ------------------ | | 8| 193k|#define ppad 512 ------------------ 152| 193k| } 153| 22.7k| for (i = 0; i < ppad - p; ++i) { ------------------ | | 8| 22.7k|#define ppad 512 ------------------ for (i = 0; i < ppad - p; ++i) { ------------------ | | 7| 22.7k|#define p 508 ------------------ | Branch (153:17): [True: 22.4k, False: 313] ------------------ 154| 22.4k| srev[i] = 0; 155| 22.4k| } 156| 22.7k| for (i = p; i < ppad; ++i) { ------------------ | | 7| 313|#define p 508 ------------------ for (i = p; i < ppad; ++i) { ------------------ | | 8| 22.7k|#define ppad 512 ------------------ | Branch (156:17): [True: 22.4k, False: 313] ------------------ 157| 22.4k| srev[i + ppad - p] = 0; ------------------ | | 8| 22.4k|#define ppad 512 ------------------ srev[i + ppad - p] = 0; ------------------ | | 7| 22.4k|#define p 508 ------------------ 158| 22.4k| } 159| | 160| 216k| for (i = 0; i < ppad; ++i) { ------------------ | | 8| 216k|#define ppad 512 ------------------ | Branch (160:17): [True: 215k, False: 313] ------------------ 161| 215k| si = srev[i + ppad - p]; ------------------ | | 8| 215k|#define ppad 512 ------------------ si = srev[i + ppad - p]; ------------------ | | 7| 215k|#define p 508 ------------------ 162| 215k| g0[i] = si & 1; 163| 215k| g1[i] = (si >> 1) & g0[i]; 164| 215k| } 165| | 166| 313| vec256_frombits(G0, g0); 167| 313| vec256_frombits(G1, g1); 168| 313|} poly_s3_inv.c:vec256_frombits: 23| 626|static inline void vec256_frombits(vec256 *v, const small *b) { 24| 626| int i; 25| | 26| 2.31k| for (i = 0; i < numvec; ++i) { ------------------ | | 9| 2.31k|#define numvec 2 ------------------ | Branch (26:17): [True: 1.68k, False: 626] ------------------ 27| 1.68k| vec256 b0 = _mm256_loadu_si256((vec256 *) b); 28| 1.68k| b += 32; /* 0,1,...,31 */ 29| 1.68k| vec256 b1 = _mm256_loadu_si256((vec256 *) b); 30| 1.68k| b += 32; /* 32,33,... */ 31| 1.68k| vec256 b2 = _mm256_loadu_si256((vec256 *) b); 32| 1.68k| b += 32; 33| 1.68k| vec256 b3 = _mm256_loadu_si256((vec256 *) b); 34| 1.68k| b += 32; 35| 1.68k| vec256 b4 = _mm256_loadu_si256((vec256 *) b); 36| 1.68k| b += 32; 37| 1.68k| vec256 b5 = _mm256_loadu_si256((vec256 *) b); 38| 1.68k| b += 32; 39| 1.68k| vec256 b6 = _mm256_loadu_si256((vec256 *) b); 40| 1.68k| b += 32; 41| 1.68k| vec256 b7 = _mm256_loadu_si256((vec256 *) b); 42| 1.68k| b += 32; 43| | 44| 1.68k| vec256 c0 = _mm256_unpacklo_epi32(b0, b1); /* 0 1 2 3 32 33 34 35 4 5 6 7 36 37 38 39 ... 55 */ 45| 1.68k| vec256 c1 = _mm256_unpackhi_epi32(b0, b1); /* 8 9 10 11 40 41 42 43 ... 63 */ 46| 1.68k| vec256 c2 = _mm256_unpacklo_epi32(b2, b3); 47| 1.68k| vec256 c3 = _mm256_unpackhi_epi32(b2, b3); 48| 1.68k| vec256 c4 = _mm256_unpacklo_epi32(b4, b5); 49| 1.68k| vec256 c5 = _mm256_unpackhi_epi32(b4, b5); 50| 1.68k| vec256 c6 = _mm256_unpacklo_epi32(b6, b7); 51| 1.68k| vec256 c7 = _mm256_unpackhi_epi32(b6, b7); 52| | 53| 1.68k| vec256 d0 = c0 | _mm256_slli_epi32(c1, 2); /* 0 8, 1 9, 2 10, 3 11, 32 40, 33 41, ..., 55 63 */ 54| 1.68k| vec256 d2 = c2 | _mm256_slli_epi32(c3, 2); 55| 1.68k| vec256 d4 = c4 | _mm256_slli_epi32(c5, 2); 56| 1.68k| vec256 d6 = c6 | _mm256_slli_epi32(c7, 2); 57| | 58| 1.68k| vec256 e0 = _mm256_unpacklo_epi64(d0, d2); 59| 1.68k| vec256 e2 = _mm256_unpackhi_epi64(d0, d2); 60| 1.68k| vec256 e4 = _mm256_unpacklo_epi64(d4, d6); 61| 1.68k| vec256 e6 = _mm256_unpackhi_epi64(d4, d6); 62| | 63| 1.68k| vec256 f0 = e0 | _mm256_slli_epi32(e2, 1); 64| 1.68k| vec256 f4 = e4 | _mm256_slli_epi32(e6, 1); 65| | 66| 1.68k| vec256 g0 = _mm256_permute2x128_si256(f0, f4, 0x20); 67| 1.68k| vec256 g4 = _mm256_permute2x128_si256(f0, f4, 0x31); 68| | 69| 1.68k| vec256 h = g0 | _mm256_slli_epi32(g4, 4); 70| | 71| 1.68k|#define TRANSPOSE _mm256_set_epi8( 31,27,23,19, 30,26,22,18, 29,25,21,17, 28,24,20,16, 15,11,7,3, 14,10,6,2, 13,9,5,1, 12,8,4,0 ) 72| 1.68k| h = _mm256_shuffle_epi8(h, TRANSPOSE); ------------------ | | 71| 1.68k|#define TRANSPOSE _mm256_set_epi8( 31,27,23,19, 30,26,22,18, 29,25,21,17, 28,24,20,16, 15,11,7,3, 14,10,6,2, 13,9,5,1, 12,8,4,0 ) ------------------ 73| 1.68k| h = _mm256_permute4x64_epi64(h, 0xd8); 74| 1.68k| h = _mm256_shuffle_epi32(h, 0xd8); 75| | 76| 1.68k| *v++ = h; 77| 1.68k| } 78| 626|} poly_s3_inv.c:vec256_timesx_1: 280| 160k|static inline void vec256_timesx_1(vec256 *f) { 281| 160k| vec256 f0 = _mm256_permute4x64_epi64(f[0], 0x93); 282| | 283| 160k| unsigned long long low0 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f0)); 284| | 285| 160k| low0 = low0 << 1; 286| | 287| 160k| f0 = _mm256_blend_epi32(f0, _mm256_set_epi64x(0, 0, 0, low0), 0x3); 288| | 289| 160k| f[0] = f0; 290| 160k|} poly_s3_inv.c:negative_mask: 196| 386k|static inline int negative_mask(int x) { 197| 386k| return x >> 31; 198| 386k|} poly_s3_inv.c:vec256_bit0mask: 247| 1.93M|static inline int vec256_bit0mask(vec256 *f) { 248| 1.93M| return -(_mm_cvtsi128_si32(_mm256_castsi256_si128(f[0])) & 1); 249| 1.93M|} poly_s3_inv.c:vec256_swap: 200| 1.54M|static inline void vec256_swap(vec256 *f, vec256 *g, int len, vec256 mask) { 201| 1.54M| vec256 flip; 202| 1.54M| int i; 203| | 204| 5.16M| for (i = 0; i < len; ++i) { ------------------ | Branch (204:17): [True: 3.62M, False: 1.54M] ------------------ 205| 3.62M| flip = mask & (f[i] ^ g[i]); 206| 3.62M| f[i] ^= flip; 207| 3.62M| g[i] ^= flip; 208| 3.62M| } 209| 1.54M|} poly_s3_inv.c:vec256_eliminate: 227| 772k|static inline void vec256_eliminate(vec256 *f0, vec256 *f1, vec256 *g0, vec256 *g1, int len, const vec256 c0, const vec256 c1) { 228| 772k| int i; 229| | 230| 2.58M| for (i = 0; i < len; ++i) { ------------------ | Branch (230:17): [True: 1.81M, False: 772k] ------------------ 231| 1.81M| vec256 f0i = f0[i]; 232| 1.81M| vec256 f1i = f1[i]; 233| 1.81M| vec256 g0i = g0[i]; 234| 1.81M| vec256 g1i = g1[i]; 235| 1.81M| vec256 t; 236| | 237| 1.81M| f0i &= c0; 238| 1.81M| f1i ^= c1; 239| 1.81M| f1i &= f0i; 240| | 241| 1.81M| t = g0i ^ f0i; 242| 1.81M| g0[i] = t | (g1i ^ f1i); 243| 1.81M| g1[i] = (g1i ^ f0i) & (f1i ^ t); 244| 1.81M| } 245| 772k|} poly_s3_inv.c:vec256_divx_2: 263| 352k|static inline void vec256_divx_2(vec256 *f) { 264| 352k| vec256 f0 = f[0]; 265| 352k| vec256 f1 = f[1]; 266| | 267| 352k| unsigned long long low0 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f0)); 268| 352k| unsigned long long low1 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f1)); 269| | 270| 352k| low0 = (low0 >> 1) | (low1 << 63); 271| 352k| low1 = low1 >> 1; 272| | 273| 352k| f0 = _mm256_blend_epi32(f0, _mm256_set_epi64x(0, 0, 0, low0), 0x3); 274| 352k| f1 = _mm256_blend_epi32(f1, _mm256_set_epi64x(0, 0, 0, low1), 0x3); 275| | 276| 352k| f[0] = _mm256_permute4x64_epi64(f0, 0x39); 277| | f[1] = _mm256_permute4x64_epi64(f1, 0x39); 278| 352k|} poly_s3_inv.c:vec256_timesx_2: 292| 352k|static inline void vec256_timesx_2(vec256 *f) { 293| 352k| vec256 f0 = _mm256_permute4x64_epi64(f[0], 0x93); 294| 352k| vec256 f1 = _mm256_permute4x64_epi64(f[1], 0x93); 295| | 296| 352k| unsigned long long low0 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f0)); 297| 352k| unsigned long long low1 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f1)); 298| | 299| 352k| low1 = (low1 << 1) | (low0 >> 63); 300| 352k| low0 = low0 << 1; 301| | 302| 352k| f0 = _mm256_blend_epi32(f0, _mm256_set_epi64x(0, 0, 0, low0), 0x3); 303| 352k| f1 = _mm256_blend_epi32(f1, _mm256_set_epi64x(0, 0, 0, low1), 0x3); 304| | 305| 352k| f[0] = f0; 306| 352k| f[1] = f1; 307| 352k|} poly_s3_inv.c:vec256_divx_1: 251| 160k|static inline void vec256_divx_1(vec256 *f) { 252| 160k| vec256 f0 = f[0]; 253| | 254| 160k| unsigned long long low0 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f0)); 255| | 256| 160k| low0 = low0 >> 1; 257| | 258| 160k| f0 = _mm256_blend_epi32(f0, _mm256_set_epi64x(0, 0, 0, low0), 0x3); 259| | 260| | f[0] = _mm256_permute4x64_epi64(f0, 0x39); 261| 160k|} poly_s3_inv.c:vec256_scale: 211| 313|static inline void vec256_scale(vec256 *f0, vec256 *f1, const vec256 c0, const vec256 c1) { 212| 313| int i; 213| | 214| 1.15k| for (i = 0; i < numvec; ++i) { ------------------ | | 9| 1.15k|#define numvec 2 ------------------ | Branch (214:17): [True: 843, False: 313] ------------------ 215| 843| vec256 f0i = f0[i]; 216| 843| vec256 f1i = f1[i]; 217| | 218| 843| f0i &= c0; 219| 843| f1i ^= c1; 220| 843| f1i &= f0i; 221| | 222| 843| f0[i] = f0i; 223| 843| f1[i] = f1i; 224| 843| } 225| 313|} poly_s3_inv.c:vec256_final: 170| 313|static void vec256_final(small *out, const vec256 *V0, const vec256 *V1) { 171| 313| int i; 172| 313| small v0[ppad]; 173| 313| small v1[ppad]; 174| 313| small v[ppad]; 175| 313| small vrev[ppad + (ppad - p)]; 176| | 177| 313| vec256_tobits(V0, v0); 178| 313| vec256_tobits(V1, v1); 179| | 180| 216k| for (i = 0; i < ppad; ++i) { ------------------ | | 8| 216k|#define ppad 512 ------------------ | Branch (180:17): [True: 215k, False: 313] ------------------ 181| 215k| v[i] = v0[i] + 2 * v1[i] - 4 * (v0[i] & v1[i]); 182| 215k| } 183| | 184| 216k| for (i = 0; i < ppad; ++i) { ------------------ | | 8| 216k|#define ppad 512 ------------------ | Branch (184:17): [True: 215k, False: 313] ------------------ 185| 215k| vrev[i] = v[ppad - 1 - i]; ------------------ | | 8| 215k|#define ppad 512 ------------------ 186| 215k| } 187| 22.7k| for (i = ppad; i < ppad + (ppad - p); ++i) { ------------------ | | 8| 313|#define ppad 512 ------------------ for (i = ppad; i < ppad + (ppad - p); ++i) { ------------------ | | 8| 22.7k|#define ppad 512 ------------------ for (i = ppad; i < ppad + (ppad - p); ++i) { ------------------ | | 8| 22.7k|#define ppad 512 ------------------ for (i = ppad; i < ppad + (ppad - p); ++i) { ------------------ | | 7| 22.7k|#define p 508 ------------------ | Branch (187:20): [True: 22.4k, False: 313] ------------------ 188| 22.4k| vrev[i] = 0; 189| 22.4k| } 190| | 191| 193k| for (i = 0; i < p; ++i) { ------------------ | | 7| 193k|#define p 508 ------------------ | Branch (191:17): [True: 193k, False: 313] ------------------ 192| 193k| out[i] = vrev[i + ppad - p]; ------------------ | | 8| 193k|#define ppad 512 ------------------ out[i] = vrev[i + ppad - p]; ------------------ | | 7| 193k|#define p 508 ------------------ 193| 193k| } 194| 313|} poly_s3_inv.c:vec256_tobits: 80| 626|static inline void vec256_tobits(const vec256 *v, small *b) { 81| 626| int i; 82| | 83| 2.31k| for (i = 0; i < numvec; ++i) { ------------------ | | 9| 2.31k|#define numvec 2 ------------------ | Branch (83:17): [True: 1.68k, False: 626] ------------------ 84| 1.68k| vec256 h = *v++; 85| | 86| 1.68k| h = _mm256_shuffle_epi32(h, 0xd8); 87| 1.68k| h = _mm256_permute4x64_epi64(h, 0xd8); 88| 1.68k| h = _mm256_shuffle_epi8(h, TRANSPOSE); ------------------ | | 71| 1.68k|#define TRANSPOSE _mm256_set_epi8( 31,27,23,19, 30,26,22,18, 29,25,21,17, 28,24,20,16, 15,11,7,3, 14,10,6,2, 13,9,5,1, 12,8,4,0 ) ------------------ 89| | 90| 1.68k| vec256 g0 = h & _mm256_set1_epi8(15); 91| 1.68k| vec256 g4 = _mm256_srli_epi32(h, 4) & _mm256_set1_epi8(15); 92| | 93| 1.68k| vec256 f0 = _mm256_permute2x128_si256(g0, g4, 0x20); 94| 1.68k| vec256 f4 = _mm256_permute2x128_si256(g0, g4, 0x31); 95| | 96| 1.68k| vec256 e0 = f0 & _mm256_set1_epi8(5); 97| 1.68k| vec256 e2 = _mm256_srli_epi32(f0, 1) & _mm256_set1_epi8(5); 98| 1.68k| vec256 e4 = f4 & _mm256_set1_epi8(5); 99| 1.68k| vec256 e6 = _mm256_srli_epi32(f4, 1) & _mm256_set1_epi8(5); 100| | 101| 1.68k| vec256 d0 = _mm256_unpacklo_epi32(e0, e2); 102| 1.68k| vec256 d2 = _mm256_unpackhi_epi32(e0, e2); 103| 1.68k| vec256 d4 = _mm256_unpacklo_epi32(e4, e6); 104| 1.68k| vec256 d6 = _mm256_unpackhi_epi32(e4, e6); 105| | 106| 1.68k| vec256 c0 = d0 & _mm256_set1_epi8(1); 107| 1.68k| vec256 c1 = _mm256_srli_epi32(d0, 2) & _mm256_set1_epi8(1); 108| 1.68k| vec256 c2 = d2 & _mm256_set1_epi8(1); 109| 1.68k| vec256 c3 = _mm256_srli_epi32(d2, 2) & _mm256_set1_epi8(1); 110| 1.68k| vec256 c4 = d4 & _mm256_set1_epi8(1); 111| 1.68k| vec256 c5 = _mm256_srli_epi32(d4, 2) & _mm256_set1_epi8(1); 112| 1.68k| vec256 c6 = d6 & _mm256_set1_epi8(1); 113| 1.68k| vec256 c7 = _mm256_srli_epi32(d6, 2) & _mm256_set1_epi8(1); 114| | 115| 1.68k| vec256 b0 = _mm256_unpacklo_epi64(c0, c1); 116| 1.68k| vec256 b1 = _mm256_unpackhi_epi64(c0, c1); 117| 1.68k| vec256 b2 = _mm256_unpacklo_epi64(c2, c3); 118| 1.68k| vec256 b3 = _mm256_unpackhi_epi64(c2, c3); 119| 1.68k| vec256 b4 = _mm256_unpacklo_epi64(c4, c5); 120| 1.68k| vec256 b5 = _mm256_unpackhi_epi64(c4, c5); 121| 1.68k| vec256 b6 = _mm256_unpacklo_epi64(c6, c7); 122| 1.68k| vec256 b7 = _mm256_unpackhi_epi64(c6, c7); 123| | 124| 1.68k| _mm256_storeu_si256((vec256 *) b, b0); 125| 1.68k| b += 32; 126| 1.68k| _mm256_storeu_si256((vec256 *) b, b1); 127| 1.68k| b += 32; 128| 1.68k| _mm256_storeu_si256((vec256 *) b, b2); 129| 1.68k| b += 32; 130| 1.68k| _mm256_storeu_si256((vec256 *) b, b3); 131| 1.68k| b += 32; 132| 1.68k| _mm256_storeu_si256((vec256 *) b, b4); 133| 1.68k| b += 32; 134| 1.68k| _mm256_storeu_si256((vec256 *) b, b5); 135| 1.68k| b += 32; 136| 1.68k| _mm256_storeu_si256((vec256 *) b, b6); 137| 1.68k| b += 32; 138| 1.68k| _mm256_storeu_si256((vec256 *) b, b7); 139| 1.68k| b += 32; 140| 1.68k| } 141| 626|} PQCLEAN_NTRUHPS2048509_AVX2_sample_fg: 3| 191|void PQCLEAN_NTRUHPS2048509_AVX2_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]) { 4| | 5| 191| PQCLEAN_NTRUHPS2048509_AVX2_sample_iid(f, uniformbytes); 6| 191| PQCLEAN_NTRUHPS2048509_AVX2_sample_fixed_type(g, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 20| 191|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 191|#define NTRU_N 509 | | ------------------ ------------------ 7| 191|} PQCLEAN_NTRUHPS2048509_AVX2_sample_rm: 9| 191|void PQCLEAN_NTRUHPS2048509_AVX2_sample_rm(poly *r, poly *m, const unsigned char uniformbytes[NTRU_SAMPLE_RM_BYTES]) { 10| | 11| 191| PQCLEAN_NTRUHPS2048509_AVX2_sample_iid(r, uniformbytes); 12| 191| PQCLEAN_NTRUHPS2048509_AVX2_sample_fixed_type(m, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 20| 191|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 191|#define NTRU_N 509 | | ------------------ ------------------ 13| 191|} PQCLEAN_NTRUHPS2048509_AVX2_sample_fixed_type: 16| 382|void PQCLEAN_NTRUHPS2048509_AVX2_sample_fixed_type(poly *r, const unsigned char u[NTRU_SAMPLE_FT_BYTES]) { 17| | // Assumes NTRU_SAMPLE_FT_BYTES = ceil(30*(n-1)/8) 18| | 19| 382| int32_t s[NTRU_N - 1]; 20| 382| int i; 21| | 22| | // Use 30 bits of u per word 23| 48.8k| for (i = 0; i < (NTRU_N - 1) / 4; i++) { ------------------ | | 5| 48.8k|#define NTRU_N 509 ------------------ | Branch (23:17): [True: 48.5k, False: 382] ------------------ 24| 48.5k| s[4 * i + 0] = (u[15 * i + 0] << 2) + (u[15 * i + 1] << 10) + (u[15 * i + 2] << 18) + ((uint32_t) u[15 * i + 3] << 26); 25| 48.5k| s[4 * i + 1] = ((u[15 * i + 3] & 0xc0) >> 4) + (u[15 * i + 4] << 4) + (u[15 * i + 5] << 12) + (u[15 * i + 6] << 20) + ((uint32_t) u[15 * i + 7] << 28); 26| 48.5k| s[4 * i + 2] = ((u[15 * i + 7] & 0xf0) >> 2) + (u[15 * i + 8] << 6) + (u[15 * i + 9] << 14) + (u[15 * i + 10] << 22) + ((uint32_t) u[15 * i + 11] << 30); 27| 48.5k| s[4 * i + 3] = (u[15 * i + 11] & 0xfc) + (u[15 * i + 12] << 8) + (u[15 * i + 13] << 16) + ((uint32_t) u[15 * i + 14] << 24); 28| 48.5k| } 29| | 30| 48.8k| for (i = 0; i < NTRU_WEIGHT / 2; i++) { ------------------ | | 14| 48.8k|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 48.8k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 48.8k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ | Branch (30:17): [True: 48.5k, False: 382] ------------------ 31| 48.5k| s[i] |= 1; 32| 48.5k| } 33| | 34| 48.8k| for (i = NTRU_WEIGHT / 2; i < NTRU_WEIGHT; i++) { ------------------ | | 14| 382|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 382|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 382|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ for (i = NTRU_WEIGHT / 2; i < NTRU_WEIGHT; i++) { ------------------ | | 14| 48.8k|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 48.8k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 48.8k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ | Branch (34:31): [True: 48.5k, False: 382] ------------------ 35| 48.5k| s[i] |= 2; 36| 48.5k| } 37| | 38| 382| PQCLEAN_NTRUHPS2048509_AVX2_crypto_sort_int32(s, NTRU_N - 1); ------------------ | | 5| 382|#define NTRU_N 509 ------------------ 39| | 40| 194k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 194k|#define NTRU_N 509 ------------------ | Branch (40:17): [True: 194k, False: 382] ------------------ 41| 194k| r->coeffs[i] = ((uint16_t) (s[i] & 3)); 42| 194k| } 43| | 44| 382| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 382|#define NTRU_N 509 ------------------ 45| 382|} PQCLEAN_NTRUHPS2048509_AVX2_sample_iid: 7| 382|void PQCLEAN_NTRUHPS2048509_AVX2_sample_iid(poly *r, const unsigned char uniformbytes[NTRU_SAMPLE_IID_BYTES]) { 8| 382| int i; 9| 382| union { /* align to 32 byte boundary for vmovdqa */ 10| 382| unsigned char b[PAD32(NTRU_SAMPLE_IID_BYTES)]; 11| 382| __m256i b_x32[PAD32(NTRU_SAMPLE_IID_BYTES) / 32]; 12| 382| } buffer; 13| | 14| 194k| for (i = 0; i < NTRU_SAMPLE_IID_BYTES; i++) { ------------------ | | 20| 194k|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 194k|#define NTRU_N 509 | | ------------------ ------------------ | Branch (14:17): [True: 194k, False: 382] ------------------ 15| 194k| buffer.b[i] = uniformbytes[i]; 16| 194k| } 17| 1.91k| for (i = NTRU_SAMPLE_IID_BYTES; i < PAD32(NTRU_SAMPLE_IID_BYTES); i++) { ------------------ | | 20| 382|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 382|#define NTRU_N 509 | | ------------------ ------------------ for (i = NTRU_SAMPLE_IID_BYTES; i < PAD32(NTRU_SAMPLE_IID_BYTES); i++) { ------------------ | | 11| 1.91k|#define PAD32(X) ((((X) + 31)/32)*32) ------------------ | Branch (17:37): [True: 1.52k, False: 382] ------------------ 18| 1.52k| buffer.b[i] = 0; 19| 1.52k| } 20| 382| PQCLEAN_NTRUHPS2048509_AVX2_vec32_sample_iid(r, buffer.b); 21| 382|} owcpa.c:owcpa_check_ciphertext: 5| 348|static int owcpa_check_ciphertext(const unsigned char *ciphertext) { 6| | /* A ciphertext is log2(q)*(n-1) bits packed into bytes. */ 7| | /* Check that any unused bits of the final byte are zero. */ 8| | 9| 348| uint16_t t = 0; 10| | 11| 348| t = ciphertext[NTRU_CIPHERTEXTBYTES - 1]; ------------------ | | 35| 348|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 31| 348|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 348|#define NTRU_LOGQ 11 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 348|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 348|#define NTRU_N 509 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 12| 348| t &= 0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG))); ------------------ | | 6| 348|#define NTRU_LOGQ 11 ------------------ t &= 0xff << (8 - (7 & (NTRU_LOGQ * NTRU_PACK_DEG))); ------------------ | | 25| 348|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 348|#define NTRU_N 509 | | ------------------ ------------------ 13| | 14| | /* We have 0 <= t < 256 */ 15| | /* Return 0 on success (t=0), 1 on failure */ 16| 348| return (int) (1 & ((~t + 1) >> 15)); 17| 348|} owcpa.c:owcpa_check_m: 38| 337|static int owcpa_check_m(const poly *m) { 39| | /* Check that m is in message space, i.e. */ 40| | /* (1) |{i : m[i] = 1}| = |{i : m[i] = 2}|, and */ 41| | /* (2) |{i : m[i] != 0}| = NTRU_WEIGHT. */ 42| | /* Note: We may assume that m has coefficients in {0,1,2}. */ 43| | 44| 337| int i; 45| 337| uint32_t t = 0; 46| 337| uint16_t ps = 0; 47| 337| uint16_t ms = 0; 48| 228k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 228k|#define NTRU_N 509 ------------------ | Branch (48:17): [True: 227k, False: 337] ------------------ 49| 227k| ps += m->coeffs[i] & 1; 50| 227k| ms += m->coeffs[i] & 2; 51| 227k| } 52| 337| t |= ps ^ (ms >> 1); /* 0 if (1) holds */ 53| 337| t |= ms ^ NTRU_WEIGHT; /* 0 if (1) and (2) hold */ ------------------ | | 14| 337|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 337|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 337|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ 54| | 55| | /* We have 0 <= t < 2^16. */ 56| | /* Return 0 on success (t=0), 1 on failure */ 57| 337| return (int) (1 & ((~t + 1) >> 31)); 58| 337|} owcpa.c:owcpa_check_r: 19| 348|static int owcpa_check_r(const poly *r) { 20| | /* A valid r has coefficients in {0,1,q-1} and has r[N-1] = 0 */ 21| | /* Note: We may assume that 0 <= r[i] <= q-1 for all i */ 22| | 23| 348| int i; 24| 348| uint32_t t = 0; 25| 348| uint16_t c; 26| 237k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 237k|#define NTRU_N 509 ------------------ | Branch (26:17): [True: 236k, False: 348] ------------------ 27| 236k| c = r->coeffs[i]; 28| 236k| t |= (c + 1) & (NTRU_Q - 4); /* 0 iff c is in {-1,0,1,2} */ ------------------ | | 13| 236k|#define NTRU_Q (1 << NTRU_LOGQ) | | ------------------ | | | | 6| 236k|#define NTRU_LOGQ 11 | | ------------------ ------------------ 29| 236k| t |= (c + 2) & 4; /* 1 if c = 2, 0 if c is in {-1,0,1} */ 30| 236k| } 31| 348| t |= r->coeffs[NTRU_N - 1]; /* Coefficient n-1 must be zero */ ------------------ | | 5| 348|#define NTRU_N 509 ------------------ 32| | 33| | /* We have 0 <= t < 2^16. */ 34| | /* Return 0 on success (t=0), 1 on failure */ 35| 348| return (int) (1 & ((~t + 1) >> 31)); 36| 348|} poly_mod.c:mod3: 3| 178k|static uint16_t mod3(uint16_t a) { 4| 178k| uint16_t r; 5| 178k| int16_t t, c; 6| | 7| 178k| r = (a >> 8) + (a & 0xff); // r mod 255 == a mod 255 8| 178k| r = (r >> 4) + (r & 0xf); // r' mod 15 == r mod 15 9| 178k| r = (r >> 2) + (r & 0x3); // r' mod 3 == r mod 3 10| 178k| r = (r >> 2) + (r & 0x3); // r' mod 3 == r mod 3 11| | 12| 178k| t = r - 3; 13| 178k| c = t >> 15; 14| | 15| 178k| return (c & r) ^ (~c & t); 16| 178k|} poly_r2_inv.c:both_negative_mask: 6| 86.5k|static inline int16_t both_negative_mask(int16_t x, int16_t y) { 7| 86.5k| return (x & y) >> 15; 8| 86.5k|} poly_rq_mul.c:toom4_k2x2_mul: 47| 561|static void toom4_k2x2_mul(uint16_t ab[2 * L], const uint16_t a[L], const uint16_t b[L]) { 48| 561| uint16_t tmpA[9 * K]; 49| 561| uint16_t tmpB[9 * K]; 50| 561| uint16_t eC[63 * 2 * K]; 51| | 52| 561| toom4_k2x2_eval_0(tmpA, a); 53| 561| toom4_k2x2_eval_0(tmpB, b); 54| 561| toom4_k2x2_basemul(eC + 0 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 561|#define K (L/16) | | ------------------ | | | | 6| 561|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 561|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 55| | 56| 561| toom4_k2x2_eval_p1(tmpA, a); 57| 561| toom4_k2x2_eval_p1(tmpB, b); 58| 561| toom4_k2x2_basemul(eC + 1 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 561|#define K (L/16) | | ------------------ | | | | 6| 561|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 561|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 59| | 60| 561| toom4_k2x2_eval_m1(tmpA, a); 61| 561| toom4_k2x2_eval_m1(tmpB, b); 62| 561| toom4_k2x2_basemul(eC + 2 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 561|#define K (L/16) | | ------------------ | | | | 6| 561|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 561|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 63| | 64| 561| toom4_k2x2_eval_p2(tmpA, a); 65| 561| toom4_k2x2_eval_p2(tmpB, b); 66| 561| toom4_k2x2_basemul(eC + 3 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 561|#define K (L/16) | | ------------------ | | | | 6| 561|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 561|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 67| | 68| 561| toom4_k2x2_eval_m2(tmpA, a); 69| 561| toom4_k2x2_eval_m2(tmpB, b); 70| 561| toom4_k2x2_basemul(eC + 4 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 561|#define K (L/16) | | ------------------ | | | | 6| 561|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 561|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 71| | 72| 561| toom4_k2x2_eval_p3(tmpA, a); 73| 561| toom4_k2x2_eval_p3(tmpB, b); 74| 561| toom4_k2x2_basemul(eC + 5 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 561|#define K (L/16) | | ------------------ | | | | 6| 561|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 561|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 75| | 76| 561| toom4_k2x2_eval_inf(tmpA, a); 77| 561| toom4_k2x2_eval_inf(tmpB, b); 78| 561| toom4_k2x2_basemul(eC + 6 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 561|#define K (L/16) | | ------------------ | | | | 6| 561|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 561|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 79| | 80| 561| toom4_k2x2_interpolate(ab, eC); 81| 561|} poly_rq_mul.c:toom4_k2x2_eval_0: 84| 1.12k|static void toom4_k2x2_eval_0(uint16_t r[9 * K], const uint16_t a[L]) { 85| 351k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 351k|#define M (L/4) | | ------------------ | | | | 6| 351k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 351k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (85:24): [True: 350k, False: 1.12k] ------------------ 86| 350k| r[i] = a[i]; 87| 350k| } 88| 1.12k| k2x2_eval(r); 89| 1.12k|} poly_rq_mul.c:k2x2_eval: 148| 8.46k|static inline void k2x2_eval(uint16_t r[9 * K]) { 149| | /* Input: e + f.Y + g.Y^2 + h.Y^3 */ 150| | /* Output: [ e | f | g | h | e+f | f+h | g+e | h+g | e+f+g+h ] */ 151| | 152| 8.46k| size_t i; 153| 2.66M| for (i = 0; i < 4 * K; i++) { ------------------ | | 8| 2.66M|#define K (L/16) | | ------------------ | | | | 6| 2.66M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 2.66M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (153:17): [True: 2.66M, False: 8.46k] ------------------ 154| 2.66M| r[4 * K + i] = r[i]; ------------------ | | 8| 2.66M|#define K (L/16) | | ------------------ | | | | 6| 2.66M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 2.66M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 155| 2.66M| } 156| 673k| for (i = 0; i < K; i++) { ------------------ | | 8| 673k|#define K (L/16) | | ------------------ | | | | 6| 673k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 673k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (156:17): [True: 665k, False: 8.46k] ------------------ 157| 665k| r[4 * K + i] += r[1 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[4 * K + i] += r[1 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 158| 665k| r[5 * K + i] += r[3 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[5 * K + i] += r[3 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 159| 665k| r[6 * K + i] += r[0 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[6 * K + i] += r[0 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 160| 665k| r[7 * K + i] += r[2 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[7 * K + i] += r[2 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 161| 665k| r[8 * K + i] = r[5 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[8 * K + i] = r[5 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 162| 665k| r[8 * K + i] += r[6 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[8 * K + i] += r[6 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 163| 665k| } 164| 8.46k|} poly_rq_mul.c:toom4_k2x2_basemul: 166| 3.92k|static void toom4_k2x2_basemul(uint16_t r[18 * K], const uint16_t a[9 * K], const uint16_t b[9 * K]) { 167| 3.92k| schoolbook_KxK(r + 0 * 2 * K, a + 0 * K, b + 0 * K); ------------------ | | 8| 3.92k|#define K (L/16) | | ------------------ | | | | 6| 3.92k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.92k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 0 * 2 * K, a + 0 * K, b + 0 * K); ------------------ | | 8| 3.92k|#define K (L/16) | | ------------------ | | | | 6| 3.92k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.92k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 0 * 2 * K, a + 0 * K, b + 0 * K); ------------------ | | 8| 3.92k|#define K (L/16) | | ------------------ | | | | 6| 3.92k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.92k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 168| 3.92k| schoolbook_KxK(r + 1 * 2 * K, a + 1 * K, b + 1 * K); ------------------ | | 8| 3.92k|#define K (L/16) | | ------------------ | | | | 6| 3.92k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.92k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 1 * 2 * K, a + 1 * K, b + 1 * K); ------------------ | | 8| 3.92k|#define K (L/16) | | ------------------ | | | | 6| 3.92k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.92k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 1 * 2 * K, a + 1 * K, b + 1 * K); ------------------ | | 8| 3.92k|#define K (L/16) | | ------------------ | | | | 6| 3.92k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.92k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 169| 3.92k| schoolbook_KxK(r + 2 * 2 * K, a + 2 * K, b + 2 * K); ------------------ | | 8| 3.92k|#define K (L/16) | | ------------------ | | | | 6| 3.92k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.92k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 2 * 2 * K, a + 2 * K, b + 2 * K); ------------------ | | 8| 3.92k|#define K (L/16) | | ------------------ | | | | 6| 3.92k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.92k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 2 * 2 * K, a + 2 * K, b + 2 * K); ------------------ | | 8| 3.92k|#define K (L/16) | | ------------------ | | | | 6| 3.92k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.92k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 170| 3.92k| schoolbook_KxK(r + 3 * 2 * K, a + 3 * K, b + 3 * K); ------------------ | | 8| 3.92k|#define K (L/16) | | ------------------ | | | | 6| 3.92k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.92k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 3 * 2 * K, a + 3 * K, b + 3 * K); ------------------ | | 8| 3.92k|#define K (L/16) | | ------------------ | | | | 6| 3.92k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.92k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 3 * 2 * K, a + 3 * K, b + 3 * K); ------------------ | | 8| 3.92k|#define K (L/16) | | ------------------ | | | | 6| 3.92k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.92k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 171| 3.92k| schoolbook_KxK(r + 4 * 2 * K, a + 4 * K, b + 4 * K); ------------------ | | 8| 3.92k|#define K (L/16) | | ------------------ | | | | 6| 3.92k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.92k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 4 * 2 * K, a + 4 * K, b + 4 * K); ------------------ | | 8| 3.92k|#define K (L/16) | | ------------------ | | | | 6| 3.92k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.92k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 4 * 2 * K, a + 4 * K, b + 4 * K); ------------------ | | 8| 3.92k|#define K (L/16) | | ------------------ | | | | 6| 3.92k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.92k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 172| 3.92k| schoolbook_KxK(r + 5 * 2 * K, a + 5 * K, b + 5 * K); ------------------ | | 8| 3.92k|#define K (L/16) | | ------------------ | | | | 6| 3.92k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.92k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 5 * 2 * K, a + 5 * K, b + 5 * K); ------------------ | | 8| 3.92k|#define K (L/16) | | ------------------ | | | | 6| 3.92k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.92k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 5 * 2 * K, a + 5 * K, b + 5 * K); ------------------ | | 8| 3.92k|#define K (L/16) | | ------------------ | | | | 6| 3.92k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.92k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 173| 3.92k| schoolbook_KxK(r + 6 * 2 * K, a + 6 * K, b + 6 * K); ------------------ | | 8| 3.92k|#define K (L/16) | | ------------------ | | | | 6| 3.92k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.92k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 6 * 2 * K, a + 6 * K, b + 6 * K); ------------------ | | 8| 3.92k|#define K (L/16) | | ------------------ | | | | 6| 3.92k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.92k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 6 * 2 * K, a + 6 * K, b + 6 * K); ------------------ | | 8| 3.92k|#define K (L/16) | | ------------------ | | | | 6| 3.92k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.92k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 174| 3.92k| schoolbook_KxK(r + 7 * 2 * K, a + 7 * K, b + 7 * K); ------------------ | | 8| 3.92k|#define K (L/16) | | ------------------ | | | | 6| 3.92k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.92k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 7 * 2 * K, a + 7 * K, b + 7 * K); ------------------ | | 8| 3.92k|#define K (L/16) | | ------------------ | | | | 6| 3.92k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.92k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 7 * 2 * K, a + 7 * K, b + 7 * K); ------------------ | | 8| 3.92k|#define K (L/16) | | ------------------ | | | | 6| 3.92k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.92k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 175| 3.92k| schoolbook_KxK(r + 8 * 2 * K, a + 8 * K, b + 8 * K); ------------------ | | 8| 3.92k|#define K (L/16) | | ------------------ | | | | 6| 3.92k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.92k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 8 * 2 * K, a + 8 * K, b + 8 * K); ------------------ | | 8| 3.92k|#define K (L/16) | | ------------------ | | | | 6| 3.92k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.92k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 8 * 2 * K, a + 8 * K, b + 8 * K); ------------------ | | 8| 3.92k|#define K (L/16) | | ------------------ | | | | 6| 3.92k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.92k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 176| 3.92k|} poly_rq_mul.c:schoolbook_KxK: 178| 38.0k|static inline void schoolbook_KxK(uint16_t r[2 * K], const uint16_t a[K], const uint16_t b[K]) { 179| 38.0k| size_t i, j; 180| 3.03M| for (j = 0; j < K; j++) { ------------------ | | 8| 3.03M|#define K (L/16) | | ------------------ | | | | 6| 3.03M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 3.03M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (180:17): [True: 2.99M, False: 38.0k] ------------------ 181| 2.99M| r[j] = a[0] * (uint32_t)b[j]; 182| 2.99M| } 183| 2.99M| for (i = 1; i < K; i++) { ------------------ | | 8| 2.99M|#define K (L/16) | | ------------------ | | | | 6| 2.99M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 2.99M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (183:17): [True: 2.95M, False: 38.0k] ------------------ 184| 232M| for (j = 0; j < K - 1; j++) { ------------------ | | 8| 232M|#define K (L/16) | | ------------------ | | | | 6| 232M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 232M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (184:21): [True: 229M, False: 2.95M] ------------------ 185| 229M| r[i + j] += a[i] * (uint32_t)b[j]; 186| 229M| } 187| 2.95M| r[i + K - 1] = a[i] * (uint32_t)b[K - 1]; ------------------ | | 8| 2.95M|#define K (L/16) | | ------------------ | | | | 6| 2.95M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 2.95M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[i + K - 1] = a[i] * (uint32_t)b[K - 1]; ------------------ | | 8| 2.95M|#define K (L/16) | | ------------------ | | | | 6| 2.95M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 2.95M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 188| 2.95M| } 189| 38.0k| r[2 * K - 1] = 0; ------------------ | | 8| 38.0k|#define K (L/16) | | ------------------ | | | | 6| 38.0k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 38.0k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 190| 38.0k|} poly_rq_mul.c:toom4_k2x2_eval_p1: 91| 1.12k|static void toom4_k2x2_eval_p1(uint16_t r[9 * K], const uint16_t a[L]) { 92| 351k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 351k|#define M (L/4) | | ------------------ | | | | 6| 351k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 351k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (92:24): [True: 350k, False: 1.12k] ------------------ 93| 350k| r[i] = a[0 * M + i]; ------------------ | | 7| 350k|#define M (L/4) | | ------------------ | | | | 6| 350k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 350k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 94| 350k| r[i] += a[1 * M + i]; ------------------ | | 7| 350k|#define M (L/4) | | ------------------ | | | | 6| 350k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 350k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 95| 350k| r[i] += a[2 * M + i]; ------------------ | | 7| 350k|#define M (L/4) | | ------------------ | | | | 6| 350k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 350k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 96| 350k| r[i] += a[3 * M + i]; ------------------ | | 7| 350k|#define M (L/4) | | ------------------ | | | | 6| 350k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 350k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 97| 350k| } 98| 1.12k| k2x2_eval(r); 99| 1.12k|} poly_rq_mul.c:toom4_k2x2_eval_m1: 101| 1.12k|static void toom4_k2x2_eval_m1(uint16_t r[9 * K], const uint16_t a[L]) { 102| 351k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 351k|#define M (L/4) | | ------------------ | | | | 6| 351k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 351k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (102:24): [True: 350k, False: 1.12k] ------------------ 103| 350k| r[i] = a[0 * M + i]; ------------------ | | 7| 350k|#define M (L/4) | | ------------------ | | | | 6| 350k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 350k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 104| 350k| r[i] -= a[1 * M + i]; ------------------ | | 7| 350k|#define M (L/4) | | ------------------ | | | | 6| 350k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 350k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 105| 350k| r[i] += a[2 * M + i]; ------------------ | | 7| 350k|#define M (L/4) | | ------------------ | | | | 6| 350k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 350k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 106| 350k| r[i] -= a[3 * M + i]; ------------------ | | 7| 350k|#define M (L/4) | | ------------------ | | | | 6| 350k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 350k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 107| 350k| } 108| 1.12k| k2x2_eval(r); 109| 1.12k|} poly_rq_mul.c:toom4_k2x2_eval_p2: 111| 1.12k|static void toom4_k2x2_eval_p2(uint16_t r[9 * K], const uint16_t a[L]) { 112| 351k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 351k|#define M (L/4) | | ------------------ | | | | 6| 351k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 351k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (112:24): [True: 350k, False: 1.12k] ------------------ 113| 350k| r[i] = a[0 * M + i]; ------------------ | | 7| 350k|#define M (L/4) | | ------------------ | | | | 6| 350k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 350k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 114| 350k| r[i] += 2 * a[1 * M + i]; ------------------ | | 7| 350k|#define M (L/4) | | ------------------ | | | | 6| 350k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 350k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 115| 350k| r[i] += 4 * a[2 * M + i]; ------------------ | | 7| 350k|#define M (L/4) | | ------------------ | | | | 6| 350k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 350k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 116| 350k| r[i] += 8 * a[3 * M + i]; ------------------ | | 7| 350k|#define M (L/4) | | ------------------ | | | | 6| 350k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 350k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 117| 350k| } 118| 1.12k| k2x2_eval(r); 119| 1.12k|} poly_rq_mul.c:toom4_k2x2_eval_m2: 121| 1.12k|static void toom4_k2x2_eval_m2(uint16_t r[9 * K], const uint16_t a[L]) { 122| 351k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 351k|#define M (L/4) | | ------------------ | | | | 6| 351k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 351k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (122:24): [True: 350k, False: 1.12k] ------------------ 123| 350k| r[i] = a[0 * M + i]; ------------------ | | 7| 350k|#define M (L/4) | | ------------------ | | | | 6| 350k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 350k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 124| 350k| r[i] -= 2 * a[1 * M + i]; ------------------ | | 7| 350k|#define M (L/4) | | ------------------ | | | | 6| 350k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 350k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 125| 350k| r[i] += 4 * a[2 * M + i]; ------------------ | | 7| 350k|#define M (L/4) | | ------------------ | | | | 6| 350k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 350k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 126| 350k| r[i] -= 8 * a[3 * M + i]; ------------------ | | 7| 350k|#define M (L/4) | | ------------------ | | | | 6| 350k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 350k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 127| 350k| } 128| 1.12k| k2x2_eval(r); 129| 1.12k|} poly_rq_mul.c:toom4_k2x2_eval_p3: 131| 1.12k|static void toom4_k2x2_eval_p3(uint16_t r[9 * K], const uint16_t a[L]) { 132| 351k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 351k|#define M (L/4) | | ------------------ | | | | 6| 351k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 351k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (132:24): [True: 350k, False: 1.12k] ------------------ 133| 350k| r[i] = a[0 * M + i]; ------------------ | | 7| 350k|#define M (L/4) | | ------------------ | | | | 6| 350k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 350k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 134| 350k| r[i] += 3 * a[1 * M + i]; ------------------ | | 7| 350k|#define M (L/4) | | ------------------ | | | | 6| 350k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 350k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 135| 350k| r[i] += 9 * a[2 * M + i]; ------------------ | | 7| 350k|#define M (L/4) | | ------------------ | | | | 6| 350k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 350k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 136| 350k| r[i] += 27 * a[3 * M + i]; ------------------ | | 7| 350k|#define M (L/4) | | ------------------ | | | | 6| 350k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 350k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 137| 350k| } 138| 1.12k| k2x2_eval(r); 139| 1.12k|} poly_rq_mul.c:toom4_k2x2_eval_inf: 141| 1.12k|static void toom4_k2x2_eval_inf(uint16_t r[9 * K], const uint16_t a[L]) { 142| 351k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 351k|#define M (L/4) | | ------------------ | | | | 6| 351k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 351k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (142:24): [True: 350k, False: 1.12k] ------------------ 143| 350k| r[i] = a[3 * M + i]; ------------------ | | 7| 350k|#define M (L/4) | | ------------------ | | | | 6| 350k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 350k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 144| 350k| } 145| 1.12k| k2x2_eval(r); 146| 1.12k|} poly_rq_mul.c:toom4_k2x2_interpolate: 192| 561|static void toom4_k2x2_interpolate(uint16_t r[2 * L], const uint16_t a[7 * 18 * K]) { 193| 561| size_t i; 194| | 195| 561| uint16_t P1[2 * M]; 196| 561| uint16_t Pm1[2 * M]; 197| 561| uint16_t P2[2 * M]; 198| 561| uint16_t Pm2[2 * M]; 199| | 200| 561| uint16_t *C0 = r; 201| 561| uint16_t *C2 = r + 2 * M; ------------------ | | 7| 561|#define M (L/4) | | ------------------ | | | | 6| 561|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 561|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 202| 561| uint16_t *C4 = r + 4 * M; ------------------ | | 7| 561|#define M (L/4) | | ------------------ | | | | 6| 561|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 561|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 203| 561| uint16_t *C6 = r + 6 * M; ------------------ | | 7| 561|#define M (L/4) | | ------------------ | | | | 6| 561|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 561|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 204| | 205| 561| uint16_t V0, V1, V2; 206| | 207| 561| k2x2_interpolate(C0, a + 0 * 9 * 2 * K); ------------------ | | 8| 561|#define K (L/16) | | ------------------ | | | | 6| 561|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 561|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 208| 561| k2x2_interpolate(P1, a + 1 * 9 * 2 * K); ------------------ | | 8| 561|#define K (L/16) | | ------------------ | | | | 6| 561|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 561|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 209| 561| k2x2_interpolate(Pm1, a + 2 * 9 * 2 * K); ------------------ | | 8| 561|#define K (L/16) | | ------------------ | | | | 6| 561|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 561|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 210| 561| k2x2_interpolate(P2, a + 3 * 9 * 2 * K); ------------------ | | 8| 561|#define K (L/16) | | ------------------ | | | | 6| 561|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 561|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 211| 561| k2x2_interpolate(Pm2, a + 4 * 9 * 2 * K); ------------------ | | 8| 561|#define K (L/16) | | ------------------ | | | | 6| 561|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 561|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 212| 561| k2x2_interpolate(C6, a + 6 * 9 * 2 * K); ------------------ | | 8| 561|#define K (L/16) | | ------------------ | | | | 6| 561|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 561|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 213| | 214| 350k| for (i = 0; i < 2 * M; i++) { ------------------ | | 7| 350k|#define M (L/4) | | ------------------ | | | | 6| 350k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 350k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (214:17): [True: 350k, False: 561] ------------------ 215| 350k| V0 = ((uint32_t)(P1[i] + Pm1[i])) >> 1; 216| 350k| V0 = V0 - C0[i] - C6[i]; 217| 350k| V1 = ((uint32_t)(P2[i] + Pm2[i] - 2 * C0[i] - 128 * C6[i])) >> 3; 218| 350k| C4[i] = 43691 * (uint32_t)(V1 - V0); 219| 350k| C2[i] = V0 - C4[i]; 220| 350k| P1[i] = ((uint32_t)(P1[i] - Pm1[i])) >> 1; 221| 350k| } 222| | 223| | /* reuse Pm1 for P3 */ 224| 561|#define P3 Pm1 225| 561| k2x2_interpolate(P3, a + 5 * 9 * 2 * K); ------------------ | | 224| 561|#define P3 Pm1 ------------------ k2x2_interpolate(P3, a + 5 * 9 * 2 * K); ------------------ | | 8| 561|#define K (L/16) | | ------------------ | | | | 6| 561|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 561|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 226| | 227| 350k| for (i = 0; i < 2 * M; i++) { ------------------ | | 7| 350k|#define M (L/4) | | ------------------ | | | | 6| 350k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 350k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (227:17): [True: 350k, False: 561] ------------------ 228| 350k| V0 = P1[i]; 229| 350k| V1 = 43691 * (((uint32_t)(P2[i] - Pm2[i]) >> 2) - V0); 230| 350k| V2 = 43691 * (uint32_t)(P3[i] - C0[i] - 9 * (C2[i] + 9 * (C4[i] + 9 * C6[i]))); ------------------ | | 224| 350k|#define P3 Pm1 ------------------ 231| 350k| V2 = ((uint32_t)(V2 - V0)) >> 3; 232| 350k| V2 -= V1; 233| 350k| P3[i] = 52429 * (uint32_t)V2; ------------------ | | 224| 350k|#define P3 Pm1 ------------------ 234| 350k| P2[i] = V1 - V2; 235| 350k| P1[i] = V0 - P2[i] - P3[i]; ------------------ | | 224| 350k|#define P3 Pm1 ------------------ 236| 350k| } 237| | 238| 350k| for (i = 0; i < 2 * M; i++) { ------------------ | | 7| 350k|#define M (L/4) | | ------------------ | | | | 6| 350k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 350k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (238:17): [True: 350k, False: 561] ------------------ 239| 350k| r[1 * M + i] += P1[i]; ------------------ | | 7| 350k|#define M (L/4) | | ------------------ | | | | 6| 350k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 350k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 240| 350k| r[3 * M + i] += P2[i]; ------------------ | | 7| 350k|#define M (L/4) | | ------------------ | | | | 6| 350k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 350k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 241| 350k| r[5 * M + i] += P3[i]; ------------------ | | 7| 350k|#define M (L/4) | | ------------------ | | | | 6| 350k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 350k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[5 * M + i] += P3[i]; ------------------ | | 224| 350k|#define P3 Pm1 ------------------ 242| 350k| } 243| 561|} poly_rq_mul.c:k2x2_interpolate: 245| 4.23k|static inline void k2x2_interpolate(uint16_t r[2 * M], const uint16_t a[18 * K]) { 246| 4.23k| size_t i; 247| 4.23k| uint16_t tmp[4 * K]; 248| | 249| 669k| for (i = 0; i < 2 * K; i++) { ------------------ | | 8| 669k|#define K (L/16) | | ------------------ | | | | 6| 669k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 669k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (249:17): [True: 665k, False: 4.23k] ------------------ 250| 665k| r[0 * K + i] = a[0 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[0 * K + i] = a[0 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 251| 665k| r[2 * K + i] = a[2 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[2 * K + i] = a[2 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 252| 665k| } 253| | 254| 669k| for (i = 0; i < 2 * K; i++) { ------------------ | | 8| 669k|#define K (L/16) | | ------------------ | | | | 6| 669k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 669k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (254:17): [True: 665k, False: 4.23k] ------------------ 255| 665k| r[1 * K + i] += a[8 * K + i] - a[0 * K + i] - a[2 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[1 * K + i] += a[8 * K + i] - a[0 * K + i] - a[2 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[1 * K + i] += a[8 * K + i] - a[0 * K + i] - a[2 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[1 * K + i] += a[8 * K + i] - a[0 * K + i] - a[2 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 256| 665k| } 257| | 258| 669k| for (i = 0; i < 2 * K; i++) { ------------------ | | 8| 669k|#define K (L/16) | | ------------------ | | | | 6| 669k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 669k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (258:17): [True: 665k, False: 4.23k] ------------------ 259| 665k| r[4 * K + i] = a[4 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[4 * K + i] = a[4 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 260| 665k| r[6 * K + i] = a[6 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[6 * K + i] = a[6 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 261| 665k| } 262| | 263| 669k| for (i = 0; i < 2 * K; i++) { ------------------ | | 8| 669k|#define K (L/16) | | ------------------ | | | | 6| 669k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 669k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (263:17): [True: 665k, False: 4.23k] ------------------ 264| 665k| r[5 * K + i] += a[14 * K + i] - a[4 * K + i] - a[6 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[5 * K + i] += a[14 * K + i] - a[4 * K + i] - a[6 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[5 * K + i] += a[14 * K + i] - a[4 * K + i] - a[6 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[5 * K + i] += a[14 * K + i] - a[4 * K + i] - a[6 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 265| 665k| } 266| | 267| 669k| for (i = 0; i < 2 * K; i++) { ------------------ | | 8| 669k|#define K (L/16) | | ------------------ | | | | 6| 669k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 669k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (267:17): [True: 665k, False: 4.23k] ------------------ 268| 665k| tmp[0 * K + i] = a[12 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[0 * K + i] = a[12 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 269| 665k| tmp[2 * K + i] = a[10 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[2 * K + i] = a[10 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 270| 665k| } 271| | 272| 669k| for (i = 0; i < 2 * K; i++) { ------------------ | | 8| 669k|#define K (L/16) | | ------------------ | | | | 6| 669k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 669k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (272:17): [True: 665k, False: 4.23k] ------------------ 273| 665k| tmp[K + i] += a[16 * K + i] - a[12 * K + i] - a[10 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[K + i] += a[16 * K + i] - a[12 * K + i] - a[10 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[K + i] += a[16 * K + i] - a[12 * K + i] - a[10 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[K + i] += a[16 * K + i] - a[12 * K + i] - a[10 * K + i]; ------------------ | | 8| 665k|#define K (L/16) | | ------------------ | | | | 6| 665k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 665k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 274| 665k| } 275| | 276| 1.33M| for (i = 0; i < 4 * K; i++) { ------------------ | | 8| 1.33M|#define K (L/16) | | ------------------ | | | | 6| 1.33M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 1.33M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (276:17): [True: 1.33M, False: 4.23k] ------------------ 277| 1.33M| tmp[0 * K + i] = tmp[0 * K + i] - r[0 * K + i] - r[4 * K + i]; ------------------ | | 8| 1.33M|#define K (L/16) | | ------------------ | | | | 6| 1.33M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 1.33M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[0 * K + i] = tmp[0 * K + i] - r[0 * K + i] - r[4 * K + i]; ------------------ | | 8| 1.33M|#define K (L/16) | | ------------------ | | | | 6| 1.33M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 1.33M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[0 * K + i] = tmp[0 * K + i] - r[0 * K + i] - r[4 * K + i]; ------------------ | | 8| 1.33M|#define K (L/16) | | ------------------ | | | | 6| 1.33M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 1.33M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[0 * K + i] = tmp[0 * K + i] - r[0 * K + i] - r[4 * K + i]; ------------------ | | 8| 1.33M|#define K (L/16) | | ------------------ | | | | 6| 1.33M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 1.33M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 278| 1.33M| } 279| | 280| 1.33M| for (i = 0; i < 4 * K; i++) { ------------------ | | 8| 1.33M|#define K (L/16) | | ------------------ | | | | 6| 1.33M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 1.33M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (280:17): [True: 1.33M, False: 4.23k] ------------------ 281| 1.33M| r[2 * K + i] += tmp[0 * K + i]; ------------------ | | 8| 1.33M|#define K (L/16) | | ------------------ | | | | 6| 1.33M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 1.33M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[2 * K + i] += tmp[0 * K + i]; ------------------ | | 8| 1.33M|#define K (L/16) | | ------------------ | | | | 6| 1.33M|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 1.33M|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 282| 1.33M| } 283| 4.23k|} poly_s3_inv.c:mod3: 5| 214M|static inline uint8_t mod3(uint8_t a) { /* a between 0 and 9 */ 6| 214M| int16_t t, c; 7| 214M| a = (a >> 2) + (a & 3); /* between 0 and 4 */ 8| 214M| t = a - 3; 9| 214M| c = t >> 5; 10| 214M| return (uint8_t) (t ^ (c & (a ^ t))); 11| 214M|} poly_s3_inv.c:both_negative_mask: 14| 86.5k|static inline int16_t both_negative_mask(int16_t x, int16_t y) { 15| 86.5k| return (x & y) >> 15; 16| 86.5k|} sample_iid.c:mod3: 3| 92.0k|static uint16_t mod3(uint16_t a) { 4| 92.0k| uint16_t r; 5| 92.0k| int16_t t, c; 6| | 7| 92.0k| r = (a >> 8) + (a & 0xff); // r mod 255 == a mod 255 8| 92.0k| r = (r >> 4) + (r & 0xf); // r' mod 15 == r mod 15 9| 92.0k| r = (r >> 2) + (r & 0x3); // r' mod 3 == r mod 3 10| 92.0k| r = (r >> 2) + (r & 0x3); // r' mod 3 == r mod 3 11| | 12| 92.0k| t = r - 3; 13| 92.0k| c = t >> 15; 14| | 15| 92.0k| return (c & r) ^ (~c & t); 16| 92.0k|} PQCLEAN_NTRUHPS2048677_AVX2_cmov: 4| 18|void PQCLEAN_NTRUHPS2048677_AVX2_cmov(unsigned char *r, const unsigned char *x, size_t len, unsigned char b) { 5| 18| size_t i; 6| | 7| 18| b = (~b + 1); 8| 594| for (i = 0; i < len; i++) { ------------------ | Branch (8:17): [True: 576, False: 18] ------------------ 9| 576| r[i] ^= b & (x[i] ^ r[i]); 10| 576| } 11| 18|} PQCLEAN_NTRUHPS2048677_AVX2_crypto_sort_int32: 903| 72|void PQCLEAN_NTRUHPS2048677_AVX2_crypto_sort_int32(int32 *x, size_t n) { 904| 72| size_t q, i, j; 905| | 906| 72| if (n <= 8) { ------------------ | Branch (906:9): [True: 0, False: 72] ------------------ 907| 0| if (n == 8) { ------------------ | Branch (907:13): [True: 0, False: 0] ------------------ 908| 0| int32_MINMAX(&x[0], &x[1]); 909| 0| int32_MINMAX(&x[1], &x[2]); 910| 0| int32_MINMAX(&x[2], &x[3]); 911| 0| int32_MINMAX(&x[3], &x[4]); 912| 0| int32_MINMAX(&x[4], &x[5]); 913| 0| int32_MINMAX(&x[5], &x[6]); 914| 0| int32_MINMAX(&x[6], &x[7]); 915| 0| } 916| 0| if (n >= 7) { ------------------ | Branch (916:13): [True: 0, False: 0] ------------------ 917| 0| int32_MINMAX(&x[0], &x[1]); 918| 0| int32_MINMAX(&x[1], &x[2]); 919| 0| int32_MINMAX(&x[2], &x[3]); 920| 0| int32_MINMAX(&x[3], &x[4]); 921| 0| int32_MINMAX(&x[4], &x[5]); 922| 0| int32_MINMAX(&x[5], &x[6]); 923| 0| } 924| 0| if (n >= 6) { ------------------ | Branch (924:13): [True: 0, False: 0] ------------------ 925| 0| int32_MINMAX(&x[0], &x[1]); 926| 0| int32_MINMAX(&x[1], &x[2]); 927| 0| int32_MINMAX(&x[2], &x[3]); 928| 0| int32_MINMAX(&x[3], &x[4]); 929| 0| int32_MINMAX(&x[4], &x[5]); 930| 0| } 931| 0| if (n >= 5) { ------------------ | Branch (931:13): [True: 0, False: 0] ------------------ 932| 0| int32_MINMAX(&x[0], &x[1]); 933| 0| int32_MINMAX(&x[1], &x[2]); 934| 0| int32_MINMAX(&x[2], &x[3]); 935| 0| int32_MINMAX(&x[3], &x[4]); 936| 0| } 937| 0| if (n >= 4) { ------------------ | Branch (937:13): [True: 0, False: 0] ------------------ 938| 0| int32_MINMAX(&x[0], &x[1]); 939| 0| int32_MINMAX(&x[1], &x[2]); 940| 0| int32_MINMAX(&x[2], &x[3]); 941| 0| } 942| 0| if (n >= 3) { ------------------ | Branch (942:13): [True: 0, False: 0] ------------------ 943| 0| int32_MINMAX(&x[0], &x[1]); 944| 0| int32_MINMAX(&x[1], &x[2]); 945| 0| } 946| 0| if (n >= 2) { ------------------ | Branch (946:13): [True: 0, False: 0] ------------------ 947| 0| int32_MINMAX(&x[0], &x[1]); 948| 0| } 949| 0| return; 950| 0| } 951| | 952| 72| if (!(n & (n - 1))) { ------------------ | Branch (952:9): [True: 0, False: 72] ------------------ 953| 0| int32_sort_2power(x, n, 0); 954| 0| return; 955| 0| } 956| | 957| 72| q = 8; 958| 432| while (q < n - q) { ------------------ | Branch (958:12): [True: 360, False: 72] ------------------ 959| 360| q += q; 960| 360| } 961| | /* n > q >= 8 */ 962| | 963| 72| if (q <= 128) { /* n <= 256 */ ------------------ | Branch (963:9): [True: 36, False: 36] ------------------ 964| 36| int32x8 y[32]; 965| 612| for (i = q >> 3; i < q >> 2; ++i) { ------------------ | Branch (965:26): [True: 576, False: 36] ------------------ 966| 576| y[i] = _mm256_set1_epi32(0x7fffffff); 967| 576| } 968| 5.94k| for (i = 0; i < n; ++i) { ------------------ | Branch (968:21): [True: 5.90k, False: 36] ------------------ 969| 5.90k| ((int32 *) y)[i] = x[i]; 970| 5.90k| } 971| 36| int32_sort_2power((int32 *) y, 2 * q, 0); 972| 5.94k| for (i = 0; i < n; ++i) { ------------------ | Branch (972:21): [True: 5.90k, False: 36] ------------------ 973| 5.90k| x[i] = ((int32 *) y)[i]; 974| 5.90k| } 975| 36| return; 976| 36| } 977| | 978| 36| int32_sort_2power(x, q, 1); 979| 36| PQCLEAN_NTRUHPS2048677_AVX2_crypto_sort_int32(x + q, n - q); 980| | 981| 108| while (q >= 64) { ------------------ | Branch (981:12): [True: 72, False: 36] ------------------ 982| 72| q >>= 2; 983| 72| j = int32_threestages(x, n, q); 984| 72| minmax_vector(x + j, x + j + 4 * q, n - 4 * q - j); 985| 72| if (j + 4 * q <= n) { ------------------ | Branch (985:13): [True: 36, False: 36] ------------------ 986| 612| for (i = j; i < j + q; i += 8) { ------------------ | Branch (986:25): [True: 576, False: 36] ------------------ 987| 576| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 576|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 988| 576| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 576|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 989| 576| int32x8 x2 = int32x8_load(&x[i + 2 * q]); ------------------ | | 9| 576|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 990| 576| int32x8 x3 = int32x8_load(&x[i + 3 * q]); ------------------ | | 9| 576|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 991| 576| int32x8_MINMAX(x0, x2); ------------------ | | 15| 576| do { \ | | 16| 576| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 576|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 576| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 576|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 576| (a) = c; \ | | 19| 576| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 576] | | ------------------ ------------------ 992| 576| int32x8_MINMAX(x1, x3); ------------------ | | 15| 576| do { \ | | 16| 576| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 576|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 576| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 576|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 576| (a) = c; \ | | 19| 576| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 576] | | ------------------ ------------------ 993| 576| int32x8_MINMAX(x0, x1); ------------------ | | 15| 576| do { \ | | 16| 576| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 576|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 576| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 576|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 576| (a) = c; \ | | 19| 576| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 576] | | ------------------ ------------------ 994| 576| int32x8_MINMAX(x2, x3); ------------------ | | 15| 576| do { \ | | 16| 576| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 576|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 576| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 576|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 576| (a) = c; \ | | 19| 576| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 576] | | ------------------ ------------------ 995| 576| int32x8_store(&x[i], x0); ------------------ | | 10| 576|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 996| 576| int32x8_store(&x[i + q], x1); ------------------ | | 10| 576|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 997| 576| int32x8_store(&x[i + 2 * q], x2); ------------------ | | 10| 576|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 998| 576| int32x8_store(&x[i + 3 * q], x3); ------------------ | | 10| 576|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 999| 576| } 1000| 36| j += 4 * q; 1001| 36| } 1002| 72| minmax_vector(x + j, x + j + 2 * q, n - 2 * q - j); 1003| 72| if (j + 2 * q <= n) { ------------------ | Branch (1003:13): [True: 36, False: 36] ------------------ 1004| 108| for (i = j; i < j + q; i += 8) { ------------------ | Branch (1004:25): [True: 72, False: 36] ------------------ 1005| 72| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 72|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1006| 72| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 72|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1007| 72| int32x8_MINMAX(x0, x1); ------------------ | | 15| 72| do { \ | | 16| 72| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 72|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 72| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 72|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 72| (a) = c; \ | | 19| 72| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 72] | | ------------------ ------------------ 1008| 72| int32x8_store(&x[i], x0); ------------------ | | 10| 72|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1009| 72| int32x8_store(&x[i + q], x1); ------------------ | | 10| 72|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1010| 72| } 1011| 36| j += 2 * q; 1012| 36| } 1013| 72| minmax_vector(x + j, x + j + q, n - q - j); 1014| 72| q >>= 1; 1015| 72| } 1016| 36| if (q == 32) { ------------------ | Branch (1016:9): [True: 0, False: 36] ------------------ 1017| 0| j = 0; 1018| 0| for (; j + 64 <= n; j += 64) { ------------------ | Branch (1018:16): [True: 0, False: 0] ------------------ 1019| 0| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1020| 0| int32x8 x1 = int32x8_load(&x[j + 8]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1021| 0| int32x8 x2 = int32x8_load(&x[j + 16]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1022| 0| int32x8 x3 = int32x8_load(&x[j + 24]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1023| 0| int32x8 x4 = int32x8_load(&x[j + 32]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1024| 0| int32x8 x5 = int32x8_load(&x[j + 40]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1025| 0| int32x8 x6 = int32x8_load(&x[j + 48]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1026| 0| int32x8 x7 = int32x8_load(&x[j + 56]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1027| 0| int32x8_MINMAX(x0, x4); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1028| 0| int32x8_MINMAX(x1, x5); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1029| 0| int32x8_MINMAX(x2, x6); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1030| 0| int32x8_MINMAX(x3, x7); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1031| 0| int32x8_MINMAX(x0, x2); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1032| 0| int32x8_MINMAX(x1, x3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1033| 0| int32x8_MINMAX(x4, x6); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1034| 0| int32x8_MINMAX(x5, x7); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1035| 0| int32x8_MINMAX(x0, x1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1036| 0| int32x8_MINMAX(x2, x3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1037| 0| int32x8_MINMAX(x4, x5); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1038| 0| int32x8_MINMAX(x6, x7); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1039| 0| int32x8 a0 = _mm256_permute2x128_si256(x0, x1, 0x20); 1040| 0| int32x8 a1 = _mm256_permute2x128_si256(x0, x1, 0x31); 1041| 0| int32x8 a2 = _mm256_permute2x128_si256(x2, x3, 0x20); 1042| 0| int32x8 a3 = _mm256_permute2x128_si256(x2, x3, 0x31); 1043| 0| int32x8 a4 = _mm256_permute2x128_si256(x4, x5, 0x20); 1044| 0| int32x8 a5 = _mm256_permute2x128_si256(x4, x5, 0x31); 1045| 0| int32x8 a6 = _mm256_permute2x128_si256(x6, x7, 0x20); 1046| 0| int32x8 a7 = _mm256_permute2x128_si256(x6, x7, 0x31); 1047| 0| int32x8_MINMAX(a0, a1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1048| 0| int32x8_MINMAX(a2, a3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1049| 0| int32x8_MINMAX(a4, a5); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1050| 0| int32x8_MINMAX(a6, a7); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1051| 0| int32x8 b0 = _mm256_permute2x128_si256(a0, a1, 0x20); 1052| 0| int32x8 b1 = _mm256_permute2x128_si256(a0, a1, 0x31); 1053| 0| int32x8 b2 = _mm256_permute2x128_si256(a2, a3, 0x20); 1054| 0| int32x8 b3 = _mm256_permute2x128_si256(a2, a3, 0x31); 1055| 0| int32x8 b4 = _mm256_permute2x128_si256(a4, a5, 0x20); 1056| 0| int32x8 b5 = _mm256_permute2x128_si256(a4, a5, 0x31); 1057| 0| int32x8 b6 = _mm256_permute2x128_si256(a6, a7, 0x20); 1058| 0| int32x8 b7 = _mm256_permute2x128_si256(a6, a7, 0x31); 1059| 0| int32x8 c0 = _mm256_unpacklo_epi64(b0, b1); 1060| 0| int32x8 c1 = _mm256_unpackhi_epi64(b0, b1); 1061| 0| int32x8 c2 = _mm256_unpacklo_epi64(b2, b3); 1062| 0| int32x8 c3 = _mm256_unpackhi_epi64(b2, b3); 1063| 0| int32x8 c4 = _mm256_unpacklo_epi64(b4, b5); 1064| 0| int32x8 c5 = _mm256_unpackhi_epi64(b4, b5); 1065| 0| int32x8 c6 = _mm256_unpacklo_epi64(b6, b7); 1066| 0| int32x8 c7 = _mm256_unpackhi_epi64(b6, b7); 1067| 0| int32x8_MINMAX(c0, c1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1068| 0| int32x8_MINMAX(c2, c3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1069| 0| int32x8_MINMAX(c4, c5); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1070| 0| int32x8_MINMAX(c6, c7); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1071| 0| int32x8 d0 = _mm256_unpacklo_epi32(c0, c1); 1072| 0| int32x8 d1 = _mm256_unpackhi_epi32(c0, c1); 1073| 0| int32x8 d2 = _mm256_unpacklo_epi32(c2, c3); 1074| 0| int32x8 d3 = _mm256_unpackhi_epi32(c2, c3); 1075| 0| int32x8 d4 = _mm256_unpacklo_epi32(c4, c5); 1076| 0| int32x8 d5 = _mm256_unpackhi_epi32(c4, c5); 1077| 0| int32x8 d6 = _mm256_unpacklo_epi32(c6, c7); 1078| 0| int32x8 d7 = _mm256_unpackhi_epi32(c6, c7); 1079| 0| int32x8 e0 = _mm256_unpacklo_epi64(d0, d1); 1080| 0| int32x8 e1 = _mm256_unpackhi_epi64(d0, d1); 1081| 0| int32x8 e2 = _mm256_unpacklo_epi64(d2, d3); 1082| 0| int32x8 e3 = _mm256_unpackhi_epi64(d2, d3); 1083| 0| int32x8 e4 = _mm256_unpacklo_epi64(d4, d5); 1084| 0| int32x8 e5 = _mm256_unpackhi_epi64(d4, d5); 1085| 0| int32x8 e6 = _mm256_unpacklo_epi64(d6, d7); 1086| 0| int32x8 e7 = _mm256_unpackhi_epi64(d6, d7); 1087| 0| int32x8_MINMAX(e0, e1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1088| 0| int32x8_MINMAX(e2, e3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1089| 0| int32x8_MINMAX(e4, e5); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1090| 0| int32x8_MINMAX(e6, e7); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1091| 0| int32x8 f0 = _mm256_unpacklo_epi32(e0, e1); 1092| 0| int32x8 f1 = _mm256_unpackhi_epi32(e0, e1); 1093| 0| int32x8 f2 = _mm256_unpacklo_epi32(e2, e3); 1094| 0| int32x8 f3 = _mm256_unpackhi_epi32(e2, e3); 1095| 0| int32x8 f4 = _mm256_unpacklo_epi32(e4, e5); 1096| 0| int32x8 f5 = _mm256_unpackhi_epi32(e4, e5); 1097| 0| int32x8 f6 = _mm256_unpacklo_epi32(e6, e7); 1098| 0| int32x8 f7 = _mm256_unpackhi_epi32(e6, e7); 1099| 0| int32x8_store(&x[j], f0); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1100| 0| int32x8_store(&x[j + 8], f1); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1101| 0| int32x8_store(&x[j + 16], f2); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1102| 0| int32x8_store(&x[j + 24], f3); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1103| 0| int32x8_store(&x[j + 32], f4); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1104| 0| int32x8_store(&x[j + 40], f5); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1105| 0| int32x8_store(&x[j + 48], f6); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1106| 0| int32x8_store(&x[j + 56], f7); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1107| 0| } 1108| 0| minmax_vector(x + j, x + j + 32, n - 32 - j); 1109| 0| goto continue16; 1110| 0| } 1111| 36| if (q == 16) { ------------------ | Branch (1111:9): [True: 0, False: 36] ------------------ 1112| 0| j = 0; 1113| 0|continue16: 1114| 0| for (; j + 32 <= n; j += 32) { ------------------ | Branch (1114:16): [True: 0, False: 0] ------------------ 1115| 0| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1116| 0| int32x8 x1 = int32x8_load(&x[j + 8]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1117| 0| int32x8 x2 = int32x8_load(&x[j + 16]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1118| 0| int32x8 x3 = int32x8_load(&x[j + 24]); ------------------ | | 9| 0|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1119| 0| int32x8_MINMAX(x0, x2); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1120| 0| int32x8_MINMAX(x1, x3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1121| 0| int32x8_MINMAX(x0, x1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1122| 0| int32x8_MINMAX(x2, x3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1123| 0| int32x8 a0 = _mm256_permute2x128_si256(x0, x1, 0x20); 1124| 0| int32x8 a1 = _mm256_permute2x128_si256(x0, x1, 0x31); 1125| 0| int32x8 a2 = _mm256_permute2x128_si256(x2, x3, 0x20); 1126| 0| int32x8 a3 = _mm256_permute2x128_si256(x2, x3, 0x31); 1127| 0| int32x8_MINMAX(a0, a1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1128| 0| int32x8_MINMAX(a2, a3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1129| 0| int32x8 b0 = _mm256_permute2x128_si256(a0, a1, 0x20); 1130| 0| int32x8 b1 = _mm256_permute2x128_si256(a0, a1, 0x31); 1131| 0| int32x8 b2 = _mm256_permute2x128_si256(a2, a3, 0x20); 1132| 0| int32x8 b3 = _mm256_permute2x128_si256(a2, a3, 0x31); 1133| 0| int32x8 c0 = _mm256_unpacklo_epi64(b0, b1); 1134| 0| int32x8 c1 = _mm256_unpackhi_epi64(b0, b1); 1135| 0| int32x8 c2 = _mm256_unpacklo_epi64(b2, b3); 1136| 0| int32x8 c3 = _mm256_unpackhi_epi64(b2, b3); 1137| 0| int32x8_MINMAX(c0, c1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1138| 0| int32x8_MINMAX(c2, c3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1139| 0| int32x8 d0 = _mm256_unpacklo_epi32(c0, c1); 1140| 0| int32x8 d1 = _mm256_unpackhi_epi32(c0, c1); 1141| 0| int32x8 d2 = _mm256_unpacklo_epi32(c2, c3); 1142| 0| int32x8 d3 = _mm256_unpackhi_epi32(c2, c3); 1143| 0| int32x8 e0 = _mm256_unpacklo_epi64(d0, d1); 1144| 0| int32x8 e1 = _mm256_unpackhi_epi64(d0, d1); 1145| 0| int32x8 e2 = _mm256_unpacklo_epi64(d2, d3); 1146| 0| int32x8 e3 = _mm256_unpackhi_epi64(d2, d3); 1147| 0| int32x8_MINMAX(e0, e1); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1148| 0| int32x8_MINMAX(e2, e3); ------------------ | | 15| 0| do { \ | | 16| 0| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 0|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 0| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 0|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 0| (a) = c; \ | | 19| 0| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 0] | | ------------------ ------------------ 1149| 0| int32x8 f0 = _mm256_unpacklo_epi32(e0, e1); 1150| 0| int32x8 f1 = _mm256_unpackhi_epi32(e0, e1); 1151| 0| int32x8 f2 = _mm256_unpacklo_epi32(e2, e3); 1152| 0| int32x8 f3 = _mm256_unpackhi_epi32(e2, e3); 1153| 0| int32x8_store(&x[j], f0); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1154| 0| int32x8_store(&x[j + 8], f1); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1155| 0| int32x8_store(&x[j + 16], f2); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1156| 0| int32x8_store(&x[j + 24], f3); ------------------ | | 10| 0|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1157| 0| } 1158| 0| minmax_vector(x + j, x + j + 16, n - 16 - j); 1159| 0| goto continue8; 1160| 0| } 1161| | /* q == 8 */ 1162| 36| j = 0; 1163| 36|continue8: 1164| 1.54k| for (; j + 16 <= n; j += 16) { ------------------ | Branch (1164:12): [True: 1.51k, False: 36] ------------------ 1165| 1.51k| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 1.51k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1166| 1.51k| int32x8 x1 = int32x8_load(&x[j + 8]); ------------------ | | 9| 1.51k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1167| 1.51k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 1.51k| do { \ | | 16| 1.51k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.51k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.51k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.51k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.51k| (a) = c; \ | | 19| 1.51k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.51k] | | ------------------ ------------------ 1168| 1.51k| int32x8_store(&x[j], x0); ------------------ | | 10| 1.51k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1169| 1.51k| int32x8_store(&x[j + 8], x1); ------------------ | | 10| 1.51k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1170| 1.51k| int32x8 a0 = _mm256_permute2x128_si256(x0, x1, 0x20); /* x0123y0123 */ 1171| 1.51k| int32x8 a1 = _mm256_permute2x128_si256(x0, x1, 0x31); /* x4567y4567 */ 1172| 1.51k| int32x8_MINMAX(a0, a1); ------------------ | | 15| 1.51k| do { \ | | 16| 1.51k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.51k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.51k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.51k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.51k| (a) = c; \ | | 19| 1.51k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.51k] | | ------------------ ------------------ 1173| 1.51k| int32x8 b0 = _mm256_permute2x128_si256(a0, a1, 0x20); /* x01234567 */ 1174| 1.51k| int32x8 b1 = _mm256_permute2x128_si256(a0, a1, 0x31); /* y01234567 */ 1175| 1.51k| int32x8 c0 = _mm256_unpacklo_epi64(b0, b1); /* x01y01x45y45 */ 1176| 1.51k| int32x8 c1 = _mm256_unpackhi_epi64(b0, b1); /* x23y23x67y67 */ 1177| 1.51k| int32x8_MINMAX(c0, c1); ------------------ | | 15| 1.51k| do { \ | | 16| 1.51k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.51k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.51k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.51k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.51k| (a) = c; \ | | 19| 1.51k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.51k] | | ------------------ ------------------ 1178| 1.51k| int32x8 d0 = _mm256_unpacklo_epi32(c0, c1); /* x02x13x46x57 */ 1179| 1.51k| int32x8 d1 = _mm256_unpackhi_epi32(c0, c1); /* y02y13y46y57 */ 1180| 1.51k| int32x8 e0 = _mm256_unpacklo_epi64(d0, d1); /* x02y02x46y46 */ 1181| 1.51k| int32x8 e1 = _mm256_unpackhi_epi64(d0, d1); /* x13y13x57y57 */ 1182| 1.51k| int32x8_MINMAX(e0, e1); ------------------ | | 15| 1.51k| do { \ | | 16| 1.51k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 1.51k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 1.51k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 1.51k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 1.51k| (a) = c; \ | | 19| 1.51k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 1.51k] | | ------------------ ------------------ 1183| 1.51k| int32x8 f0 = _mm256_unpacklo_epi32(e0, e1); /* x01234567 */ 1184| 1.51k| int32x8 f1 = _mm256_unpackhi_epi32(e0, e1); /* y01234567 */ 1185| 1.51k| int32x8_store(&x[j], f0); ------------------ | | 10| 1.51k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1186| 1.51k| int32x8_store(&x[j + 8], f1); ------------------ | | 10| 1.51k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1187| 1.51k| } 1188| 36| minmax_vector(x + j, x + j + 8, n - 8 - j); 1189| 36| if (j + 8 <= n) { ------------------ | Branch (1189:9): [True: 0, False: 36] ------------------ 1190| 0| int32_MINMAX(&x[j], &x[j + 4]); 1191| 0| int32_MINMAX(&x[j + 1], &x[j + 5]); 1192| 0| int32_MINMAX(&x[j + 2], &x[j + 6]); 1193| 0| int32_MINMAX(&x[j + 3], &x[j + 7]); 1194| 0| int32_MINMAX(&x[j], &x[j + 2]); 1195| 0| int32_MINMAX(&x[j + 1], &x[j + 3]); 1196| 0| int32_MINMAX(&x[j], &x[j + 1]); 1197| 0| int32_MINMAX(&x[j + 2], &x[j + 3]); 1198| 0| int32_MINMAX(&x[j + 4], &x[j + 6]); 1199| 0| int32_MINMAX(&x[j + 5], &x[j + 7]); 1200| 0| int32_MINMAX(&x[j + 4], &x[j + 5]); 1201| 0| int32_MINMAX(&x[j + 6], &x[j + 7]); 1202| 0| j += 8; 1203| 0| } 1204| 36| minmax_vector(x + j, x + j + 4, n - 4 - j); 1205| 36| if (j + 4 <= n) { ------------------ | Branch (1205:9): [True: 36, False: 0] ------------------ 1206| 36| int32_MINMAX(&x[j], &x[j + 2]); 1207| 36| int32_MINMAX(&x[j + 1], &x[j + 3]); 1208| 36| int32_MINMAX(&x[j], &x[j + 1]); 1209| 36| int32_MINMAX(&x[j + 2], &x[j + 3]); 1210| 36| j += 4; 1211| 36| } 1212| 36| if (j + 3 <= n) { ------------------ | Branch (1212:9): [True: 0, False: 36] ------------------ 1213| 0| int32_MINMAX(&x[j], &x[j + 2]); 1214| 0| } 1215| 36| if (j + 2 <= n) { ------------------ | Branch (1215:9): [True: 0, False: 36] ------------------ 1216| 0| int32_MINMAX(&x[j], &x[j + 1]); 1217| 0| } 1218| 36|} PQCLEAN_NTRUHPS2048677_AVX2_crypto_kem_keypair: 10| 18|int PQCLEAN_NTRUHPS2048677_AVX2_crypto_kem_keypair(uint8_t *pk, uint8_t *sk) { 11| 18| uint8_t seed[NTRU_SAMPLE_FG_BYTES]; 12| | 13| 18| randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 8| 18|#define randombytes OQS_randombytes ------------------ randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 22| 18|#define NTRU_SAMPLE_FG_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 20| 18|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 18|#define NTRU_N 677 | | | | ------------------ | | ------------------ | | #define NTRU_SAMPLE_FG_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 21| 18|#define NTRU_SAMPLE_FT_BYTES ((30*(NTRU_N-1)+7)/8) | | | | ------------------ | | | | | | 5| 18|#define NTRU_N 677 | | | | ------------------ | | ------------------ ------------------ 14| 18| PQCLEAN_NTRUHPS2048677_AVX2_owcpa_keypair(pk, sk, seed); 15| | 16| 18| randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 8| 18|#define randombytes OQS_randombytes ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 30| 18|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 26| 18|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 18|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 18|#define NTRU_N 677 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 29| 18|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 18|#define NTRU_LOGQ 11 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 18|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 18|#define NTRU_N 677 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 17| 18|#define NTRU_PRFKEYBYTES 32 ------------------ 17| | 18| 18| return 0; 19| 18|} PQCLEAN_NTRUHPS2048677_AVX2_crypto_kem_enc: 21| 18|int PQCLEAN_NTRUHPS2048677_AVX2_crypto_kem_enc(uint8_t *c, uint8_t *k, const uint8_t *pk) { 22| 18| poly r, m; 23| 18| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 24| 18| uint8_t rm_seed[NTRU_SAMPLE_RM_BYTES]; 25| | 26| 18| randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 8| 18|#define randombytes OQS_randombytes ------------------ randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 23| 18|#define NTRU_SAMPLE_RM_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 20| 18|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 18|#define NTRU_N 677 | | | | ------------------ | | ------------------ | | #define NTRU_SAMPLE_RM_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 21| 18|#define NTRU_SAMPLE_FT_BYTES ((30*(NTRU_N-1)+7)/8) | | | | ------------------ | | | | | | 5| 18|#define NTRU_N 677 | | | | ------------------ | | ------------------ ------------------ 27| | 28| 18| PQCLEAN_NTRUHPS2048677_AVX2_sample_rm(&r, &m, rm_seed); 29| | 30| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_tobytes(rm, &r); 31| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, &m); ------------------ | | 26| 18|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 18|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 18|#define NTRU_N 677 | | | | ------------------ | | ------------------ ------------------ 32| 18| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 18|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 28| 18|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 26| 18|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 18|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 18|#define NTRU_N 677 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 33| | 34| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_Z3_to_Zq(&r); 35| 18| PQCLEAN_NTRUHPS2048677_AVX2_owcpa_enc(c, &r, &m, pk); 36| | 37| 18| return 0; 38| 18|} PQCLEAN_NTRUHPS2048677_AVX2_crypto_kem_dec: 40| 18|int PQCLEAN_NTRUHPS2048677_AVX2_crypto_kem_dec(uint8_t *k, const uint8_t *c, const uint8_t *sk) { 41| 18| int i, fail; 42| 18| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 43| 18| uint8_t buf[NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES]; 44| | 45| 18| fail = PQCLEAN_NTRUHPS2048677_AVX2_owcpa_dec(rm, c, sk); 46| | /* If fail = 0 then c = Enc(h, rm). There is no need to re-encapsulate. */ 47| | /* See comment in PQCLEAN_NTRUHPS2048677_AVX2_owcpa_dec for details. */ 48| | 49| 18| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 18|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 28| 18|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 26| 18|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 18|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 18|#define NTRU_N 677 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 50| | 51| | /* shake(secret PRF key || input ciphertext) */ 52| 594| for (i = 0; i < NTRU_PRFKEYBYTES; i++) { ------------------ | | 17| 594|#define NTRU_PRFKEYBYTES 32 ------------------ | Branch (52:17): [True: 576, False: 18] ------------------ 53| 576| buf[i] = sk[i + NTRU_OWCPA_SECRETKEYBYTES]; ------------------ | | 30| 576|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 26| 576|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 576|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 576|#define NTRU_N 677 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 29| 576|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 576|#define NTRU_LOGQ 11 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 576|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 576|#define NTRU_N 677 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 576| } 55| 16.7k| for (i = 0; i < NTRU_CIPHERTEXTBYTES; i++) { ------------------ | | 35| 16.7k|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 31| 16.7k|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 16.7k|#define NTRU_LOGQ 11 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 16.7k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 16.7k|#define NTRU_N 677 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (55:17): [True: 16.7k, False: 18] ------------------ 56| 16.7k| buf[NTRU_PRFKEYBYTES + i] = c[i]; ------------------ | | 17| 16.7k|#define NTRU_PRFKEYBYTES 32 ------------------ 57| 16.7k| } 58| 18| sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 15| 18|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 17| 18|#define NTRU_PRFKEYBYTES 32 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 35| 18|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 31| 18|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 18|#define NTRU_LOGQ 11 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 18|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 18|#define NTRU_N 677 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 59| | 60| 18| PQCLEAN_NTRUHPS2048677_AVX2_cmov(k, rm, NTRU_SHAREDKEYBYTES, (unsigned char) fail); ------------------ | | 18| 18|#define NTRU_SHAREDKEYBYTES 32 ------------------ 61| | 62| 18| return 0; 63| 18|} PQCLEAN_NTRUHPS2048677_AVX2_owcpa_keypair: 62| 18| const unsigned char seed[NTRU_SAMPLE_FG_BYTES]) { 63| 18| int i; 64| | 65| 18| poly x1, x2, x3, x4, x5; 66| | 67| 18| poly *f = &x1, *g = &x2, *invf_mod3 = &x3; 68| 18| poly *gf = &x3, *invgf = &x4, *tmp = &x5; 69| 18| poly *invh = &x3, *h = &x3; 70| | 71| 18| PQCLEAN_NTRUHPS2048677_AVX2_sample_fg(f, g, seed); 72| | 73| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_inv(invf_mod3, f); 74| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_tobytes(sk, f); 75| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_tobytes(sk + NTRU_PACK_TRINARY_BYTES, invf_mod3); ------------------ | | 26| 18|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 18|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 18|#define NTRU_N 677 | | | | ------------------ | | ------------------ ------------------ 76| | 77| | /* Lift coeffs of f and g from Z_p to Z_q */ 78| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_Z3_to_Zq(f); 79| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_Z3_to_Zq(g); 80| | 81| | 82| | /* g = 3*g */ 83| 12.2k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 12.2k|#define NTRU_N 677 ------------------ | Branch (83:17): [True: 12.1k, False: 18] ------------------ 84| 12.1k| g->coeffs[i] = 3 * g->coeffs[i]; 85| 12.1k| } 86| | 87| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(gf, g, f); 88| | 89| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_inv(invgf, gf); 90| | 91| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(tmp, invgf, f); 92| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_mul(invh, tmp, f); 93| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_tobytes(sk + 2 * NTRU_PACK_TRINARY_BYTES, invh); ------------------ | | 26| 18|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 18|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 18|#define NTRU_N 677 | | | | ------------------ | | ------------------ ------------------ 94| | 95| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(tmp, invgf, g); 96| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(h, tmp, g); 97| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_sum_zero_tobytes(pk, h); 98| 18|} PQCLEAN_NTRUHPS2048677_AVX2_owcpa_enc: 104| 18| const unsigned char *pk) { 105| 18| int i; 106| 18| poly x1, x2; 107| 18| poly *h = &x1, *liftm = &x1; 108| 18| poly *ct = &x2; 109| | 110| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_sum_zero_frombytes(h, pk); 111| | 112| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(ct, r, h); 113| | 114| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_lift(liftm, m); 115| 12.2k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 12.2k|#define NTRU_N 677 ------------------ | Branch (115:17): [True: 12.1k, False: 18] ------------------ 116| 12.1k| ct->coeffs[i] = ct->coeffs[i] + liftm->coeffs[i]; 117| 12.1k| } 118| | 119| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_sum_zero_tobytes(c, ct); 120| 18|} PQCLEAN_NTRUHPS2048677_AVX2_owcpa_dec: 124| 18| const unsigned char *secretkey) { 125| 18| int i; 126| 18| int fail; 127| 18| poly x1, x2, x3, x4; 128| | 129| 18| poly *c = &x1, *f = &x2, *cf = &x3; 130| 18| poly *mf = &x2, *finv3 = &x3, *m = &x4; 131| 18| poly *liftm = &x2, *invh = &x3, *r = &x4; 132| 18| poly *b = &x1; 133| | 134| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_sum_zero_frombytes(c, ciphertext); 135| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_frombytes(f, secretkey); 136| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_Z3_to_Zq(f); 137| | 138| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(cf, c, f); 139| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_to_S3(mf, cf); 140| | 141| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_frombytes(finv3, secretkey + NTRU_PACK_TRINARY_BYTES); ------------------ | | 26| 18|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 18|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 18|#define NTRU_N 677 | | | | ------------------ | | ------------------ ------------------ 142| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_mul(m, mf, finv3); 143| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, m); ------------------ | | 26| 18|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 18|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 18|#define NTRU_N 677 | | | | ------------------ | | ------------------ ------------------ 144| | 145| 18| fail = 0; 146| | 147| | /* Check that the unused bits of the last byte of the ciphertext are zero */ 148| 18| fail |= owcpa_check_ciphertext(ciphertext); 149| | 150| | /* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */ 151| | /* We can avoid re-computing r*h + Lift(m) as long as we check that */ 152| | /* r (defined as b/h mod (q, Phi_n)) and m are in the message space. */ 153| | /* (m can take any value in S3 in NTRU_HRSS) */ 154| 18| fail |= owcpa_check_m(m); 155| | 156| | /* b = c - Lift(m) mod (q, x^n - 1) */ 157| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_lift(liftm, m); 158| 12.2k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 12.2k|#define NTRU_N 677 ------------------ | Branch (158:17): [True: 12.1k, False: 18] ------------------ 159| 12.1k| b->coeffs[i] = c->coeffs[i] - liftm->coeffs[i]; 160| 12.1k| } 161| | 162| | /* r = b / h mod (q, Phi_n) */ 163| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_frombytes(invh, secretkey + 2 * NTRU_PACK_TRINARY_BYTES); ------------------ | | 26| 18|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 18|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 18|#define NTRU_N 677 | | | | ------------------ | | ------------------ ------------------ 164| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_mul(r, b, invh); 165| | 166| | /* NOTE: Our definition of r as b/h mod (q, Phi_n) follows Figure 4 of */ 167| | /* [Sch18] https://eprint.iacr.org/2018/1174/20181203:032458. */ 168| | /* This differs from Figure 10 of Saito--Xagawa--Yamakawa */ 169| | /* [SXY17] https://eprint.iacr.org/2017/1005/20180516:055500 */ 170| | /* where r gets a final reduction modulo p. */ 171| | /* We need this change to use Proposition 1 of [Sch18]. */ 172| | 173| | /* Proposition 1 of [Sch18] shows that re-encryption with (r,m) yields c. */ 174| | /* if and only if fail==0 after the following call to owcpa_check_r */ 175| | /* The procedure given in Fig. 8 of [Sch18] can be skipped because we have */ 176| | /* c(1) = 0 due to the use of poly_Rq_sum_zero_{to,from}bytes. */ 177| 18| fail |= owcpa_check_r(r); 178| | 179| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_trinary_Zq_to_Z3(r); 180| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_tobytes(rm, r); 181| | 182| 18| return fail; 183| 18|} PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_tobytes: 3| 108|void PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_tobytes(unsigned char msg[NTRU_PACK_TRINARY_BYTES], const poly *a) { 4| 108| int i; 5| 108| unsigned char c; 6| 108| int j; 7| | 8| 14.6k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 25| 14.6k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 14.6k|#define NTRU_N 677 | | ------------------ ------------------ | Branch (8:17): [True: 14.5k, False: 108] ------------------ 9| 14.5k| c = a->coeffs[5 * i + 4] & 255; 10| 14.5k| c = (3 * c + a->coeffs[5 * i + 3]) & 255; 11| 14.5k| c = (3 * c + a->coeffs[5 * i + 2]) & 255; 12| 14.5k| c = (3 * c + a->coeffs[5 * i + 1]) & 255; 13| 14.5k| c = (3 * c + a->coeffs[5 * i + 0]) & 255; 14| 14.5k| msg[i] = c; 15| 14.5k| } 16| 108| i = NTRU_PACK_DEG / 5; ------------------ | | 25| 108|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 108|#define NTRU_N 677 | | ------------------ ------------------ 17| 108| c = 0; 18| 216| for (j = NTRU_PACK_DEG - (5 * i) - 1; j >= 0; j--) { ------------------ | | 25| 108|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 108|#define NTRU_N 677 | | ------------------ ------------------ | Branch (18:43): [True: 108, False: 108] ------------------ 19| 108| c = (3 * c + a->coeffs[5 * i + j]) & 255; 20| 108| } 21| 108| msg[i] = c; 22| 108|} PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_frombytes: 24| 36|void PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_frombytes(poly *r, const unsigned char msg[NTRU_PACK_TRINARY_BYTES]) { 25| 36| int i; 26| 36| unsigned char c; 27| 36| int j; 28| | 29| 4.89k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 25| 4.89k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 4.89k|#define NTRU_N 677 | | ------------------ ------------------ | Branch (29:17): [True: 4.86k, False: 36] ------------------ 30| 4.86k| c = msg[i]; 31| 4.86k| r->coeffs[5 * i + 0] = c; 32| 4.86k| r->coeffs[5 * i + 1] = c * 171 >> 9; // this is division by 3 33| 4.86k| r->coeffs[5 * i + 2] = c * 57 >> 9; // division by 3^2 34| 4.86k| r->coeffs[5 * i + 3] = c * 19 >> 9; // division by 3^3 35| 4.86k| r->coeffs[5 * i + 4] = c * 203 >> 14; // etc. 36| 4.86k| } 37| 36| i = NTRU_PACK_DEG / 5; ------------------ | | 25| 36|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 36|#define NTRU_N 677 | | ------------------ ------------------ 38| 36| c = msg[i]; 39| 72| for (j = 0; (5 * i + j) < NTRU_PACK_DEG; j++) { ------------------ | | 25| 72|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 72|#define NTRU_N 677 | | ------------------ ------------------ | Branch (39:17): [True: 36, False: 36] ------------------ 40| 36| r->coeffs[5 * i + j] = c; 41| 36| c = c * 171 >> 9; 42| 36| } 43| 36| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 36|#define NTRU_N 677 ------------------ 44| 36| PQCLEAN_NTRUHPS2048677_AVX2_poly_mod_3_Phi_n(r); 45| 36|} PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_tobytes: 3| 54|void PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_tobytes(unsigned char *r, const poly *a) { 4| 54| int i, j; 5| 54| uint16_t t[8]; 6| | 7| 4.59k| for (i = 0; i < NTRU_PACK_DEG / 8; i++) { ------------------ | | 25| 4.59k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 4.59k|#define NTRU_N 677 | | ------------------ ------------------ | Branch (7:17): [True: 4.53k, False: 54] ------------------ 8| 40.8k| for (j = 0; j < 8; j++) { ------------------ | Branch (8:21): [True: 36.2k, False: 4.53k] ------------------ 9| 36.2k| t[j] = MODQ(a->coeffs[8 * i + j]); ------------------ | | 9| 36.2k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 36.2k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 36.2k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ 10| 36.2k| } 11| | 12| 4.53k| r[11 * i + 0] = (unsigned char) ( t[0] & 0xff); 13| 4.53k| r[11 * i + 1] = (unsigned char) ((t[0] >> 8) | ((t[1] & 0x1f) << 3)); 14| 4.53k| r[11 * i + 2] = (unsigned char) ((t[1] >> 5) | ((t[2] & 0x03) << 6)); 15| 4.53k| r[11 * i + 3] = (unsigned char) ((t[2] >> 2) & 0xff); 16| 4.53k| r[11 * i + 4] = (unsigned char) ((t[2] >> 10) | ((t[3] & 0x7f) << 1)); 17| 4.53k| r[11 * i + 5] = (unsigned char) ((t[3] >> 7) | ((t[4] & 0x0f) << 4)); 18| 4.53k| r[11 * i + 6] = (unsigned char) ((t[4] >> 4) | ((t[5] & 0x01) << 7)); 19| 4.53k| r[11 * i + 7] = (unsigned char) ((t[5] >> 1) & 0xff); 20| 4.53k| r[11 * i + 8] = (unsigned char) ((t[5] >> 9) | ((t[6] & 0x3f) << 2)); 21| 4.53k| r[11 * i + 9] = (unsigned char) ((t[6] >> 6) | ((t[7] & 0x07) << 5)); 22| 4.53k| r[11 * i + 10] = (unsigned char) ((t[7] >> 3)); 23| 4.53k| } 24| | 25| 270| for (j = 0; j < NTRU_PACK_DEG - 8 * i; j++) { ------------------ | | 25| 270|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 270|#define NTRU_N 677 | | ------------------ ------------------ | Branch (25:17): [True: 216, False: 54] ------------------ 26| 216| t[j] = MODQ(a->coeffs[8 * i + j]); ------------------ | | 9| 216|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 216|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 216|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ 27| 216| } 28| 270| for (; j < 8; j++) { ------------------ | Branch (28:12): [True: 216, False: 54] ------------------ 29| 216| t[j] = 0; 30| 216| } 31| | 32| 54| switch (NTRU_PACK_DEG & 0x07) { ------------------ | | 25| 54|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 54|#define NTRU_N 677 | | ------------------ ------------------ | Branch (32:13): [True: 54, Folded] ------------------ 33| | // cases 0 and 6 are impossible since 2 generates (Z/n)* and 34| | // p mod 8 in {1, 7} implies that 2 is a quadratic residue. 35| 54| case 4: ------------------ | Branch (35:5): [True: 54, False: 0] ------------------ 36| 54| r[11 * i + 0] = (unsigned char) (t[0] & 0xff); 37| 54| r[11 * i + 1] = (unsigned char) (t[0] >> 8) | ((t[1] & 0x1f) << 3); 38| 54| r[11 * i + 2] = (unsigned char) (t[1] >> 5) | ((t[2] & 0x03) << 6); 39| 54| r[11 * i + 3] = (unsigned char) (t[2] >> 2) & 0xff; 40| 54| r[11 * i + 4] = (unsigned char) (t[2] >> 10) | ((t[3] & 0x7f) << 1); 41| 54| r[11 * i + 5] = (unsigned char) (t[3] >> 7) | ((t[4] & 0x0f) << 4); 42| 54| break; 43| 0| case 2: ------------------ | Branch (43:5): [True: 0, False: 54] ------------------ 44| 0| r[11 * i + 0] = (unsigned char) (t[0] & 0xff); 45| 0| r[11 * i + 1] = (unsigned char) (t[0] >> 8) | ((t[1] & 0x1f) << 3); 46| 0| r[11 * i + 2] = (unsigned char) (t[1] >> 5) | ((t[2] & 0x03) << 6); 47| 0| break; 48| 54| } 49| 54|} PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_frombytes: 51| 54|void PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_frombytes(poly *r, const unsigned char *a) { 52| 54| int i; 53| 4.59k| for (i = 0; i < NTRU_PACK_DEG / 8; i++) { ------------------ | | 25| 4.59k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 4.59k|#define NTRU_N 677 | | ------------------ ------------------ | Branch (53:17): [True: 4.53k, False: 54] ------------------ 54| 4.53k| r->coeffs[8 * i + 0] = (a[11 * i + 0] >> 0) | (((uint16_t)a[11 * i + 1] & 0x07) << 8); 55| 4.53k| r->coeffs[8 * i + 1] = (a[11 * i + 1] >> 3) | (((uint16_t)a[11 * i + 2] & 0x3f) << 5); 56| 4.53k| r->coeffs[8 * i + 2] = (a[11 * i + 2] >> 6) | (((uint16_t)a[11 * i + 3] & 0xff) << 2) | (((uint16_t)a[11 * i + 4] & 0x01) << 10); 57| 4.53k| r->coeffs[8 * i + 3] = (a[11 * i + 4] >> 1) | (((uint16_t)a[11 * i + 5] & 0x0f) << 7); 58| 4.53k| r->coeffs[8 * i + 4] = (a[11 * i + 5] >> 4) | (((uint16_t)a[11 * i + 6] & 0x7f) << 4); 59| 4.53k| r->coeffs[8 * i + 5] = (a[11 * i + 6] >> 7) | (((uint16_t)a[11 * i + 7] & 0xff) << 1) | (((uint16_t)a[11 * i + 8] & 0x03) << 9); 60| 4.53k| r->coeffs[8 * i + 6] = (a[11 * i + 8] >> 2) | (((uint16_t)a[11 * i + 9] & 0x1f) << 6); 61| 4.53k| r->coeffs[8 * i + 7] = (a[11 * i + 9] >> 5) | (((uint16_t)a[11 * i + 10] & 0xff) << 3); 62| 4.53k| } 63| 54| switch (NTRU_PACK_DEG & 0x07) { ------------------ | | 25| 54|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 54|#define NTRU_N 677 | | ------------------ ------------------ | Branch (63:13): [True: 54, Folded] ------------------ 64| | // cases 0 and 6 are impossible since 2 generates (Z/n)* and 65| | // p mod 8 in {1, 7} implies that 2 is a quadratic residue. 66| 54| case 4: ------------------ | Branch (66:5): [True: 54, False: 0] ------------------ 67| 54| r->coeffs[8 * i + 0] = (a[11 * i + 0] >> 0) | (((uint16_t)a[11 * i + 1] & 0x07) << 8); 68| 54| r->coeffs[8 * i + 1] = (a[11 * i + 1] >> 3) | (((uint16_t)a[11 * i + 2] & 0x3f) << 5); 69| 54| r->coeffs[8 * i + 2] = (a[11 * i + 2] >> 6) | (((uint16_t)a[11 * i + 3] & 0xff) << 2) | (((uint16_t)a[11 * i + 4] & 0x01) << 10); 70| 54| r->coeffs[8 * i + 3] = (a[11 * i + 4] >> 1) | (((uint16_t)a[11 * i + 5] & 0x0f) << 7); 71| 54| break; 72| 0| case 2: ------------------ | Branch (72:5): [True: 0, False: 54] ------------------ 73| 0| r->coeffs[8 * i + 0] = (a[11 * i + 0] >> 0) | (((uint16_t)a[11 * i + 1] & 0x07) << 8); 74| 0| r->coeffs[8 * i + 1] = (a[11 * i + 1] >> 3) | (((uint16_t)a[11 * i + 2] & 0x3f) << 5); 75| 0| break; 76| 54| } 77| 54| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 54|#define NTRU_N 677 ------------------ 78| 54|} PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_sum_zero_tobytes: 80| 36|void PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_sum_zero_tobytes(unsigned char *r, const poly *a) { 81| 36| PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_tobytes(r, a); 82| 36|} PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_sum_zero_frombytes: 84| 36|void PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_sum_zero_frombytes(poly *r, const unsigned char *a) { 85| 36| int i; 86| 36| PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_frombytes(r, a); 87| | 88| | /* Set r[n-1] so that the sum of coefficients is zero mod q */ 89| 36| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 36|#define NTRU_N 677 ------------------ 90| 24.3k| for (i = 0; i < NTRU_PACK_DEG; i++) { ------------------ | | 25| 24.3k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 24.3k|#define NTRU_N 677 | | ------------------ ------------------ | Branch (90:17): [True: 24.3k, False: 36] ------------------ 91| 24.3k| r->coeffs[NTRU_N - 1] -= r->coeffs[i]; ------------------ | | 5| 24.3k|#define NTRU_N 677 ------------------ 92| 24.3k| } 93| 36|} PQCLEAN_NTRUHPS2048677_AVX2_poly_Z3_to_Zq: 4| 108|void PQCLEAN_NTRUHPS2048677_AVX2_poly_Z3_to_Zq(poly *r) { 5| 108| int i; 6| 73.2k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 73.2k|#define NTRU_N 677 ------------------ | Branch (6:17): [True: 73.1k, False: 108] ------------------ 7| 73.1k| r->coeffs[i] = r->coeffs[i] | ((-(r->coeffs[i] >> 1)) & (NTRU_Q - 1)); ------------------ | | 13| 73.1k|#define NTRU_Q (1 << NTRU_LOGQ) | | ------------------ | | | | 6| 73.1k|#define NTRU_LOGQ 11 | | ------------------ ------------------ 8| 73.1k| } 9| 108|} PQCLEAN_NTRUHPS2048677_AVX2_poly_trinary_Zq_to_Z3: 12| 18|void PQCLEAN_NTRUHPS2048677_AVX2_poly_trinary_Zq_to_Z3(poly *r) { 13| 18| int i; 14| 12.2k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 12.2k|#define NTRU_N 677 ------------------ | Branch (14:17): [True: 12.1k, False: 18] ------------------ 15| 12.1k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 12.1k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 12.1k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 12.1k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ 16| 12.1k| r->coeffs[i] = 3 & (r->coeffs[i] ^ (r->coeffs[i] >> (NTRU_LOGQ - 1))); ------------------ | | 6| 12.1k|#define NTRU_LOGQ 11 ------------------ 17| 12.1k| } 18| 18|} PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_mul: 20| 36|void PQCLEAN_NTRUHPS2048677_AVX2_poly_Sq_mul(poly *r, const poly *a, const poly *b) { 21| 36| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(r, a, b); 22| 36| PQCLEAN_NTRUHPS2048677_AVX2_poly_mod_q_Phi_n(r); 23| 36|} PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_mul: 25| 18|void PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_mul(poly *r, const poly *a, const poly *b) { 26| 18| int i; 27| | 28| | /* Our S3 multiplications do not overflow mod q, */ 29| | /* so we can re-purpose PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul, as long as we */ 30| | /* follow with an explicit reduction mod q. */ 31| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(r, a, b); 32| 12.2k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 12.2k|#define NTRU_N 677 ------------------ | Branch (32:17): [True: 12.1k, False: 18] ------------------ 33| 12.1k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 12.1k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 12.1k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 12.1k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ 34| 12.1k| } 35| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_mod_3_Phi_n(r); 36| 18|} PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_inv: 71| 18|void PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_inv(poly *r, const poly *a) { 72| 18| poly ai2; 73| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_inv(&ai2, a); 74| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_inv_to_Rq_inv(r, &ai2, a); 75| 18|} poly.c:PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_inv_to_Rq_inv: 38| 18|static void PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_inv_to_Rq_inv(poly *r, const poly *ai, const poly *a) { 39| | 40| 18| int i; 41| 18| poly b, c; 42| 18| poly s; 43| | 44| | // for 0..4 45| | // ai = ai * (2 - a*ai) mod q 46| 12.2k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 12.2k|#define NTRU_N 677 ------------------ | Branch (46:17): [True: 12.1k, False: 18] ------------------ 47| 12.1k| b.coeffs[i] = -(a->coeffs[i]); 48| 12.1k| } 49| | 50| 12.2k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 12.2k|#define NTRU_N 677 ------------------ | Branch (50:17): [True: 12.1k, False: 18] ------------------ 51| 12.1k| r->coeffs[i] = ai->coeffs[i]; 52| 12.1k| } 53| | 54| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(&c, r, &b); 55| 18| c.coeffs[0] += 2; // c = 2 - a*ai 56| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(&s, &c, r); // s = ai*c 57| | 58| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(&c, &s, &b); 59| 18| c.coeffs[0] += 2; // c = 2 - a*s 60| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(r, &c, &s); // r = s*c 61| | 62| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(&c, r, &b); 63| 18| c.coeffs[0] += 2; // c = 2 - a*r 64| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(&s, &c, r); // s = r*c 65| | 66| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(&c, &s, &b); 67| 18| c.coeffs[0] += 2; // c = 2 - a*s 68| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_Rq_mul(r, &c, &s); // r = s*c 69| 18|} PQCLEAN_NTRUHPS2048677_AVX2_poly_lift: 3| 36|void PQCLEAN_NTRUHPS2048677_AVX2_poly_lift(poly *r, const poly *a) { 4| 36| int i; 5| 24.4k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 24.4k|#define NTRU_N 677 ------------------ | Branch (5:17): [True: 24.3k, False: 36] ------------------ 6| 24.3k| r->coeffs[i] = a->coeffs[i]; 7| 24.3k| } 8| 36| PQCLEAN_NTRUHPS2048677_AVX2_poly_Z3_to_Zq(r); 9| 36|} PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_tobytes: 6| 18|void PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_tobytes(unsigned char *out, const poly *a) { 7| 18| int i, j, k; 8| 234| for (i = 0; i < 12; i++) { ------------------ | Branch (8:17): [True: 216, False: 18] ------------------ 9| 1.94k| for (k = 0; k < 8; k++) { ------------------ | Branch (9:21): [True: 1.72k, False: 216] ------------------ 10| 1.72k| out[i * 8 + k] = 0; 11| 15.5k| for (j = 0; j < 8; j++) { ------------------ | Branch (11:25): [True: 13.8k, False: 1.72k] ------------------ 12| 13.8k| if ((i * 8 + k) * 8 + j < NTRU_N) { ------------------ | | 5| 13.8k|#define NTRU_N 677 ------------------ | Branch (12:21): [True: 12.1k, False: 1.63k] ------------------ 13| 12.1k| out[i * 8 + k] |= (a->coeffs[(i * 8 + k) * 8 + j] & 1) << j; 14| 12.1k| } 15| 13.8k| } 16| 1.72k| } 17| 216| } 18| 18|} PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_frombytes: 20| 18|void PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_frombytes(poly *a, const unsigned char *in) { 21| 18| int i, j, k; 22| 234| for (i = 0; i < 12; i++) { ------------------ | Branch (22:17): [True: 216, False: 18] ------------------ 23| 1.94k| for (k = 0; k < 8; k++) { ------------------ | Branch (23:21): [True: 1.72k, False: 216] ------------------ 24| 15.5k| for (j = 0; j < 8; j++) { ------------------ | Branch (24:25): [True: 13.8k, False: 1.72k] ------------------ 25| 13.8k| if ((i * 8 + k) * 8 + j < NTRU_N) { ------------------ | | 5| 13.8k|#define NTRU_N 677 ------------------ | Branch (25:21): [True: 12.1k, False: 1.63k] ------------------ 26| 12.1k| a->coeffs[(i * 8 + k) * 8 + j] = (in[i * 8 + k] >> j) & 1; 27| 12.1k| } 28| 13.8k| } 29| 1.72k| } 30| 216| } 31| 18|} PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_inv: 33| 18|void PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_inv(poly *r, const poly *a) { 34| 18| union { 35| 18| unsigned char s[96]; 36| 18| __m256i s_x32[3]; 37| 18| } squares[13]; 38| 18|#define s(x) squares[(x)].s 39| | 40| | // This relies on the following addition chain: 41| | // 1, 2, 3, 5, 10, 20, 21, 42, 84, 168, 336, 672, 675 42| | 43| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_tobytes(s(0), a); // TODO alignment ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ 44| | 45| 18| PQCLEAN_NTRUHPS2048677_AVX2_square_1_677(s(1), s(0)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_1_677(s(1), s(0)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ 46| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ 47| 18| PQCLEAN_NTRUHPS2048677_AVX2_square_1_677(s(2), s(1)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_1_677(s(2), s(1)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ 48| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ 49| 18| PQCLEAN_NTRUHPS2048677_AVX2_square_2_677(s(3), s(2)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_2_677(s(3), s(2)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ 50| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(3), s(3), s(1)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(3), s(3), s(1)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(3), s(3), s(1)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ 51| 18| PQCLEAN_NTRUHPS2048677_AVX2_square_5_677(s(4), s(3)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_5_677(s(4), s(3)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ 52| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ 53| 18| PQCLEAN_NTRUHPS2048677_AVX2_square_10_677(s(5), s(4)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_10_677(s(5), s(4)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ 54| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(5), s(5), s(4)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(5), s(5), s(4)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(5), s(5), s(4)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ 55| 18| PQCLEAN_NTRUHPS2048677_AVX2_square_1_677(s(6), s(5)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_1_677(s(6), s(5)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ 56| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(6), s(6), s(0)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(6), s(6), s(0)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(6), s(6), s(0)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ 57| 18| PQCLEAN_NTRUHPS2048677_AVX2_square_21_677(s(7), s(6)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_21_677(s(7), s(6)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ 58| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(7), s(7), s(6)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(7), s(7), s(6)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(7), s(7), s(6)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ 59| 18| PQCLEAN_NTRUHPS2048677_AVX2_square_42_677(s(8), s(7)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_42_677(s(8), s(7)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ 60| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(8), s(8), s(7)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(8), s(8), s(7)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(8), s(8), s(7)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ 61| 18| PQCLEAN_NTRUHPS2048677_AVX2_square_84_677(s(9), s(8)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_84_677(s(9), s(8)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ 62| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ 63| 18| PQCLEAN_NTRUHPS2048677_AVX2_square_168_677(s(10), s(9)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_168_677(s(10), s(9)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ 64| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ 65| 18| PQCLEAN_NTRUHPS2048677_AVX2_square_336_677(s(11), s(10)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_336_677(s(11), s(10)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ 66| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ 67| 18| PQCLEAN_NTRUHPS2048677_AVX2_square_3_677(s(12), s(11)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_3_677(s(12), s(11)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ 68| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(12), s(12), s(2)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(12), s(12), s(2)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_mul(s(12), s(12), s(2)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ 69| 18| PQCLEAN_NTRUHPS2048677_AVX2_square_1_677(s(0), s(12)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS2048677_AVX2_square_1_677(s(0), s(12)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ 70| | 71| 18| PQCLEAN_NTRUHPS2048677_AVX2_poly_R2_frombytes(r, s(0)); ------------------ | | 38| 18|#define s(x) squares[(x)].s ------------------ 72| 18|#undef s 73| 18|} PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_inv: 545| 18|void PQCLEAN_NTRUHPS2048677_AVX2_poly_S3_inv(poly *r_out, const poly *a) { 546| 18| const unsigned char *in = (void *) a; 547| 18| unsigned char *out = (void *) r_out; 548| | 549| 18| small input[ppad]; 550| 18| small output[ppad]; 551| 18| int i; 552| | 553| | /* XXX: obviously input/output format should be packed into bytes */ 554| | 555| 12.1k| for (i = 0; i < p; ++i) { ------------------ | | 7| 12.1k|#define p 676 ------------------ | Branch (555:17): [True: 12.1k, False: 18] ------------------ 556| 12.1k| small x = in[2 * i] & 3; /* 0 1 2 3 */ 557| 12.1k| x += 1; /* 0 1 2 3 4 5 6, offset by 1 */ 558| 12.1k| x &= (x - 3) >> 5; /* 0 1 2, offset by 1 */ 559| 12.1k| input[i] = x - 1; 560| 12.1k| } 561| | /* XXX: merge with vec256_init */ 562| | 563| 18| __poly_S3_inv((unsigned char *)output, (unsigned char *)input); 564| | 565| 12.1k| for (i = 0; i < p; ++i) { ------------------ | | 7| 12.1k|#define p 676 ------------------ | Branch (565:17): [True: 12.1k, False: 18] ------------------ 566| 12.1k| out[2 * i] = (3 & output[i]) ^ ((3 & output[i]) >> 1); 567| 12.1k| out[2 * i + 1] = 0; 568| 12.1k| } 569| 18|} poly_s3_inv.c:vec256_divx_3: 280| 94.8k|static inline void vec256_divx_3(vec256 *f) { 281| 94.8k| vec256 f0 = f[0]; 282| 94.8k| vec256 f1 = f[1]; 283| 94.8k| vec256 f2 = f[2]; 284| | 285| 94.8k| unsigned long long low0 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f0)); 286| 94.8k| unsigned long long low1 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f1)); 287| 94.8k| unsigned long long low2 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f2)); 288| | 289| 94.8k| low0 = (low0 >> 1) | (low1 << 63); 290| 94.8k| low1 = (low1 >> 1) | (low2 << 63); 291| 94.8k| low2 = low2 >> 1; 292| | 293| 94.8k| f0 = _mm256_blend_epi32(f0, _mm256_set_epi64x(0, 0, 0, low0), 0x3); 294| 94.8k| f1 = _mm256_blend_epi32(f1, _mm256_set_epi64x(0, 0, 0, low1), 0x3); 295| 94.8k| f2 = _mm256_blend_epi32(f2, _mm256_set_epi64x(0, 0, 0, low2), 0x3); 296| | 297| 94.8k| f[0] = _mm256_permute4x64_epi64(f0, 0x39); 298| 94.8k| f[1] = _mm256_permute4x64_epi64(f1, 0x39); 299| | f[2] = _mm256_permute4x64_epi64(f2, 0x39); 300| 94.8k|} poly_s3_inv.c:vec256_timesx_3: 331| 94.8k|static inline void vec256_timesx_3(vec256 *f) { 332| 94.8k| vec256 f0 = _mm256_permute4x64_epi64(f[0], 0x93); 333| 94.8k| vec256 f1 = _mm256_permute4x64_epi64(f[1], 0x93); 334| 94.8k| vec256 f2 = _mm256_permute4x64_epi64(f[2], 0x93); 335| | 336| 94.8k| unsigned long long low0 = *(unsigned long long *) &f0; 337| 94.8k| unsigned long long low1 = *(unsigned long long *) &f1; 338| 94.8k| unsigned long long low2 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f2)); 339| | 340| 94.8k| low2 = (low2 << 1) | (low1 >> 63); 341| 94.8k| low1 = (low1 << 1) | (low0 >> 63); 342| 94.8k| low0 = low0 << 1; 343| | 344| 94.8k| *(unsigned long long *) &f0 = low0; 345| 94.8k| *(unsigned long long *) &f1 = low1; 346| 94.8k| f2 = _mm256_blend_epi32(f2, _mm256_set_epi64x(0, 0, 0, low2), 0x3); 347| | 348| 94.8k| f[0] = f0; 349| 94.8k| f[1] = f1; 350| 94.8k| f[2] = f2; 351| 94.8k|} PQCLEAN_NTRUHPS2048677_AVX2_sample_fg: 3| 18|void PQCLEAN_NTRUHPS2048677_AVX2_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]) { 4| | 5| 18| PQCLEAN_NTRUHPS2048677_AVX2_sample_iid(f, uniformbytes); 6| 18| PQCLEAN_NTRUHPS2048677_AVX2_sample_fixed_type(g, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 20| 18|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 18|#define NTRU_N 677 | | ------------------ ------------------ 7| 18|} PQCLEAN_NTRUHPS2048677_AVX2_sample_rm: 9| 18|void PQCLEAN_NTRUHPS2048677_AVX2_sample_rm(poly *r, poly *m, const unsigned char uniformbytes[NTRU_SAMPLE_RM_BYTES]) { 10| | 11| 18| PQCLEAN_NTRUHPS2048677_AVX2_sample_iid(r, uniformbytes); 12| 18| PQCLEAN_NTRUHPS2048677_AVX2_sample_fixed_type(m, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 20| 18|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 18|#define NTRU_N 677 | | ------------------ ------------------ 13| 18|} PQCLEAN_NTRUHPS2048677_AVX2_sample_fixed_type: 16| 36|void PQCLEAN_NTRUHPS2048677_AVX2_sample_fixed_type(poly *r, const unsigned char u[NTRU_SAMPLE_FT_BYTES]) { 17| | // Assumes NTRU_SAMPLE_FT_BYTES = ceil(30*(n-1)/8) 18| | 19| 36| int32_t s[NTRU_N - 1]; 20| 36| int i; 21| | 22| | // Use 30 bits of u per word 23| 6.12k| for (i = 0; i < (NTRU_N - 1) / 4; i++) { ------------------ | | 5| 6.12k|#define NTRU_N 677 ------------------ | Branch (23:17): [True: 6.08k, False: 36] ------------------ 24| 6.08k| s[4 * i + 0] = (u[15 * i + 0] << 2) + (u[15 * i + 1] << 10) + (u[15 * i + 2] << 18) + ((uint32_t) u[15 * i + 3] << 26); 25| 6.08k| s[4 * i + 1] = ((u[15 * i + 3] & 0xc0) >> 4) + (u[15 * i + 4] << 4) + (u[15 * i + 5] << 12) + (u[15 * i + 6] << 20) + ((uint32_t) u[15 * i + 7] << 28); 26| 6.08k| s[4 * i + 2] = ((u[15 * i + 7] & 0xf0) >> 2) + (u[15 * i + 8] << 6) + (u[15 * i + 9] << 14) + (u[15 * i + 10] << 22) + ((uint32_t) u[15 * i + 11] << 30); 27| 6.08k| s[4 * i + 3] = (u[15 * i + 11] & 0xfc) + (u[15 * i + 12] << 8) + (u[15 * i + 13] << 16) + ((uint32_t) u[15 * i + 14] << 24); 28| 6.08k| } 29| | 30| 4.60k| for (i = 0; i < NTRU_WEIGHT / 2; i++) { ------------------ | | 14| 4.60k|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 4.60k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 4.60k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ | Branch (30:17): [True: 4.57k, False: 36] ------------------ 31| 4.57k| s[i] |= 1; 32| 4.57k| } 33| | 34| 4.60k| for (i = NTRU_WEIGHT / 2; i < NTRU_WEIGHT; i++) { ------------------ | | 14| 36|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 36|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 36|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ for (i = NTRU_WEIGHT / 2; i < NTRU_WEIGHT; i++) { ------------------ | | 14| 4.60k|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 4.60k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 4.60k|#define NTRU_LOGQ 11 | | | | ------------------ | | ------------------ ------------------ | Branch (34:31): [True: 4.57k, False: 36] ------------------ 35| 4.57k| s[i] |= 2; 36| 4.57k| } 37| | 38| 36| PQCLEAN_NTRUHPS2048677_AVX2_crypto_sort_int32(s, NTRU_N - 1); ------------------ | | 5| 36|#define NTRU_N 677 ------------------ 39| | 40| 24.3k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 24.3k|#define NTRU_N 677 ------------------ | Branch (40:17): [True: 24.3k, False: 36] ------------------ 41| 24.3k| r->coeffs[i] = ((uint16_t) (s[i] & 3)); 42| 24.3k| } 43| | 44| 36| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 36|#define NTRU_N 677 ------------------ 45| 36|} PQCLEAN_NTRUHPS2048677_AVX2_sample_iid: 7| 36|void PQCLEAN_NTRUHPS2048677_AVX2_sample_iid(poly *r, const unsigned char uniformbytes[NTRU_SAMPLE_IID_BYTES]) { 8| 36| int i; 9| 36| union { /* align to 32 byte boundary for vmovdqa */ 10| 36| unsigned char b[PAD32(NTRU_SAMPLE_IID_BYTES)]; 11| 36| __m256i b_x32[PAD32(NTRU_SAMPLE_IID_BYTES) / 32]; 12| 36| } buffer; 13| | 14| 24.3k| for (i = 0; i < NTRU_SAMPLE_IID_BYTES; i++) { ------------------ | | 20| 24.3k|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 24.3k|#define NTRU_N 677 | | ------------------ ------------------ | Branch (14:17): [True: 24.3k, False: 36] ------------------ 15| 24.3k| buffer.b[i] = uniformbytes[i]; 16| 24.3k| } 17| 1.04k| for (i = NTRU_SAMPLE_IID_BYTES; i < PAD32(NTRU_SAMPLE_IID_BYTES); i++) { ------------------ | | 20| 36|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 36|#define NTRU_N 677 | | ------------------ ------------------ for (i = NTRU_SAMPLE_IID_BYTES; i < PAD32(NTRU_SAMPLE_IID_BYTES); i++) { ------------------ | | 11| 1.04k|#define PAD32(X) ((((X) + 31)/32)*32) ------------------ | Branch (17:37): [True: 1.00k, False: 36] ------------------ 18| 1.00k| buffer.b[i] = 0; 19| 1.00k| } 20| 36| PQCLEAN_NTRUHPS2048677_AVX2_vec32_sample_iid(r, buffer.b); 21| 36|} PQCLEAN_NTRUHPS40961229_CLEAN_cmov: 4| 33|void PQCLEAN_NTRUHPS40961229_CLEAN_cmov(unsigned char *r, const unsigned char *x, size_t len, unsigned char b) { 5| 33| size_t i; 6| | 7| 33| b = (~b + 1); 8| 1.08k| for (i = 0; i < len; i++) { ------------------ | Branch (8:17): [True: 1.05k, False: 33] ------------------ 9| 1.05k| r[i] ^= b & (x[i] ^ r[i]); 10| 1.05k| } 11| 33|} PQCLEAN_NTRUHPS40961229_CLEAN_crypto_sort_int32: 20| 66|void PQCLEAN_NTRUHPS40961229_CLEAN_crypto_sort_int32(int32 *array, size_t n) { 21| 66| size_t top, p, q, r, i, j; 22| 66| int32 *x = array; ------------------ | | 6| 66|#define int32 int32_t ------------------ 23| | 24| 66| top = 1; 25| 726| while (top < n - top) { ------------------ | Branch (25:12): [True: 660, False: 66] ------------------ 26| 660| top += top; 27| 660| } 28| | 29| 792| for (p = top; p >= 1; p >>= 1) { ------------------ | Branch (29:19): [True: 726, False: 66] ------------------ 30| 726| i = 0; 31| 81.4k| while (i + 2 * p <= n) { ------------------ | Branch (31:16): [True: 80.7k, False: 726] ------------------ 32| 461k| for (j = i; j < i + p; ++j) { ------------------ | Branch (32:25): [True: 381k, False: 80.7k] ------------------ 33| 381k| int32_MINMAX(x[j], x[j + p]); ------------------ | | 9| 381k| do { \ | | 10| 381k| int32_t ab = (b) ^ (a); \ | | 11| 381k| int32_t c = (int32_t)((int64_t)(b) - (int64_t)(a)); \ | | 12| 381k| c ^= ab & (c ^ (b)); \ | | 13| 381k| c >>= 31; \ | | 14| 381k| c &= ab; \ | | 15| 381k| (a) ^= c; \ | | 16| 381k| (b) ^= c; \ | | 17| 381k| } while(0) | | ------------------ | | | Branch (17:13): [Folded, False: 381k] | | ------------------ ------------------ 34| 381k| } 35| 80.7k| i += 2 * p; 36| 80.7k| } 37| 20.2k| for (j = i; j < n - p; ++j) { ------------------ | Branch (37:21): [True: 19.5k, False: 726] ------------------ 38| 19.5k| int32_MINMAX(x[j], x[j + p]); ------------------ | | 9| 19.5k| do { \ | | 10| 19.5k| int32_t ab = (b) ^ (a); \ | | 11| 19.5k| int32_t c = (int32_t)((int64_t)(b) - (int64_t)(a)); \ | | 12| 19.5k| c ^= ab & (c ^ (b)); \ | | 13| 19.5k| c >>= 31; \ | | 14| 19.5k| c &= ab; \ | | 15| 19.5k| (a) ^= c; \ | | 16| 19.5k| (b) ^= c; \ | | 17| 19.5k| } while(0) | | ------------------ | | | Branch (17:13): [Folded, False: 19.5k] | | ------------------ ------------------ 39| 19.5k| } 40| | 41| 726| i = 0; 42| 726| j = 0; 43| 4.35k| for (q = top; q > p; q >>= 1) { ------------------ | Branch (43:23): [True: 3.63k, False: 726] ------------------ 44| 3.63k| if (j != i) { ------------------ | Branch (44:17): [True: 660, False: 2.97k] ------------------ 45| 10.0k| for (;;) { 46| 10.0k| if (j == n - q) { ------------------ | Branch (46:25): [True: 0, False: 10.0k] ------------------ 47| 0| goto done; 48| 0| } 49| 10.0k| int32 a = x[j + p]; ------------------ | | 6| 10.0k|#define int32 int32_t ------------------ 50| 30.6k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (50:33): [True: 20.5k, False: 10.0k] ------------------ 51| 20.5k| int32_MINMAX(a, x[j + r]); ------------------ | | 9| 20.5k| do { \ | | 10| 20.5k| int32_t ab = (b) ^ (a); \ | | 11| 20.5k| int32_t c = (int32_t)((int64_t)(b) - (int64_t)(a)); \ | | 12| 20.5k| c ^= ab & (c ^ (b)); \ | | 13| 20.5k| c >>= 31; \ | | 14| 20.5k| c &= ab; \ | | 15| 20.5k| (a) ^= c; \ | | 16| 20.5k| (b) ^= c; \ | | 17| 20.5k| } while(0) | | ------------------ | | | Branch (17:13): [Folded, False: 20.5k] | | ------------------ ------------------ 52| 20.5k| } 53| 10.0k| x[j + p] = a; 54| 10.0k| ++j; 55| 10.0k| if (j == i + p) { ------------------ | Branch (55:25): [True: 660, False: 9.37k] ------------------ 56| 660| i += 2 * p; 57| 660| break; 58| 660| } 59| 10.0k| } 60| 660| } 61| 83.2k| while (i + p <= n - q) { ------------------ | Branch (61:20): [True: 79.6k, False: 3.63k] ------------------ 62| 376k| for (j = i; j < i + p; ++j) { ------------------ | Branch (62:29): [True: 296k, False: 79.6k] ------------------ 63| 296k| int32 a = x[j + p]; ------------------ | | 6| 296k|#define int32 int32_t ------------------ 64| 1.85M| for (r = q; r > p; r >>= 1) { ------------------ | Branch (64:33): [True: 1.55M, False: 296k] ------------------ 65| 1.55M| int32_MINMAX(a, x[j + r]); ------------------ | | 9| 1.55M| do { \ | | 10| 1.55M| int32_t ab = (b) ^ (a); \ | | 11| 1.55M| int32_t c = (int32_t)((int64_t)(b) - (int64_t)(a)); \ | | 12| 1.55M| c ^= ab & (c ^ (b)); \ | | 13| 1.55M| c >>= 31; \ | | 14| 1.55M| c &= ab; \ | | 15| 1.55M| (a) ^= c; \ | | 16| 1.55M| (b) ^= c; \ | | 17| 1.55M| } while(0) | | ------------------ | | | Branch (17:13): [Folded, False: 1.55M] | | ------------------ ------------------ 66| 1.55M| } 67| 296k| x[j + p] = a; 68| 296k| } 69| 79.6k| i += 2 * p; 70| 79.6k| } 71| | /* now i + p > n - q */ 72| 3.63k| j = i; 73| 52.7k| while (j < n - q) { ------------------ | Branch (73:20): [True: 49.1k, False: 3.63k] ------------------ 74| 49.1k| int32 a = x[j + p]; ------------------ | | 6| 49.1k|#define int32 int32_t ------------------ 75| 131k| for (r = q; r > p; r >>= 1) { ------------------ | Branch (75:29): [True: 82.3k, False: 49.1k] ------------------ 76| 82.3k| int32_MINMAX(a, x[j + r]); ------------------ | | 9| 82.3k| do { \ | | 10| 82.3k| int32_t ab = (b) ^ (a); \ | | 11| 82.3k| int32_t c = (int32_t)((int64_t)(b) - (int64_t)(a)); \ | | 12| 82.3k| c ^= ab & (c ^ (b)); \ | | 13| 82.3k| c >>= 31; \ | | 14| 82.3k| c &= ab; \ | | 15| 82.3k| (a) ^= c; \ | | 16| 82.3k| (b) ^= c; \ | | 17| 82.3k| } while(0) | | ------------------ | | | Branch (17:13): [Folded, False: 82.3k] | | ------------------ ------------------ 77| 82.3k| } 78| 49.1k| x[j + p] = a; 79| 49.1k| ++j; 80| 49.1k| } 81| | 82| 3.63k|done: 83| 3.63k| ; 84| 3.63k| } 85| 726| } 86| 66|} PQCLEAN_NTRUHPS40961229_CLEAN_crypto_kem_keypair: 10| 33|int PQCLEAN_NTRUHPS40961229_CLEAN_crypto_kem_keypair(uint8_t *pk, uint8_t *sk) { 11| 33| uint8_t seed[NTRU_SAMPLE_FG_BYTES]; 12| | 13| 33| randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 8| 33|#define randombytes OQS_randombytes ------------------ randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 22| 33|#define NTRU_SAMPLE_FG_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 20| 33|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 33|#define NTRU_N 1229 | | | | ------------------ | | ------------------ | | #define NTRU_SAMPLE_FG_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 21| 33|#define NTRU_SAMPLE_FT_BYTES ((30*(NTRU_N-1)+7)/8) | | | | ------------------ | | | | | | 5| 33|#define NTRU_N 1229 | | | | ------------------ | | ------------------ ------------------ 14| 33| PQCLEAN_NTRUHPS40961229_CLEAN_owcpa_keypair(pk, sk, seed); 15| | 16| 33| randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 8| 33|#define randombytes OQS_randombytes ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 30| 33|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 26| 33|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 33|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 33|#define NTRU_N 1229 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 29| 33|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 33|#define NTRU_LOGQ 12 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 33|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 33|#define NTRU_N 1229 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 17| 33|#define NTRU_PRFKEYBYTES 32 ------------------ 17| | 18| 33| return 0; 19| 33|} PQCLEAN_NTRUHPS40961229_CLEAN_crypto_kem_enc: 21| 33|int PQCLEAN_NTRUHPS40961229_CLEAN_crypto_kem_enc(uint8_t *c, uint8_t *k, const uint8_t *pk) { 22| 33| poly r, m; 23| 33| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 24| 33| uint8_t rm_seed[NTRU_SAMPLE_RM_BYTES]; 25| | 26| 33| randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 8| 33|#define randombytes OQS_randombytes ------------------ randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 23| 33|#define NTRU_SAMPLE_RM_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 20| 33|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 33|#define NTRU_N 1229 | | | | ------------------ | | ------------------ | | #define NTRU_SAMPLE_RM_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 21| 33|#define NTRU_SAMPLE_FT_BYTES ((30*(NTRU_N-1)+7)/8) | | | | ------------------ | | | | | | 5| 33|#define NTRU_N 1229 | | | | ------------------ | | ------------------ ------------------ 27| | 28| 33| PQCLEAN_NTRUHPS40961229_CLEAN_sample_rm(&r, &m, rm_seed); 29| | 30| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_tobytes(rm, &r); 31| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, &m); ------------------ | | 26| 33|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 33|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 33|#define NTRU_N 1229 | | | | ------------------ | | ------------------ ------------------ 32| 33| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 33|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 28| 33|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 26| 33|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 33|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 33|#define NTRU_N 1229 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 33| | 34| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Z3_to_Zq(&r); 35| 33| PQCLEAN_NTRUHPS40961229_CLEAN_owcpa_enc(c, &r, &m, pk); 36| | 37| 33| return 0; 38| 33|} PQCLEAN_NTRUHPS40961229_CLEAN_crypto_kem_dec: 40| 33|int PQCLEAN_NTRUHPS40961229_CLEAN_crypto_kem_dec(uint8_t *k, const uint8_t *c, const uint8_t *sk) { 41| 33| int i, fail; 42| 33| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 43| 33| uint8_t buf[NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES]; 44| | 45| 33| fail = PQCLEAN_NTRUHPS40961229_CLEAN_owcpa_dec(rm, c, sk); 46| | /* If fail = 0 then c = Enc(h, rm). There is no need to re-encapsulate. */ 47| | /* See comment in PQCLEAN_NTRUHPS40961229_CLEAN_owcpa_dec for details. */ 48| | 49| 33| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 33|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 28| 33|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 26| 33|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 33|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 33|#define NTRU_N 1229 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 50| | 51| | /* shake(secret PRF key || input ciphertext) */ 52| 1.08k| for (i = 0; i < NTRU_PRFKEYBYTES; i++) { ------------------ | | 17| 1.08k|#define NTRU_PRFKEYBYTES 32 ------------------ | Branch (52:17): [True: 1.05k, False: 33] ------------------ 53| 1.05k| buf[i] = sk[i + NTRU_OWCPA_SECRETKEYBYTES]; ------------------ | | 30| 1.05k|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 26| 1.05k|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 1.05k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 1.05k|#define NTRU_N 1229 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 29| 1.05k|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 1.05k|#define NTRU_LOGQ 12 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 1.05k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 1.05k|#define NTRU_N 1229 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 1.05k| } 55| 60.8k| for (i = 0; i < NTRU_CIPHERTEXTBYTES; i++) { ------------------ | | 35| 60.8k|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 31| 60.8k|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 60.8k|#define NTRU_LOGQ 12 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 60.8k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 60.8k|#define NTRU_N 1229 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (55:17): [True: 60.7k, False: 33] ------------------ 56| 60.7k| buf[NTRU_PRFKEYBYTES + i] = c[i]; ------------------ | | 17| 60.7k|#define NTRU_PRFKEYBYTES 32 ------------------ 57| 60.7k| } 58| 33| sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 15| 33|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 17| 33|#define NTRU_PRFKEYBYTES 32 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 35| 33|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 31| 33|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 33|#define NTRU_LOGQ 12 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 33|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 33|#define NTRU_N 1229 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 59| | 60| 33| PQCLEAN_NTRUHPS40961229_CLEAN_cmov(k, rm, NTRU_SHAREDKEYBYTES, (unsigned char) fail); ------------------ | | 18| 33|#define NTRU_SHAREDKEYBYTES 32 ------------------ 61| | 62| 33| return 0; 63| 33|} PQCLEAN_NTRUHPS40961229_CLEAN_owcpa_keypair: 62| 33| const unsigned char seed[NTRU_SAMPLE_FG_BYTES]) { 63| 33| int i; 64| | 65| 33| poly x1, x2, x3, x4, x5; 66| | 67| 33| poly *f = &x1, *g = &x2, *invf_mod3 = &x3; 68| 33| poly *gf = &x3, *invgf = &x4, *tmp = &x5; 69| 33| poly *invh = &x3, *h = &x3; 70| | 71| 33| PQCLEAN_NTRUHPS40961229_CLEAN_sample_fg(f, g, seed); 72| | 73| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_inv(invf_mod3, f); 74| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_tobytes(sk, f); 75| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_tobytes(sk + NTRU_PACK_TRINARY_BYTES, invf_mod3); ------------------ | | 26| 33|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 33|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 33|#define NTRU_N 1229 | | | | ------------------ | | ------------------ ------------------ 76| | 77| | /* Lift coeffs of f and g from Z_p to Z_q */ 78| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Z3_to_Zq(f); 79| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Z3_to_Zq(g); 80| | 81| | 82| | /* g = 3*g */ 83| 40.5k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 40.5k|#define NTRU_N 1229 ------------------ | Branch (83:17): [True: 40.5k, False: 33] ------------------ 84| 40.5k| g->coeffs[i] = 3 * g->coeffs[i]; 85| 40.5k| } 86| | 87| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(gf, g, f); 88| | 89| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_inv(invgf, gf); 90| | 91| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(tmp, invgf, f); 92| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_mul(invh, tmp, f); 93| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_tobytes(sk + 2 * NTRU_PACK_TRINARY_BYTES, invh); ------------------ | | 26| 33|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 33|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 33|#define NTRU_N 1229 | | | | ------------------ | | ------------------ ------------------ 94| | 95| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(tmp, invgf, g); 96| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(h, tmp, g); 97| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_sum_zero_tobytes(pk, h); 98| 33|} PQCLEAN_NTRUHPS40961229_CLEAN_owcpa_enc: 104| 33| const unsigned char *pk) { 105| 33| int i; 106| 33| poly x1, x2; 107| 33| poly *h = &x1, *liftm = &x1; 108| 33| poly *ct = &x2; 109| | 110| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_sum_zero_frombytes(h, pk); 111| | 112| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(ct, r, h); 113| | 114| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_lift(liftm, m); 115| 40.5k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 40.5k|#define NTRU_N 1229 ------------------ | Branch (115:17): [True: 40.5k, False: 33] ------------------ 116| 40.5k| ct->coeffs[i] = ct->coeffs[i] + liftm->coeffs[i]; 117| 40.5k| } 118| | 119| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_sum_zero_tobytes(c, ct); 120| 33|} PQCLEAN_NTRUHPS40961229_CLEAN_owcpa_dec: 124| 33| const unsigned char *secretkey) { 125| 33| int i; 126| 33| int fail; 127| 33| poly x1, x2, x3, x4; 128| | 129| 33| poly *c = &x1, *f = &x2, *cf = &x3; 130| 33| poly *mf = &x2, *finv3 = &x3, *m = &x4; 131| 33| poly *liftm = &x2, *invh = &x3, *r = &x4; 132| 33| poly *b = &x1; 133| | 134| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_sum_zero_frombytes(c, ciphertext); 135| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_frombytes(f, secretkey); 136| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Z3_to_Zq(f); 137| | 138| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(cf, c, f); 139| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_to_S3(mf, cf); 140| | 141| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_frombytes(finv3, secretkey + NTRU_PACK_TRINARY_BYTES); ------------------ | | 26| 33|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 33|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 33|#define NTRU_N 1229 | | | | ------------------ | | ------------------ ------------------ 142| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_mul(m, mf, finv3); 143| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, m); ------------------ | | 26| 33|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 33|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 33|#define NTRU_N 1229 | | | | ------------------ | | ------------------ ------------------ 144| | 145| 33| fail = 0; 146| | 147| | /* Check that the unused bits of the last byte of the ciphertext are zero */ 148| 33| fail |= owcpa_check_ciphertext(ciphertext); 149| | 150| | /* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */ 151| | /* We can avoid re-computing r*h + Lift(m) as long as we check that */ 152| | /* r (defined as b/h mod (q, Phi_n)) and m are in the message space. */ 153| | /* (m can take any value in S3 in NTRU_HRSS) */ 154| 33| fail |= owcpa_check_m(m); 155| | 156| | /* b = c - Lift(m) mod (q, x^n - 1) */ 157| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_lift(liftm, m); 158| 40.5k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 40.5k|#define NTRU_N 1229 ------------------ | Branch (158:17): [True: 40.5k, False: 33] ------------------ 159| 40.5k| b->coeffs[i] = c->coeffs[i] - liftm->coeffs[i]; 160| 40.5k| } 161| | 162| | /* r = b / h mod (q, Phi_n) */ 163| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_frombytes(invh, secretkey + 2 * NTRU_PACK_TRINARY_BYTES); ------------------ | | 26| 33|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 33|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 33|#define NTRU_N 1229 | | | | ------------------ | | ------------------ ------------------ 164| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_mul(r, b, invh); 165| | 166| | /* NOTE: Our definition of r as b/h mod (q, Phi_n) follows Figure 4 of */ 167| | /* [Sch18] https://eprint.iacr.org/2018/1174/20181203:032458. */ 168| | /* This differs from Figure 10 of Saito--Xagawa--Yamakawa */ 169| | /* [SXY17] https://eprint.iacr.org/2017/1005/20180516:055500 */ 170| | /* where r gets a final reduction modulo p. */ 171| | /* We need this change to use Proposition 1 of [Sch18]. */ 172| | 173| | /* Proposition 1 of [Sch18] shows that re-encryption with (r,m) yields c. */ 174| | /* if and only if fail==0 after the following call to owcpa_check_r */ 175| | /* The procedure given in Fig. 8 of [Sch18] can be skipped because we have */ 176| | /* c(1) = 0 due to the use of poly_Rq_sum_zero_{to,from}bytes. */ 177| 33| fail |= owcpa_check_r(r); 178| | 179| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_trinary_Zq_to_Z3(r); 180| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_tobytes(rm, r); 181| | 182| 33| return fail; 183| 33|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_tobytes: 3| 198|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_tobytes(unsigned char msg[NTRU_PACK_TRINARY_BYTES], const poly *a) { 4| 198| int i; 5| 198| unsigned char c; 6| 198| int j; 7| | 8| 48.7k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 25| 48.7k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 48.7k|#define NTRU_N 1229 | | ------------------ ------------------ | Branch (8:17): [True: 48.5k, False: 198] ------------------ 9| 48.5k| c = a->coeffs[5 * i + 4] & 255; 10| 48.5k| c = (3 * c + a->coeffs[5 * i + 3]) & 255; 11| 48.5k| c = (3 * c + a->coeffs[5 * i + 2]) & 255; 12| 48.5k| c = (3 * c + a->coeffs[5 * i + 1]) & 255; 13| 48.5k| c = (3 * c + a->coeffs[5 * i + 0]) & 255; 14| 48.5k| msg[i] = c; 15| 48.5k| } 16| 198| i = NTRU_PACK_DEG / 5; ------------------ | | 25| 198|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 198|#define NTRU_N 1229 | | ------------------ ------------------ 17| 198| c = 0; 18| 792| for (j = NTRU_PACK_DEG - (5 * i) - 1; j >= 0; j--) { ------------------ | | 25| 198|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 198|#define NTRU_N 1229 | | ------------------ ------------------ | Branch (18:43): [True: 594, False: 198] ------------------ 19| 594| c = (3 * c + a->coeffs[5 * i + j]) & 255; 20| 594| } 21| 198| msg[i] = c; 22| 198|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_frombytes: 24| 66|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_frombytes(poly *r, const unsigned char msg[NTRU_PACK_TRINARY_BYTES]) { 25| 66| int i; 26| 66| unsigned char c; 27| 66| int j; 28| | 29| 16.2k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 25| 16.2k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 16.2k|#define NTRU_N 1229 | | ------------------ ------------------ | Branch (29:17): [True: 16.1k, False: 66] ------------------ 30| 16.1k| c = msg[i]; 31| 16.1k| r->coeffs[5 * i + 0] = c; 32| 16.1k| r->coeffs[5 * i + 1] = c * 171 >> 9; // this is division by 3 33| 16.1k| r->coeffs[5 * i + 2] = c * 57 >> 9; // division by 3^2 34| 16.1k| r->coeffs[5 * i + 3] = c * 19 >> 9; // division by 3^3 35| 16.1k| r->coeffs[5 * i + 4] = c * 203 >> 14; // etc. 36| 16.1k| } 37| 66| i = NTRU_PACK_DEG / 5; ------------------ | | 25| 66|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 66|#define NTRU_N 1229 | | ------------------ ------------------ 38| 66| c = msg[i]; 39| 264| for (j = 0; (5 * i + j) < NTRU_PACK_DEG; j++) { ------------------ | | 25| 264|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 264|#define NTRU_N 1229 | | ------------------ ------------------ | Branch (39:17): [True: 198, False: 66] ------------------ 40| 198| r->coeffs[5 * i + j] = c; 41| 198| c = c * 171 >> 9; 42| 198| } 43| 66| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 66|#define NTRU_N 1229 ------------------ 44| 66| PQCLEAN_NTRUHPS40961229_CLEAN_poly_mod_3_Phi_n(r); 45| 66|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_tobytes: 4| 99|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_tobytes(unsigned char *r, const poly *a) { 5| 99| int i; 6| | 7| 60.8k| for (i = 0; i < NTRU_PACK_DEG / 2; i++) { ------------------ | | 25| 60.8k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 60.8k|#define NTRU_N 1229 | | ------------------ ------------------ | Branch (7:17): [True: 60.7k, False: 99] ------------------ 8| 60.7k| r[3 * i + 0] = (unsigned char) ( MODQ(a->coeffs[2 * i + 0]) & 0xff); ------------------ | | 9| 60.7k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 60.7k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 60.7k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 9| 60.7k| r[3 * i + 1] = (unsigned char) ((MODQ(a->coeffs[2 * i + 0]) >> 8) | ((MODQ(a->coeffs[2 * i + 1]) & 0x0f) << 4)); ------------------ | | 9| 60.7k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 60.7k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 60.7k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ r[3 * i + 1] = (unsigned char) ((MODQ(a->coeffs[2 * i + 0]) >> 8) | ((MODQ(a->coeffs[2 * i + 1]) & 0x0f) << 4)); ------------------ | | 9| 60.7k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 60.7k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 60.7k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 10| 60.7k| r[3 * i + 2] = (unsigned char) ((MODQ(a->coeffs[2 * i + 1]) >> 4)); ------------------ | | 9| 60.7k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 60.7k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 60.7k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 11| 60.7k| } 12| 99|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_frombytes: 14| 99|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_frombytes(poly *r, const unsigned char *a) { 15| 99| int i; 16| 60.8k| for (i = 0; i < NTRU_PACK_DEG / 2; i++) { ------------------ | | 25| 60.8k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 60.8k|#define NTRU_N 1229 | | ------------------ ------------------ | Branch (16:17): [True: 60.7k, False: 99] ------------------ 17| 60.7k| r->coeffs[2 * i + 0] = (a[3 * i + 0] >> 0) | (((uint16_t)a[3 * i + 1] & 0x0f) << 8); 18| 60.7k| r->coeffs[2 * i + 1] = (a[3 * i + 1] >> 4) | (((uint16_t)a[3 * i + 2] & 0xff) << 4); 19| 60.7k| } 20| 99| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 99|#define NTRU_N 1229 ------------------ 21| 99|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_sum_zero_tobytes: 23| 66|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_sum_zero_tobytes(unsigned char *r, const poly *a) { 24| 66| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_tobytes(r, a); 25| 66|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_sum_zero_frombytes: 27| 66|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_sum_zero_frombytes(poly *r, const unsigned char *a) { 28| 66| int i; 29| 66| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_frombytes(r, a); 30| | 31| | /* Set r[n-1] so that the sum of coefficients is zero mod q */ 32| 66| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 66|#define NTRU_N 1229 ------------------ 33| 81.1k| for (i = 0; i < NTRU_PACK_DEG; i++) { ------------------ | | 25| 81.1k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 81.1k|#define NTRU_N 1229 | | ------------------ ------------------ | Branch (33:17): [True: 81.0k, False: 66] ------------------ 34| 81.0k| r->coeffs[NTRU_N - 1] -= r->coeffs[i]; ------------------ | | 5| 81.0k|#define NTRU_N 1229 ------------------ 35| 81.0k| } 36| 66|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_Z3_to_Zq: 4| 198|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_Z3_to_Zq(poly *r) { 5| 198| int i; 6| 243k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 243k|#define NTRU_N 1229 ------------------ | Branch (6:17): [True: 243k, False: 198] ------------------ 7| 243k| r->coeffs[i] = r->coeffs[i] | ((-(r->coeffs[i] >> 1)) & (NTRU_Q - 1)); ------------------ | | 13| 243k|#define NTRU_Q (1 << NTRU_LOGQ) | | ------------------ | | | | 6| 243k|#define NTRU_LOGQ 12 | | ------------------ ------------------ 8| 243k| } 9| 198|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_trinary_Zq_to_Z3: 12| 33|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_trinary_Zq_to_Z3(poly *r) { 13| 33| int i; 14| 40.5k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 40.5k|#define NTRU_N 1229 ------------------ | Branch (14:17): [True: 40.5k, False: 33] ------------------ 15| 40.5k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 40.5k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 40.5k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 40.5k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 16| 40.5k| r->coeffs[i] = 3 & (r->coeffs[i] ^ (r->coeffs[i] >> (NTRU_LOGQ - 1))); ------------------ | | 6| 40.5k|#define NTRU_LOGQ 12 ------------------ 17| 40.5k| } 18| 33|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_mul: 20| 66|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_Sq_mul(poly *r, const poly *a, const poly *b) { 21| 66| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(r, a, b); 22| 66| PQCLEAN_NTRUHPS40961229_CLEAN_poly_mod_q_Phi_n(r); 23| 66|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_mul: 25| 33|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_mul(poly *r, const poly *a, const poly *b) { 26| 33| int i; 27| | 28| | /* Our S3 multiplications do not overflow mod q, */ 29| | /* so we can re-purpose PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul, as long as we */ 30| | /* follow with an explicit reduction mod q. */ 31| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(r, a, b); 32| 40.5k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 40.5k|#define NTRU_N 1229 ------------------ | Branch (32:17): [True: 40.5k, False: 33] ------------------ 33| 40.5k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 40.5k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 40.5k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 40.5k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 34| 40.5k| } 35| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_mod_3_Phi_n(r); 36| 33|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_inv: 71| 33|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_inv(poly *r, const poly *a) { 72| 33| poly ai2; 73| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_R2_inv(&ai2, a); 74| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_R2_inv_to_Rq_inv(r, &ai2, a); 75| 33|} poly.c:PQCLEAN_NTRUHPS40961229_CLEAN_poly_R2_inv_to_Rq_inv: 38| 33|static void PQCLEAN_NTRUHPS40961229_CLEAN_poly_R2_inv_to_Rq_inv(poly *r, const poly *ai, const poly *a) { 39| | 40| 33| int i; 41| 33| poly b, c; 42| 33| poly s; 43| | 44| | // for 0..4 45| | // ai = ai * (2 - a*ai) mod q 46| 40.5k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 40.5k|#define NTRU_N 1229 ------------------ | Branch (46:17): [True: 40.5k, False: 33] ------------------ 47| 40.5k| b.coeffs[i] = -(a->coeffs[i]); 48| 40.5k| } 49| | 50| 40.5k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 40.5k|#define NTRU_N 1229 ------------------ | Branch (50:17): [True: 40.5k, False: 33] ------------------ 51| 40.5k| r->coeffs[i] = ai->coeffs[i]; 52| 40.5k| } 53| | 54| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(&c, r, &b); 55| 33| c.coeffs[0] += 2; // c = 2 - a*ai 56| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(&s, &c, r); // s = ai*c 57| | 58| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(&c, &s, &b); 59| 33| c.coeffs[0] += 2; // c = 2 - a*s 60| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(r, &c, &s); // r = s*c 61| | 62| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(&c, r, &b); 63| 33| c.coeffs[0] += 2; // c = 2 - a*r 64| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(&s, &c, r); // s = r*c 65| | 66| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(&c, &s, &b); 67| 33| c.coeffs[0] += 2; // c = 2 - a*s 68| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(r, &c, &s); // r = s*c 69| 33|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_lift: 3| 66|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_lift(poly *r, const poly *a) { 4| 66| int i; 5| 81.1k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 81.1k|#define NTRU_N 1229 ------------------ | Branch (5:17): [True: 81.1k, False: 66] ------------------ 6| 81.1k| r->coeffs[i] = a->coeffs[i]; 7| 81.1k| } 8| 66| PQCLEAN_NTRUHPS40961229_CLEAN_poly_Z3_to_Zq(r); 9| 66|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_mod_3_Phi_n: 18| 132|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_mod_3_Phi_n(poly *r) { 19| 132| int i; 20| 162k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 162k|#define NTRU_N 1229 ------------------ | Branch (20:17): [True: 162k, False: 132] ------------------ 21| 162k| r->coeffs[i] = mod3(r->coeffs[i] + 2 * r->coeffs[NTRU_N - 1]); ------------------ | | 5| 162k|#define NTRU_N 1229 ------------------ 22| 162k| } 23| 132|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_mod_q_Phi_n: 25| 66|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_mod_q_Phi_n(poly *r) { 26| 66| int i; 27| 81.1k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 81.1k|#define NTRU_N 1229 ------------------ | Branch (27:17): [True: 81.1k, False: 66] ------------------ 28| 81.1k| r->coeffs[i] = r->coeffs[i] - r->coeffs[NTRU_N - 1]; ------------------ | | 5| 81.1k|#define NTRU_N 1229 ------------------ 29| 81.1k| } 30| 66|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_to_S3: 32| 33|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_to_S3(poly *r, const poly *a) { 33| 33| int i; 34| 33| uint16_t flag; 35| | 36| | /* The coefficients of a are stored as non-negative integers. */ 37| | /* We must translate to representatives in [-q/2, q/2) before */ 38| | /* reduction mod 3. */ 39| 40.5k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 40.5k|#define NTRU_N 1229 ------------------ | Branch (39:17): [True: 40.5k, False: 33] ------------------ 40| | /* Need an explicit reduction mod q here */ 41| 40.5k| r->coeffs[i] = MODQ(a->coeffs[i]); ------------------ | | 9| 40.5k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 40.5k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 40.5k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 42| | 43| | /* flag = 1 if r[i] >= q/2 else 0 */ 44| 40.5k| flag = r->coeffs[i] >> (NTRU_LOGQ - 1); ------------------ | | 6| 40.5k|#define NTRU_LOGQ 12 ------------------ 45| | 46| | /* Now we will add (-q) mod 3 if r[i] >= q/2 */ 47| | /* Note (-q) mod 3=(-2^k) mod 3=1<<(1-(k&1)) */ 48| 40.5k| r->coeffs[i] += flag << (1 - (NTRU_LOGQ & 1)); ------------------ | | 6| 40.5k|#define NTRU_LOGQ 12 ------------------ 49| 40.5k| } 50| | 51| 33| PQCLEAN_NTRUHPS40961229_CLEAN_poly_mod_3_Phi_n(r); 52| 33|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_R2_inv: 10| 33|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_R2_inv(poly *r, const poly *a) { 11| 33| poly f, g, v, w; 12| 33| size_t i, loop; 13| 33| int16_t delta, sign, swap, t; 14| | 15| 40.5k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 40.5k|#define NTRU_N 1229 ------------------ | Branch (15:17): [True: 40.5k, False: 33] ------------------ 16| 40.5k| v.coeffs[i] = 0; 17| 40.5k| } 18| 40.5k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 40.5k|#define NTRU_N 1229 ------------------ | Branch (18:17): [True: 40.5k, False: 33] ------------------ 19| 40.5k| w.coeffs[i] = 0; 20| 40.5k| } 21| 33| w.coeffs[0] = 1; 22| | 23| 40.5k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 40.5k|#define NTRU_N 1229 ------------------ | Branch (23:17): [True: 40.5k, False: 33] ------------------ 24| 40.5k| f.coeffs[i] = 1; 25| 40.5k| } 26| 40.5k| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 40.5k|#define NTRU_N 1229 ------------------ | Branch (26:17): [True: 40.5k, False: 33] ------------------ 27| 40.5k| g.coeffs[NTRU_N - 2 - i] = (a->coeffs[i] ^ a->coeffs[NTRU_N - 1]) & 1; ------------------ | | 5| 40.5k|#define NTRU_N 1229 ------------------ g.coeffs[NTRU_N - 2 - i] = (a->coeffs[i] ^ a->coeffs[NTRU_N - 1]) & 1; ------------------ | | 5| 40.5k|#define NTRU_N 1229 ------------------ 28| 40.5k| } 29| 33| g.coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 33|#define NTRU_N 1229 ------------------ 30| | 31| 33| delta = 1; 32| | 33| 81.0k| for (loop = 0; loop < 2 * (NTRU_N - 1) - 1; ++loop) { ------------------ | | 5| 81.0k|#define NTRU_N 1229 ------------------ | Branch (33:20): [True: 81.0k, False: 33] ------------------ 34| 99.5M| for (i = NTRU_N - 1; i > 0; --i) { ------------------ | | 5| 81.0k|#define NTRU_N 1229 ------------------ | Branch (34:30): [True: 99.4M, False: 81.0k] ------------------ 35| 99.4M| v.coeffs[i] = v.coeffs[i - 1]; 36| 99.4M| } 37| 81.0k| v.coeffs[0] = 0; 38| | 39| 81.0k| sign = g.coeffs[0] & f.coeffs[0]; 40| 81.0k| swap = both_negative_mask(-delta, -(int16_t) g.coeffs[0]); 41| 81.0k| delta ^= swap & (delta ^ -delta); 42| 81.0k| delta += 1; 43| | 44| 99.6M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 99.6M|#define NTRU_N 1229 ------------------ | Branch (44:21): [True: 99.5M, False: 81.0k] ------------------ 45| 99.5M| t = swap & (f.coeffs[i] ^ g.coeffs[i]); 46| 99.5M| f.coeffs[i] ^= t; 47| 99.5M| g.coeffs[i] ^= t; 48| 99.5M| t = swap & (v.coeffs[i] ^ w.coeffs[i]); 49| 99.5M| v.coeffs[i] ^= t; 50| 99.5M| w.coeffs[i] ^= t; 51| 99.5M| } 52| | 53| 99.6M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 99.6M|#define NTRU_N 1229 ------------------ | Branch (53:21): [True: 99.5M, False: 81.0k] ------------------ 54| 99.5M| g.coeffs[i] = g.coeffs[i] ^ (sign & f.coeffs[i]); 55| 99.5M| } 56| 99.6M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 99.6M|#define NTRU_N 1229 ------------------ | Branch (56:21): [True: 99.5M, False: 81.0k] ------------------ 57| 99.5M| w.coeffs[i] = w.coeffs[i] ^ (sign & v.coeffs[i]); 58| 99.5M| } 59| 99.5M| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 99.5M|#define NTRU_N 1229 ------------------ | Branch (59:21): [True: 99.4M, False: 81.0k] ------------------ 60| 99.4M| g.coeffs[i] = g.coeffs[i + 1]; 61| 99.4M| } 62| 81.0k| g.coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 81.0k|#define NTRU_N 1229 ------------------ 63| 81.0k| } 64| | 65| 40.5k| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 40.5k|#define NTRU_N 1229 ------------------ | Branch (65:17): [True: 40.5k, False: 33] ------------------ 66| 40.5k| r->coeffs[i] = v.coeffs[NTRU_N - 2 - i]; ------------------ | | 5| 40.5k|#define NTRU_N 1229 ------------------ 67| 40.5k| } 68| 33| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 33|#define NTRU_N 1229 ------------------ 69| 33|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul: 27| 561|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_Rq_mul(poly *r, const poly *a, const poly *b) { 28| 561| size_t i; 29| 561| uint16_t ab[2 * L]; 30| | 31| 690k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 690k|#define NTRU_N 1229 ------------------ | Branch (31:17): [True: 689k, False: 561] ------------------ 32| 689k| ab[i] = a->coeffs[i]; 33| 689k| ab[L + i] = b->coeffs[i]; ------------------ | | 6| 689k|#define L PAD32(NTRU_N) | | ------------------ | | | | 11| 689k|#define PAD32(X) ((((X) + 31)/32)*32) | | ------------------ ------------------ 34| 689k| } 35| 11.2k| for (i = NTRU_N; i < L; i++) { ------------------ | | 5| 561|#define NTRU_N 1229 ------------------ for (i = NTRU_N; i < L; i++) { ------------------ | | 6| 11.2k|#define L PAD32(NTRU_N) | | ------------------ | | | | 11| 11.2k|#define PAD32(X) ((((X) + 31)/32)*32) | | ------------------ ------------------ | Branch (35:22): [True: 10.6k, False: 561] ------------------ 36| 10.6k| ab[i] = 0; 37| 10.6k| ab[L + i] = 0; ------------------ | | 6| 10.6k|#define L PAD32(NTRU_N) | | ------------------ | | | | 11| 10.6k|#define PAD32(X) ((((X) + 31)/32)*32) | | ------------------ ------------------ 38| 10.6k| } 39| | 40| 561| toom4_k2x2_mul(ab, ab, ab + L); ------------------ | | 6| 561|#define L PAD32(NTRU_N) | | ------------------ | | | | 11| 561|#define PAD32(X) ((((X) + 31)/32)*32) | | ------------------ ------------------ 41| | 42| 690k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 690k|#define NTRU_N 1229 ------------------ | Branch (42:17): [True: 689k, False: 561] ------------------ 43| 689k| r->coeffs[i] = ab[i] + ab[NTRU_N + i]; ------------------ | | 5| 689k|#define NTRU_N 1229 ------------------ 44| 689k| } 45| 561|} PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_inv: 18| 33|void PQCLEAN_NTRUHPS40961229_CLEAN_poly_S3_inv(poly *r, const poly *a) { 19| 33| poly f, g, v, w; 20| 33| size_t i, loop; 21| 33| int16_t delta, sign, swap, t; 22| | 23| 40.5k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 40.5k|#define NTRU_N 1229 ------------------ | Branch (23:17): [True: 40.5k, False: 33] ------------------ 24| 40.5k| v.coeffs[i] = 0; 25| 40.5k| } 26| 40.5k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 40.5k|#define NTRU_N 1229 ------------------ | Branch (26:17): [True: 40.5k, False: 33] ------------------ 27| 40.5k| w.coeffs[i] = 0; 28| 40.5k| } 29| 33| w.coeffs[0] = 1; 30| | 31| 40.5k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 40.5k|#define NTRU_N 1229 ------------------ | Branch (31:17): [True: 40.5k, False: 33] ------------------ 32| 40.5k| f.coeffs[i] = 1; 33| 40.5k| } 34| 40.5k| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 40.5k|#define NTRU_N 1229 ------------------ | Branch (34:17): [True: 40.5k, False: 33] ------------------ 35| 40.5k| g.coeffs[NTRU_N - 2 - i] = mod3((a->coeffs[i] & 3) + 2 * (a->coeffs[NTRU_N - 1] & 3)); ------------------ | | 5| 40.5k|#define NTRU_N 1229 ------------------ g.coeffs[NTRU_N - 2 - i] = mod3((a->coeffs[i] & 3) + 2 * (a->coeffs[NTRU_N - 1] & 3)); ------------------ | | 5| 40.5k|#define NTRU_N 1229 ------------------ 36| 40.5k| } 37| 33| g.coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 33|#define NTRU_N 1229 ------------------ 38| | 39| 33| delta = 1; 40| | 41| 81.0k| for (loop = 0; loop < 2 * (NTRU_N - 1) - 1; ++loop) { ------------------ | | 5| 81.0k|#define NTRU_N 1229 ------------------ | Branch (41:20): [True: 81.0k, False: 33] ------------------ 42| 99.5M| for (i = NTRU_N - 1; i > 0; --i) { ------------------ | | 5| 81.0k|#define NTRU_N 1229 ------------------ | Branch (42:30): [True: 99.4M, False: 81.0k] ------------------ 43| 99.4M| v.coeffs[i] = v.coeffs[i - 1]; 44| 99.4M| } 45| 81.0k| v.coeffs[0] = 0; 46| | 47| 81.0k| sign = mod3((uint8_t) (2 * g.coeffs[0] * f.coeffs[0])); 48| 81.0k| swap = both_negative_mask(-delta, -(int16_t) g.coeffs[0]); 49| 81.0k| delta ^= swap & (delta ^ -delta); 50| 81.0k| delta += 1; 51| | 52| 99.6M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 99.6M|#define NTRU_N 1229 ------------------ | Branch (52:21): [True: 99.5M, False: 81.0k] ------------------ 53| 99.5M| t = swap & (f.coeffs[i] ^ g.coeffs[i]); 54| 99.5M| f.coeffs[i] ^= t; 55| 99.5M| g.coeffs[i] ^= t; 56| 99.5M| t = swap & (v.coeffs[i] ^ w.coeffs[i]); 57| 99.5M| v.coeffs[i] ^= t; 58| 99.5M| w.coeffs[i] ^= t; 59| 99.5M| } 60| | 61| 99.6M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 99.6M|#define NTRU_N 1229 ------------------ | Branch (61:21): [True: 99.5M, False: 81.0k] ------------------ 62| 99.5M| g.coeffs[i] = mod3((uint8_t) (g.coeffs[i] + sign * f.coeffs[i])); 63| 99.5M| } 64| 99.6M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 99.6M|#define NTRU_N 1229 ------------------ | Branch (64:21): [True: 99.5M, False: 81.0k] ------------------ 65| 99.5M| w.coeffs[i] = mod3((uint8_t) (w.coeffs[i] + sign * v.coeffs[i])); 66| 99.5M| } 67| 99.5M| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 99.5M|#define NTRU_N 1229 ------------------ | Branch (67:21): [True: 99.4M, False: 81.0k] ------------------ 68| 99.4M| g.coeffs[i] = g.coeffs[i + 1]; 69| 99.4M| } 70| 81.0k| g.coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 81.0k|#define NTRU_N 1229 ------------------ 71| 81.0k| } 72| | 73| 33| sign = f.coeffs[0]; 74| 40.5k| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 40.5k|#define NTRU_N 1229 ------------------ | Branch (74:17): [True: 40.5k, False: 33] ------------------ 75| 40.5k| r->coeffs[i] = mod3((uint8_t) (sign * v.coeffs[NTRU_N - 2 - i])); ------------------ | | 5| 40.5k|#define NTRU_N 1229 ------------------ 76| 40.5k| } 77| 33| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 33|#define NTRU_N 1229 ------------------ 78| 33|} PQCLEAN_NTRUHPS40961229_CLEAN_sample_fg: 3| 33|void PQCLEAN_NTRUHPS40961229_CLEAN_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]) { 4| | 5| 33| PQCLEAN_NTRUHPS40961229_CLEAN_sample_iid(f, uniformbytes); 6| 33| PQCLEAN_NTRUHPS40961229_CLEAN_sample_fixed_type(g, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 20| 33|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 33|#define NTRU_N 1229 | | ------------------ ------------------ 7| 33|} PQCLEAN_NTRUHPS40961229_CLEAN_sample_rm: 9| 33|void PQCLEAN_NTRUHPS40961229_CLEAN_sample_rm(poly *r, poly *m, const unsigned char uniformbytes[NTRU_SAMPLE_RM_BYTES]) { 10| | 11| 33| PQCLEAN_NTRUHPS40961229_CLEAN_sample_iid(r, uniformbytes); 12| 33| PQCLEAN_NTRUHPS40961229_CLEAN_sample_fixed_type(m, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 20| 33|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 33|#define NTRU_N 1229 | | ------------------ ------------------ 13| 33|} PQCLEAN_NTRUHPS40961229_CLEAN_sample_fixed_type: 16| 66|void PQCLEAN_NTRUHPS40961229_CLEAN_sample_fixed_type(poly *r, const unsigned char u[NTRU_SAMPLE_FT_BYTES]) { 17| | // Assumes NTRU_SAMPLE_FT_BYTES = ceil(30*(n-1)/8) 18| | 19| 66| int32_t s[NTRU_N - 1]; 20| 66| int i; 21| | 22| | // Use 30 bits of u per word 23| 20.3k| for (i = 0; i < (NTRU_N - 1) / 4; i++) { ------------------ | | 5| 20.3k|#define NTRU_N 1229 ------------------ | Branch (23:17): [True: 20.2k, False: 66] ------------------ 24| 20.2k| s[4 * i + 0] = (u[15 * i + 0] << 2) + (u[15 * i + 1] << 10) + (u[15 * i + 2] << 18) + ((uint32_t) u[15 * i + 3] << 26); 25| 20.2k| s[4 * i + 1] = ((u[15 * i + 3] & 0xc0) >> 4) + (u[15 * i + 4] << 4) + (u[15 * i + 5] << 12) + (u[15 * i + 6] << 20) + ((uint32_t) u[15 * i + 7] << 28); 26| 20.2k| s[4 * i + 2] = ((u[15 * i + 7] & 0xf0) >> 2) + (u[15 * i + 8] << 6) + (u[15 * i + 9] << 14) + (u[15 * i + 10] << 22) + ((uint32_t) u[15 * i + 11] << 30); 27| 20.2k| s[4 * i + 3] = (u[15 * i + 11] & 0xfc) + (u[15 * i + 12] << 8) + (u[15 * i + 13] << 16) + ((uint32_t) u[15 * i + 14] << 24); 28| 20.2k| } 29| | 30| 16.8k| for (i = 0; i < NTRU_WEIGHT / 2; i++) { ------------------ | | 14| 16.8k|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 16.8k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 16.8k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ | Branch (30:17): [True: 16.8k, False: 66] ------------------ 31| 16.8k| s[i] |= 1; 32| 16.8k| } 33| | 34| 16.8k| for (i = NTRU_WEIGHT / 2; i < NTRU_WEIGHT; i++) { ------------------ | | 14| 66|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 66|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 66|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ for (i = NTRU_WEIGHT / 2; i < NTRU_WEIGHT; i++) { ------------------ | | 14| 16.8k|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 16.8k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 16.8k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ | Branch (34:31): [True: 16.8k, False: 66] ------------------ 35| 16.8k| s[i] |= 2; 36| 16.8k| } 37| | 38| 66| PQCLEAN_NTRUHPS40961229_CLEAN_crypto_sort_int32(s, NTRU_N - 1); ------------------ | | 5| 66|#define NTRU_N 1229 ------------------ 39| | 40| 81.1k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 81.1k|#define NTRU_N 1229 ------------------ | Branch (40:17): [True: 81.0k, False: 66] ------------------ 41| 81.0k| r->coeffs[i] = ((uint16_t) (s[i] & 3)); 42| 81.0k| } 43| | 44| 66| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 66|#define NTRU_N 1229 ------------------ 45| 66|} PQCLEAN_NTRUHPS40961229_CLEAN_sample_iid: 18| 66|void PQCLEAN_NTRUHPS40961229_CLEAN_sample_iid(poly *r, const unsigned char uniformbytes[NTRU_SAMPLE_IID_BYTES]) { 19| 66| int i; 20| | /* {0,1,...,255} -> {0,1,2}; Pr[0] = 86/256, Pr[1] = Pr[-1] = 85/256 */ 21| 81.1k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 81.1k|#define NTRU_N 1229 ------------------ | Branch (21:17): [True: 81.0k, False: 66] ------------------ 22| 81.0k| r->coeffs[i] = mod3(uniformbytes[i]); 23| 81.0k| } 24| | 25| 66| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 66|#define NTRU_N 1229 ------------------ 26| 66|} PQCLEAN_NTRUHPS4096821_AVX2_cmov: 4| 95|void PQCLEAN_NTRUHPS4096821_AVX2_cmov(unsigned char *r, const unsigned char *x, size_t len, unsigned char b) { 5| 95| size_t i; 6| | 7| 95| b = (~b + 1); 8| 3.13k| for (i = 0; i < len; i++) { ------------------ | Branch (8:17): [True: 3.04k, False: 95] ------------------ 9| 3.04k| r[i] ^= b & (x[i] ^ r[i]); 10| 3.04k| } 11| 95|} PQCLEAN_NTRUHPS4096821_AVX2_crypto_sort_int32: 903| 570|void PQCLEAN_NTRUHPS4096821_AVX2_crypto_sort_int32(int32 *x, size_t n) { 904| 570| size_t q, i, j; 905| | 906| 570| if (n <= 8) { ------------------ | Branch (906:9): [True: 0, False: 570] ------------------ 907| 0| if (n == 8) { ------------------ | Branch (907:13): [True: 0, False: 0] ------------------ 908| 0| int32_MINMAX(&x[0], &x[1]); 909| 0| int32_MINMAX(&x[1], &x[2]); 910| 0| int32_MINMAX(&x[2], &x[3]); 911| 0| int32_MINMAX(&x[3], &x[4]); 912| 0| int32_MINMAX(&x[4], &x[5]); 913| 0| int32_MINMAX(&x[5], &x[6]); 914| 0| int32_MINMAX(&x[6], &x[7]); 915| 0| } 916| 0| if (n >= 7) { ------------------ | Branch (916:13): [True: 0, False: 0] ------------------ 917| 0| int32_MINMAX(&x[0], &x[1]); 918| 0| int32_MINMAX(&x[1], &x[2]); 919| 0| int32_MINMAX(&x[2], &x[3]); 920| 0| int32_MINMAX(&x[3], &x[4]); 921| 0| int32_MINMAX(&x[4], &x[5]); 922| 0| int32_MINMAX(&x[5], &x[6]); 923| 0| } 924| 0| if (n >= 6) { ------------------ | Branch (924:13): [True: 0, False: 0] ------------------ 925| 0| int32_MINMAX(&x[0], &x[1]); 926| 0| int32_MINMAX(&x[1], &x[2]); 927| 0| int32_MINMAX(&x[2], &x[3]); 928| 0| int32_MINMAX(&x[3], &x[4]); 929| 0| int32_MINMAX(&x[4], &x[5]); 930| 0| } 931| 0| if (n >= 5) { ------------------ | Branch (931:13): [True: 0, False: 0] ------------------ 932| 0| int32_MINMAX(&x[0], &x[1]); 933| 0| int32_MINMAX(&x[1], &x[2]); 934| 0| int32_MINMAX(&x[2], &x[3]); 935| 0| int32_MINMAX(&x[3], &x[4]); 936| 0| } 937| 0| if (n >= 4) { ------------------ | Branch (937:13): [True: 0, False: 0] ------------------ 938| 0| int32_MINMAX(&x[0], &x[1]); 939| 0| int32_MINMAX(&x[1], &x[2]); 940| 0| int32_MINMAX(&x[2], &x[3]); 941| 0| } 942| 0| if (n >= 3) { ------------------ | Branch (942:13): [True: 0, False: 0] ------------------ 943| 0| int32_MINMAX(&x[0], &x[1]); 944| 0| int32_MINMAX(&x[1], &x[2]); 945| 0| } 946| 0| if (n >= 2) { ------------------ | Branch (946:13): [True: 0, False: 0] ------------------ 947| 0| int32_MINMAX(&x[0], &x[1]); 948| 0| } 949| 0| return; 950| 0| } 951| | 952| 570| if (!(n & (n - 1))) { ------------------ | Branch (952:9): [True: 0, False: 570] ------------------ 953| 0| int32_sort_2power(x, n, 0); 954| 0| return; 955| 0| } 956| | 957| 570| q = 8; 958| 3.04k| while (q < n - q) { ------------------ | Branch (958:12): [True: 2.47k, False: 570] ------------------ 959| 2.47k| q += q; 960| 2.47k| } 961| | /* n > q >= 8 */ 962| | 963| 570| if (q <= 128) { /* n <= 256 */ ------------------ | Branch (963:9): [True: 190, False: 380] ------------------ 964| 190| int32x8 y[32]; 965| 950| for (i = q >> 3; i < q >> 2; ++i) { ------------------ | Branch (965:26): [True: 760, False: 190] ------------------ 966| 760| y[i] = _mm256_set1_epi32(0x7fffffff); 967| 760| } 968| 10.0k| for (i = 0; i < n; ++i) { ------------------ | Branch (968:21): [True: 9.88k, False: 190] ------------------ 969| 9.88k| ((int32 *) y)[i] = x[i]; 970| 9.88k| } 971| 190| int32_sort_2power((int32 *) y, 2 * q, 0); 972| 10.0k| for (i = 0; i < n; ++i) { ------------------ | Branch (972:21): [True: 9.88k, False: 190] ------------------ 973| 9.88k| x[i] = ((int32 *) y)[i]; 974| 9.88k| } 975| 190| return; 976| 190| } 977| | 978| 380| int32_sort_2power(x, q, 1); 979| 380| PQCLEAN_NTRUHPS4096821_AVX2_crypto_sort_int32(x + q, n - q); 980| | 981| 950| while (q >= 64) { ------------------ | Branch (981:12): [True: 570, False: 380] ------------------ 982| 570| q >>= 2; 983| 570| j = int32_threestages(x, n, q); 984| 570| minmax_vector(x + j, x + j + 4 * q, n - 4 * q - j); 985| 570| if (j + 4 * q <= n) { ------------------ | Branch (985:13): [True: 380, False: 190] ------------------ 986| 4.94k| for (i = j; i < j + q; i += 8) { ------------------ | Branch (986:25): [True: 4.56k, False: 380] ------------------ 987| 4.56k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 4.56k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 988| 4.56k| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 4.56k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 989| 4.56k| int32x8 x2 = int32x8_load(&x[i + 2 * q]); ------------------ | | 9| 4.56k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 990| 4.56k| int32x8 x3 = int32x8_load(&x[i + 3 * q]); ------------------ | | 9| 4.56k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 991| 4.56k| int32x8_MINMAX(x0, x2); ------------------ | | 15| 4.56k| do { \ | | 16| 4.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 4.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 4.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 4.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 4.56k| (a) = c; \ | | 19| 4.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 4.56k] | | ------------------ ------------------ 992| 4.56k| int32x8_MINMAX(x1, x3); ------------------ | | 15| 4.56k| do { \ | | 16| 4.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 4.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 4.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 4.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 4.56k| (a) = c; \ | | 19| 4.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 4.56k] | | ------------------ ------------------ 993| 4.56k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 4.56k| do { \ | | 16| 4.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 4.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 4.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 4.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 4.56k| (a) = c; \ | | 19| 4.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 4.56k] | | ------------------ ------------------ 994| 4.56k| int32x8_MINMAX(x2, x3); ------------------ | | 15| 4.56k| do { \ | | 16| 4.56k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 4.56k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 4.56k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 4.56k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 4.56k| (a) = c; \ | | 19| 4.56k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 4.56k] | | ------------------ ------------------ 995| 4.56k| int32x8_store(&x[i], x0); ------------------ | | 10| 4.56k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 996| 4.56k| int32x8_store(&x[i + q], x1); ------------------ | | 10| 4.56k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 997| 4.56k| int32x8_store(&x[i + 2 * q], x2); ------------------ | | 10| 4.56k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 998| 4.56k| int32x8_store(&x[i + 3 * q], x3); ------------------ | | 10| 4.56k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 999| 4.56k| } 1000| 380| j += 4 * q; 1001| 380| } 1002| 570| minmax_vector(x + j, x + j + 2 * q, n - 2 * q - j); 1003| 570| if (j + 2 * q <= n) { ------------------ | Branch (1003:13): [True: 380, False: 190] ------------------ 1004| 3.80k| for (i = j; i < j + q; i += 8) { ------------------ | Branch (1004:25): [True: 3.42k, False: 380] ------------------ 1005| 3.42k| int32x8 x0 = int32x8_load(&x[i]); ------------------ | | 9| 3.42k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1006| 3.42k| int32x8 x1 = int32x8_load(&x[i + q]); ------------------ | | 9| 3.42k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1007| 3.42k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 3.42k| do { \ | | 16| 3.42k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 3.42k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 3.42k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 3.42k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 3.42k| (a) = c; \ | | 19| 3.42k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 3.42k] | | ------------------ ------------------ 1008| 3.42k| int32x8_store(&x[i], x0); ------------------ | | 10| 3.42k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1009| 3.42k| int32x8_store(&x[i + q], x1); ------------------ | | 10| 3.42k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1010| 3.42k| } 1011| 380| j += 2 * q; 1012| 380| } 1013| 570| minmax_vector(x + j, x + j + q, n - q - j); 1014| 570| q >>= 1; 1015| 570| } 1016| 380| if (q == 32) { ------------------ | Branch (1016:9): [True: 190, False: 190] ------------------ 1017| 190| j = 0; 1018| 950| for (; j + 64 <= n; j += 64) { ------------------ | Branch (1018:16): [True: 760, False: 190] ------------------ 1019| 760| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 760|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1020| 760| int32x8 x1 = int32x8_load(&x[j + 8]); ------------------ | | 9| 760|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1021| 760| int32x8 x2 = int32x8_load(&x[j + 16]); ------------------ | | 9| 760|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1022| 760| int32x8 x3 = int32x8_load(&x[j + 24]); ------------------ | | 9| 760|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1023| 760| int32x8 x4 = int32x8_load(&x[j + 32]); ------------------ | | 9| 760|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1024| 760| int32x8 x5 = int32x8_load(&x[j + 40]); ------------------ | | 9| 760|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1025| 760| int32x8 x6 = int32x8_load(&x[j + 48]); ------------------ | | 9| 760|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1026| 760| int32x8 x7 = int32x8_load(&x[j + 56]); ------------------ | | 9| 760|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1027| 760| int32x8_MINMAX(x0, x4); ------------------ | | 15| 760| do { \ | | 16| 760| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 760|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 760| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 760|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 760| (a) = c; \ | | 19| 760| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 760] | | ------------------ ------------------ 1028| 760| int32x8_MINMAX(x1, x5); ------------------ | | 15| 760| do { \ | | 16| 760| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 760|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 760| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 760|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 760| (a) = c; \ | | 19| 760| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 760] | | ------------------ ------------------ 1029| 760| int32x8_MINMAX(x2, x6); ------------------ | | 15| 760| do { \ | | 16| 760| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 760|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 760| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 760|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 760| (a) = c; \ | | 19| 760| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 760] | | ------------------ ------------------ 1030| 760| int32x8_MINMAX(x3, x7); ------------------ | | 15| 760| do { \ | | 16| 760| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 760|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 760| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 760|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 760| (a) = c; \ | | 19| 760| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 760] | | ------------------ ------------------ 1031| 760| int32x8_MINMAX(x0, x2); ------------------ | | 15| 760| do { \ | | 16| 760| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 760|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 760| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 760|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 760| (a) = c; \ | | 19| 760| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 760] | | ------------------ ------------------ 1032| 760| int32x8_MINMAX(x1, x3); ------------------ | | 15| 760| do { \ | | 16| 760| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 760|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 760| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 760|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 760| (a) = c; \ | | 19| 760| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 760] | | ------------------ ------------------ 1033| 760| int32x8_MINMAX(x4, x6); ------------------ | | 15| 760| do { \ | | 16| 760| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 760|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 760| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 760|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 760| (a) = c; \ | | 19| 760| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 760] | | ------------------ ------------------ 1034| 760| int32x8_MINMAX(x5, x7); ------------------ | | 15| 760| do { \ | | 16| 760| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 760|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 760| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 760|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 760| (a) = c; \ | | 19| 760| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 760] | | ------------------ ------------------ 1035| 760| int32x8_MINMAX(x0, x1); ------------------ | | 15| 760| do { \ | | 16| 760| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 760|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 760| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 760|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 760| (a) = c; \ | | 19| 760| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 760] | | ------------------ ------------------ 1036| 760| int32x8_MINMAX(x2, x3); ------------------ | | 15| 760| do { \ | | 16| 760| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 760|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 760| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 760|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 760| (a) = c; \ | | 19| 760| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 760] | | ------------------ ------------------ 1037| 760| int32x8_MINMAX(x4, x5); ------------------ | | 15| 760| do { \ | | 16| 760| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 760|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 760| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 760|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 760| (a) = c; \ | | 19| 760| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 760] | | ------------------ ------------------ 1038| 760| int32x8_MINMAX(x6, x7); ------------------ | | 15| 760| do { \ | | 16| 760| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 760|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 760| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 760|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 760| (a) = c; \ | | 19| 760| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 760] | | ------------------ ------------------ 1039| 760| int32x8 a0 = _mm256_permute2x128_si256(x0, x1, 0x20); 1040| 760| int32x8 a1 = _mm256_permute2x128_si256(x0, x1, 0x31); 1041| 760| int32x8 a2 = _mm256_permute2x128_si256(x2, x3, 0x20); 1042| 760| int32x8 a3 = _mm256_permute2x128_si256(x2, x3, 0x31); 1043| 760| int32x8 a4 = _mm256_permute2x128_si256(x4, x5, 0x20); 1044| 760| int32x8 a5 = _mm256_permute2x128_si256(x4, x5, 0x31); 1045| 760| int32x8 a6 = _mm256_permute2x128_si256(x6, x7, 0x20); 1046| 760| int32x8 a7 = _mm256_permute2x128_si256(x6, x7, 0x31); 1047| 760| int32x8_MINMAX(a0, a1); ------------------ | | 15| 760| do { \ | | 16| 760| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 760|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 760| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 760|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 760| (a) = c; \ | | 19| 760| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 760] | | ------------------ ------------------ 1048| 760| int32x8_MINMAX(a2, a3); ------------------ | | 15| 760| do { \ | | 16| 760| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 760|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 760| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 760|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 760| (a) = c; \ | | 19| 760| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 760] | | ------------------ ------------------ 1049| 760| int32x8_MINMAX(a4, a5); ------------------ | | 15| 760| do { \ | | 16| 760| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 760|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 760| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 760|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 760| (a) = c; \ | | 19| 760| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 760] | | ------------------ ------------------ 1050| 760| int32x8_MINMAX(a6, a7); ------------------ | | 15| 760| do { \ | | 16| 760| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 760|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 760| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 760|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 760| (a) = c; \ | | 19| 760| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 760] | | ------------------ ------------------ 1051| 760| int32x8 b0 = _mm256_permute2x128_si256(a0, a1, 0x20); 1052| 760| int32x8 b1 = _mm256_permute2x128_si256(a0, a1, 0x31); 1053| 760| int32x8 b2 = _mm256_permute2x128_si256(a2, a3, 0x20); 1054| 760| int32x8 b3 = _mm256_permute2x128_si256(a2, a3, 0x31); 1055| 760| int32x8 b4 = _mm256_permute2x128_si256(a4, a5, 0x20); 1056| 760| int32x8 b5 = _mm256_permute2x128_si256(a4, a5, 0x31); 1057| 760| int32x8 b6 = _mm256_permute2x128_si256(a6, a7, 0x20); 1058| 760| int32x8 b7 = _mm256_permute2x128_si256(a6, a7, 0x31); 1059| 760| int32x8 c0 = _mm256_unpacklo_epi64(b0, b1); 1060| 760| int32x8 c1 = _mm256_unpackhi_epi64(b0, b1); 1061| 760| int32x8 c2 = _mm256_unpacklo_epi64(b2, b3); 1062| 760| int32x8 c3 = _mm256_unpackhi_epi64(b2, b3); 1063| 760| int32x8 c4 = _mm256_unpacklo_epi64(b4, b5); 1064| 760| int32x8 c5 = _mm256_unpackhi_epi64(b4, b5); 1065| 760| int32x8 c6 = _mm256_unpacklo_epi64(b6, b7); 1066| 760| int32x8 c7 = _mm256_unpackhi_epi64(b6, b7); 1067| 760| int32x8_MINMAX(c0, c1); ------------------ | | 15| 760| do { \ | | 16| 760| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 760|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 760| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 760|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 760| (a) = c; \ | | 19| 760| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 760] | | ------------------ ------------------ 1068| 760| int32x8_MINMAX(c2, c3); ------------------ | | 15| 760| do { \ | | 16| 760| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 760|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 760| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 760|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 760| (a) = c; \ | | 19| 760| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 760] | | ------------------ ------------------ 1069| 760| int32x8_MINMAX(c4, c5); ------------------ | | 15| 760| do { \ | | 16| 760| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 760|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 760| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 760|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 760| (a) = c; \ | | 19| 760| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 760] | | ------------------ ------------------ 1070| 760| int32x8_MINMAX(c6, c7); ------------------ | | 15| 760| do { \ | | 16| 760| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 760|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 760| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 760|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 760| (a) = c; \ | | 19| 760| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 760] | | ------------------ ------------------ 1071| 760| int32x8 d0 = _mm256_unpacklo_epi32(c0, c1); 1072| 760| int32x8 d1 = _mm256_unpackhi_epi32(c0, c1); 1073| 760| int32x8 d2 = _mm256_unpacklo_epi32(c2, c3); 1074| 760| int32x8 d3 = _mm256_unpackhi_epi32(c2, c3); 1075| 760| int32x8 d4 = _mm256_unpacklo_epi32(c4, c5); 1076| 760| int32x8 d5 = _mm256_unpackhi_epi32(c4, c5); 1077| 760| int32x8 d6 = _mm256_unpacklo_epi32(c6, c7); 1078| 760| int32x8 d7 = _mm256_unpackhi_epi32(c6, c7); 1079| 760| int32x8 e0 = _mm256_unpacklo_epi64(d0, d1); 1080| 760| int32x8 e1 = _mm256_unpackhi_epi64(d0, d1); 1081| 760| int32x8 e2 = _mm256_unpacklo_epi64(d2, d3); 1082| 760| int32x8 e3 = _mm256_unpackhi_epi64(d2, d3); 1083| 760| int32x8 e4 = _mm256_unpacklo_epi64(d4, d5); 1084| 760| int32x8 e5 = _mm256_unpackhi_epi64(d4, d5); 1085| 760| int32x8 e6 = _mm256_unpacklo_epi64(d6, d7); 1086| 760| int32x8 e7 = _mm256_unpackhi_epi64(d6, d7); 1087| 760| int32x8_MINMAX(e0, e1); ------------------ | | 15| 760| do { \ | | 16| 760| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 760|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 760| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 760|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 760| (a) = c; \ | | 19| 760| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 760] | | ------------------ ------------------ 1088| 760| int32x8_MINMAX(e2, e3); ------------------ | | 15| 760| do { \ | | 16| 760| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 760|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 760| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 760|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 760| (a) = c; \ | | 19| 760| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 760] | | ------------------ ------------------ 1089| 760| int32x8_MINMAX(e4, e5); ------------------ | | 15| 760| do { \ | | 16| 760| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 760|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 760| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 760|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 760| (a) = c; \ | | 19| 760| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 760] | | ------------------ ------------------ 1090| 760| int32x8_MINMAX(e6, e7); ------------------ | | 15| 760| do { \ | | 16| 760| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 760|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 760| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 760|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 760| (a) = c; \ | | 19| 760| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 760] | | ------------------ ------------------ 1091| 760| int32x8 f0 = _mm256_unpacklo_epi32(e0, e1); 1092| 760| int32x8 f1 = _mm256_unpackhi_epi32(e0, e1); 1093| 760| int32x8 f2 = _mm256_unpacklo_epi32(e2, e3); 1094| 760| int32x8 f3 = _mm256_unpackhi_epi32(e2, e3); 1095| 760| int32x8 f4 = _mm256_unpacklo_epi32(e4, e5); 1096| 760| int32x8 f5 = _mm256_unpackhi_epi32(e4, e5); 1097| 760| int32x8 f6 = _mm256_unpacklo_epi32(e6, e7); 1098| 760| int32x8 f7 = _mm256_unpackhi_epi32(e6, e7); 1099| 760| int32x8_store(&x[j], f0); ------------------ | | 10| 760|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1100| 760| int32x8_store(&x[j + 8], f1); ------------------ | | 10| 760|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1101| 760| int32x8_store(&x[j + 16], f2); ------------------ | | 10| 760|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1102| 760| int32x8_store(&x[j + 24], f3); ------------------ | | 10| 760|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1103| 760| int32x8_store(&x[j + 32], f4); ------------------ | | 10| 760|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1104| 760| int32x8_store(&x[j + 40], f5); ------------------ | | 10| 760|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1105| 760| int32x8_store(&x[j + 48], f6); ------------------ | | 10| 760|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1106| 760| int32x8_store(&x[j + 56], f7); ------------------ | | 10| 760|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1107| 760| } 1108| 190| minmax_vector(x + j, x + j + 32, n - 32 - j); 1109| 190| goto continue16; 1110| 190| } 1111| 190| if (q == 16) { ------------------ | Branch (1111:9): [True: 0, False: 190] ------------------ 1112| 0| j = 0; 1113| 190|continue16: 1114| 380| for (; j + 32 <= n; j += 32) { ------------------ | Branch (1114:16): [True: 190, False: 190] ------------------ 1115| 190| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 190|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1116| 190| int32x8 x1 = int32x8_load(&x[j + 8]); ------------------ | | 9| 190|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1117| 190| int32x8 x2 = int32x8_load(&x[j + 16]); ------------------ | | 9| 190|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1118| 190| int32x8 x3 = int32x8_load(&x[j + 24]); ------------------ | | 9| 190|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1119| 190| int32x8_MINMAX(x0, x2); ------------------ | | 15| 190| do { \ | | 16| 190| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 190|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 190| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 190|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 190| (a) = c; \ | | 19| 190| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 190] | | ------------------ ------------------ 1120| 190| int32x8_MINMAX(x1, x3); ------------------ | | 15| 190| do { \ | | 16| 190| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 190|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 190| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 190|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 190| (a) = c; \ | | 19| 190| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 190] | | ------------------ ------------------ 1121| 190| int32x8_MINMAX(x0, x1); ------------------ | | 15| 190| do { \ | | 16| 190| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 190|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 190| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 190|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 190| (a) = c; \ | | 19| 190| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 190] | | ------------------ ------------------ 1122| 190| int32x8_MINMAX(x2, x3); ------------------ | | 15| 190| do { \ | | 16| 190| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 190|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 190| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 190|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 190| (a) = c; \ | | 19| 190| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 190] | | ------------------ ------------------ 1123| 190| int32x8 a0 = _mm256_permute2x128_si256(x0, x1, 0x20); 1124| 190| int32x8 a1 = _mm256_permute2x128_si256(x0, x1, 0x31); 1125| 190| int32x8 a2 = _mm256_permute2x128_si256(x2, x3, 0x20); 1126| 190| int32x8 a3 = _mm256_permute2x128_si256(x2, x3, 0x31); 1127| 190| int32x8_MINMAX(a0, a1); ------------------ | | 15| 190| do { \ | | 16| 190| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 190|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 190| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 190|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 190| (a) = c; \ | | 19| 190| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 190] | | ------------------ ------------------ 1128| 190| int32x8_MINMAX(a2, a3); ------------------ | | 15| 190| do { \ | | 16| 190| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 190|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 190| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 190|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 190| (a) = c; \ | | 19| 190| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 190] | | ------------------ ------------------ 1129| 190| int32x8 b0 = _mm256_permute2x128_si256(a0, a1, 0x20); 1130| 190| int32x8 b1 = _mm256_permute2x128_si256(a0, a1, 0x31); 1131| 190| int32x8 b2 = _mm256_permute2x128_si256(a2, a3, 0x20); 1132| 190| int32x8 b3 = _mm256_permute2x128_si256(a2, a3, 0x31); 1133| 190| int32x8 c0 = _mm256_unpacklo_epi64(b0, b1); 1134| 190| int32x8 c1 = _mm256_unpackhi_epi64(b0, b1); 1135| 190| int32x8 c2 = _mm256_unpacklo_epi64(b2, b3); 1136| 190| int32x8 c3 = _mm256_unpackhi_epi64(b2, b3); 1137| 190| int32x8_MINMAX(c0, c1); ------------------ | | 15| 190| do { \ | | 16| 190| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 190|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 190| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 190|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 190| (a) = c; \ | | 19| 190| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 190] | | ------------------ ------------------ 1138| 190| int32x8_MINMAX(c2, c3); ------------------ | | 15| 190| do { \ | | 16| 190| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 190|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 190| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 190|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 190| (a) = c; \ | | 19| 190| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 190] | | ------------------ ------------------ 1139| 190| int32x8 d0 = _mm256_unpacklo_epi32(c0, c1); 1140| 190| int32x8 d1 = _mm256_unpackhi_epi32(c0, c1); 1141| 190| int32x8 d2 = _mm256_unpacklo_epi32(c2, c3); 1142| 190| int32x8 d3 = _mm256_unpackhi_epi32(c2, c3); 1143| 190| int32x8 e0 = _mm256_unpacklo_epi64(d0, d1); 1144| 190| int32x8 e1 = _mm256_unpackhi_epi64(d0, d1); 1145| 190| int32x8 e2 = _mm256_unpacklo_epi64(d2, d3); 1146| 190| int32x8 e3 = _mm256_unpackhi_epi64(d2, d3); 1147| 190| int32x8_MINMAX(e0, e1); ------------------ | | 15| 190| do { \ | | 16| 190| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 190|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 190| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 190|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 190| (a) = c; \ | | 19| 190| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 190] | | ------------------ ------------------ 1148| 190| int32x8_MINMAX(e2, e3); ------------------ | | 15| 190| do { \ | | 16| 190| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 190|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 190| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 190|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 190| (a) = c; \ | | 19| 190| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 190] | | ------------------ ------------------ 1149| 190| int32x8 f0 = _mm256_unpacklo_epi32(e0, e1); 1150| 190| int32x8 f1 = _mm256_unpackhi_epi32(e0, e1); 1151| 190| int32x8 f2 = _mm256_unpacklo_epi32(e2, e3); 1152| 190| int32x8 f3 = _mm256_unpackhi_epi32(e2, e3); 1153| 190| int32x8_store(&x[j], f0); ------------------ | | 10| 190|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1154| 190| int32x8_store(&x[j + 8], f1); ------------------ | | 10| 190|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1155| 190| int32x8_store(&x[j + 16], f2); ------------------ | | 10| 190|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1156| 190| int32x8_store(&x[j + 24], f3); ------------------ | | 10| 190|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1157| 190| } 1158| 190| minmax_vector(x + j, x + j + 16, n - 16 - j); 1159| 190| goto continue8; 1160| 0| } 1161| | /* q == 8 */ 1162| 190| j = 0; 1163| 380|continue8: 1164| 10.2k| for (; j + 16 <= n; j += 16) { ------------------ | Branch (1164:12): [True: 9.88k, False: 380] ------------------ 1165| 9.88k| int32x8 x0 = int32x8_load(&x[j]); ------------------ | | 9| 9.88k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1166| 9.88k| int32x8 x1 = int32x8_load(&x[j + 8]); ------------------ | | 9| 9.88k|#define int32x8_load(z) _mm256_loadu_si256((__m256i *) (z)) ------------------ 1167| 9.88k| int32x8_MINMAX(x0, x1); ------------------ | | 15| 9.88k| do { \ | | 16| 9.88k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 9.88k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 9.88k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 9.88k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 9.88k| (a) = c; \ | | 19| 9.88k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 9.88k] | | ------------------ ------------------ 1168| 9.88k| int32x8_store(&x[j], x0); ------------------ | | 10| 9.88k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1169| 9.88k| int32x8_store(&x[j + 8], x1); ------------------ | | 10| 9.88k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1170| 9.88k| int32x8 a0 = _mm256_permute2x128_si256(x0, x1, 0x20); /* x0123y0123 */ 1171| 9.88k| int32x8 a1 = _mm256_permute2x128_si256(x0, x1, 0x31); /* x4567y4567 */ 1172| 9.88k| int32x8_MINMAX(a0, a1); ------------------ | | 15| 9.88k| do { \ | | 16| 9.88k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 9.88k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 9.88k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 9.88k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 9.88k| (a) = c; \ | | 19| 9.88k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 9.88k] | | ------------------ ------------------ 1173| 9.88k| int32x8 b0 = _mm256_permute2x128_si256(a0, a1, 0x20); /* x01234567 */ 1174| 9.88k| int32x8 b1 = _mm256_permute2x128_si256(a0, a1, 0x31); /* y01234567 */ 1175| 9.88k| int32x8 c0 = _mm256_unpacklo_epi64(b0, b1); /* x01y01x45y45 */ 1176| 9.88k| int32x8 c1 = _mm256_unpackhi_epi64(b0, b1); /* x23y23x67y67 */ 1177| 9.88k| int32x8_MINMAX(c0, c1); ------------------ | | 15| 9.88k| do { \ | | 16| 9.88k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 9.88k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 9.88k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 9.88k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 9.88k| (a) = c; \ | | 19| 9.88k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 9.88k] | | ------------------ ------------------ 1178| 9.88k| int32x8 d0 = _mm256_unpacklo_epi32(c0, c1); /* x02x13x46x57 */ 1179| 9.88k| int32x8 d1 = _mm256_unpackhi_epi32(c0, c1); /* y02y13y46y57 */ 1180| 9.88k| int32x8 e0 = _mm256_unpacklo_epi64(d0, d1); /* x02y02x46y46 */ 1181| 9.88k| int32x8 e1 = _mm256_unpackhi_epi64(d0, d1); /* x13y13x57y57 */ 1182| 9.88k| int32x8_MINMAX(e0, e1); ------------------ | | 15| 9.88k| do { \ | | 16| 9.88k| int32x8 c = int32x8_min((a),(b)); \ | | ------------------ | | | | 11| 9.88k|#define int32x8_min _mm256_min_epi32 | | ------------------ | | 17| 9.88k| (b) = int32x8_max((a),(b)); \ | | ------------------ | | | | 12| 9.88k|#define int32x8_max _mm256_max_epi32 | | ------------------ | | 18| 9.88k| (a) = c; \ | | 19| 9.88k| } while(0) | | ------------------ | | | Branch (19:13): [Folded, False: 9.88k] | | ------------------ ------------------ 1183| 9.88k| int32x8 f0 = _mm256_unpacklo_epi32(e0, e1); /* x01234567 */ 1184| 9.88k| int32x8 f1 = _mm256_unpackhi_epi32(e0, e1); /* y01234567 */ 1185| 9.88k| int32x8_store(&x[j], f0); ------------------ | | 10| 9.88k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1186| 9.88k| int32x8_store(&x[j + 8], f1); ------------------ | | 10| 9.88k|#define int32x8_store(z,i) _mm256_storeu_si256((__m256i *) (z),(i)) ------------------ 1187| 9.88k| } 1188| 380| minmax_vector(x + j, x + j + 8, n - 8 - j); 1189| 380| if (j + 8 <= n) { ------------------ | Branch (1189:9): [True: 0, False: 380] ------------------ 1190| 0| int32_MINMAX(&x[j], &x[j + 4]); 1191| 0| int32_MINMAX(&x[j + 1], &x[j + 5]); 1192| 0| int32_MINMAX(&x[j + 2], &x[j + 6]); 1193| 0| int32_MINMAX(&x[j + 3], &x[j + 7]); 1194| 0| int32_MINMAX(&x[j], &x[j + 2]); 1195| 0| int32_MINMAX(&x[j + 1], &x[j + 3]); 1196| 0| int32_MINMAX(&x[j], &x[j + 1]); 1197| 0| int32_MINMAX(&x[j + 2], &x[j + 3]); 1198| 0| int32_MINMAX(&x[j + 4], &x[j + 6]); 1199| 0| int32_MINMAX(&x[j + 5], &x[j + 7]); 1200| 0| int32_MINMAX(&x[j + 4], &x[j + 5]); 1201| 0| int32_MINMAX(&x[j + 6], &x[j + 7]); 1202| 0| j += 8; 1203| 0| } 1204| 380| minmax_vector(x + j, x + j + 4, n - 4 - j); 1205| 380| if (j + 4 <= n) { ------------------ | Branch (1205:9): [True: 380, False: 0] ------------------ 1206| 380| int32_MINMAX(&x[j], &x[j + 2]); 1207| 380| int32_MINMAX(&x[j + 1], &x[j + 3]); 1208| 380| int32_MINMAX(&x[j], &x[j + 1]); 1209| 380| int32_MINMAX(&x[j + 2], &x[j + 3]); 1210| 380| j += 4; 1211| 380| } 1212| 380| if (j + 3 <= n) { ------------------ | Branch (1212:9): [True: 0, False: 380] ------------------ 1213| 0| int32_MINMAX(&x[j], &x[j + 2]); 1214| 0| } 1215| 380| if (j + 2 <= n) { ------------------ | Branch (1215:9): [True: 0, False: 380] ------------------ 1216| 0| int32_MINMAX(&x[j], &x[j + 1]); 1217| 0| } 1218| 380|} PQCLEAN_NTRUHPS4096821_AVX2_crypto_kem_keypair: 10| 95|int PQCLEAN_NTRUHPS4096821_AVX2_crypto_kem_keypair(uint8_t *pk, uint8_t *sk) { 11| 95| uint8_t seed[NTRU_SAMPLE_FG_BYTES]; 12| | 13| 95| randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 8| 95|#define randombytes OQS_randombytes ------------------ randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 22| 95|#define NTRU_SAMPLE_FG_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 20| 95|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 95|#define NTRU_N 821 | | | | ------------------ | | ------------------ | | #define NTRU_SAMPLE_FG_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 21| 95|#define NTRU_SAMPLE_FT_BYTES ((30*(NTRU_N-1)+7)/8) | | | | ------------------ | | | | | | 5| 95|#define NTRU_N 821 | | | | ------------------ | | ------------------ ------------------ 14| 95| PQCLEAN_NTRUHPS4096821_AVX2_owcpa_keypair(pk, sk, seed); 15| | 16| 95| randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 8| 95|#define randombytes OQS_randombytes ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 30| 95|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 26| 95|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 95|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 95|#define NTRU_N 821 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 29| 95|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 95|#define NTRU_LOGQ 12 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 95|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 95|#define NTRU_N 821 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 17| 95|#define NTRU_PRFKEYBYTES 32 ------------------ 17| | 18| 95| return 0; 19| 95|} PQCLEAN_NTRUHPS4096821_AVX2_crypto_kem_enc: 21| 95|int PQCLEAN_NTRUHPS4096821_AVX2_crypto_kem_enc(uint8_t *c, uint8_t *k, const uint8_t *pk) { 22| 95| poly r, m; 23| 95| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 24| 95| uint8_t rm_seed[NTRU_SAMPLE_RM_BYTES]; 25| | 26| 95| randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 8| 95|#define randombytes OQS_randombytes ------------------ randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 23| 95|#define NTRU_SAMPLE_RM_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 20| 95|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 95|#define NTRU_N 821 | | | | ------------------ | | ------------------ | | #define NTRU_SAMPLE_RM_BYTES (NTRU_SAMPLE_IID_BYTES+NTRU_SAMPLE_FT_BYTES) | | ------------------ | | | | 21| 95|#define NTRU_SAMPLE_FT_BYTES ((30*(NTRU_N-1)+7)/8) | | | | ------------------ | | | | | | 5| 95|#define NTRU_N 821 | | | | ------------------ | | ------------------ ------------------ 27| | 28| 95| PQCLEAN_NTRUHPS4096821_AVX2_sample_rm(&r, &m, rm_seed); 29| | 30| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_tobytes(rm, &r); 31| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, &m); ------------------ | | 26| 95|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 95|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 95|#define NTRU_N 821 | | | | ------------------ | | ------------------ ------------------ 32| 95| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 95|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 28| 95|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 26| 95|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 95|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 95|#define NTRU_N 821 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 33| | 34| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_Z3_to_Zq(&r); 35| 95| PQCLEAN_NTRUHPS4096821_AVX2_owcpa_enc(c, &r, &m, pk); 36| | 37| 95| return 0; 38| 95|} PQCLEAN_NTRUHPS4096821_AVX2_crypto_kem_dec: 40| 95|int PQCLEAN_NTRUHPS4096821_AVX2_crypto_kem_dec(uint8_t *k, const uint8_t *c, const uint8_t *sk) { 41| 95| int i, fail; 42| 95| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 43| 95| uint8_t buf[NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES]; 44| | 45| 95| fail = PQCLEAN_NTRUHPS4096821_AVX2_owcpa_dec(rm, c, sk); 46| | /* If fail = 0 then c = Enc(h, rm). There is no need to re-encapsulate. */ 47| | /* See comment in PQCLEAN_NTRUHPS4096821_AVX2_owcpa_dec for details. */ 48| | 49| 95| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 95|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 28| 95|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 26| 95|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 95|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 95|#define NTRU_N 821 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 50| | 51| | /* shake(secret PRF key || input ciphertext) */ 52| 3.13k| for (i = 0; i < NTRU_PRFKEYBYTES; i++) { ------------------ | | 17| 3.13k|#define NTRU_PRFKEYBYTES 32 ------------------ | Branch (52:17): [True: 3.04k, False: 95] ------------------ 53| 3.04k| buf[i] = sk[i + NTRU_OWCPA_SECRETKEYBYTES]; ------------------ | | 30| 3.04k|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 26| 3.04k|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 25| 3.04k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 3.04k|#define NTRU_N 821 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 29| 3.04k|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 3.04k|#define NTRU_LOGQ 12 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 3.04k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 3.04k|#define NTRU_N 821 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 3.04k| } 55| 116k| for (i = 0; i < NTRU_CIPHERTEXTBYTES; i++) { ------------------ | | 35| 116k|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 31| 116k|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 116k|#define NTRU_LOGQ 12 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 116k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 116k|#define NTRU_N 821 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (55:17): [True: 116k, False: 95] ------------------ 56| 116k| buf[NTRU_PRFKEYBYTES + i] = c[i]; ------------------ | | 17| 116k|#define NTRU_PRFKEYBYTES 32 ------------------ 57| 116k| } 58| 95| sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 15| 95|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 17| 95|#define NTRU_PRFKEYBYTES 32 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 35| 95|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 31| 95|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 95|#define NTRU_LOGQ 12 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 25| 95|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 95|#define NTRU_N 821 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 59| | 60| 95| PQCLEAN_NTRUHPS4096821_AVX2_cmov(k, rm, NTRU_SHAREDKEYBYTES, (unsigned char) fail); ------------------ | | 18| 95|#define NTRU_SHAREDKEYBYTES 32 ------------------ 61| | 62| 95| return 0; 63| 95|} PQCLEAN_NTRUHPS4096821_AVX2_owcpa_keypair: 62| 95| const unsigned char seed[NTRU_SAMPLE_FG_BYTES]) { 63| 95| int i; 64| | 65| 95| poly x1, x2, x3, x4, x5; 66| | 67| 95| poly *f = &x1, *g = &x2, *invf_mod3 = &x3; 68| 95| poly *gf = &x3, *invgf = &x4, *tmp = &x5; 69| 95| poly *invh = &x3, *h = &x3; 70| | 71| 95| PQCLEAN_NTRUHPS4096821_AVX2_sample_fg(f, g, seed); 72| | 73| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_inv(invf_mod3, f); 74| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_tobytes(sk, f); 75| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_tobytes(sk + NTRU_PACK_TRINARY_BYTES, invf_mod3); ------------------ | | 26| 95|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 95|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 95|#define NTRU_N 821 | | | | ------------------ | | ------------------ ------------------ 76| | 77| | /* Lift coeffs of f and g from Z_p to Z_q */ 78| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_Z3_to_Zq(f); 79| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_Z3_to_Zq(g); 80| | 81| | 82| | /* g = 3*g */ 83| 78.0k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 78.0k|#define NTRU_N 821 ------------------ | Branch (83:17): [True: 77.9k, False: 95] ------------------ 84| 77.9k| g->coeffs[i] = 3 * g->coeffs[i]; 85| 77.9k| } 86| | 87| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(gf, g, f); 88| | 89| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_inv(invgf, gf); 90| | 91| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(tmp, invgf, f); 92| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_mul(invh, tmp, f); 93| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_tobytes(sk + 2 * NTRU_PACK_TRINARY_BYTES, invh); ------------------ | | 26| 95|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 95|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 95|#define NTRU_N 821 | | | | ------------------ | | ------------------ ------------------ 94| | 95| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(tmp, invgf, g); 96| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(h, tmp, g); 97| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_sum_zero_tobytes(pk, h); 98| 95|} PQCLEAN_NTRUHPS4096821_AVX2_owcpa_enc: 104| 95| const unsigned char *pk) { 105| 95| int i; 106| 95| poly x1, x2; 107| 95| poly *h = &x1, *liftm = &x1; 108| 95| poly *ct = &x2; 109| | 110| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_sum_zero_frombytes(h, pk); 111| | 112| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(ct, r, h); 113| | 114| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_lift(liftm, m); 115| 78.0k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 78.0k|#define NTRU_N 821 ------------------ | Branch (115:17): [True: 77.9k, False: 95] ------------------ 116| 77.9k| ct->coeffs[i] = ct->coeffs[i] + liftm->coeffs[i]; 117| 77.9k| } 118| | 119| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_sum_zero_tobytes(c, ct); 120| 95|} PQCLEAN_NTRUHPS4096821_AVX2_owcpa_dec: 124| 95| const unsigned char *secretkey) { 125| 95| int i; 126| 95| int fail; 127| 95| poly x1, x2, x3, x4; 128| | 129| 95| poly *c = &x1, *f = &x2, *cf = &x3; 130| 95| poly *mf = &x2, *finv3 = &x3, *m = &x4; 131| 95| poly *liftm = &x2, *invh = &x3, *r = &x4; 132| 95| poly *b = &x1; 133| | 134| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_sum_zero_frombytes(c, ciphertext); 135| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_frombytes(f, secretkey); 136| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_Z3_to_Zq(f); 137| | 138| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(cf, c, f); 139| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_to_S3(mf, cf); 140| | 141| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_frombytes(finv3, secretkey + NTRU_PACK_TRINARY_BYTES); ------------------ | | 26| 95|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 95|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 95|#define NTRU_N 821 | | | | ------------------ | | ------------------ ------------------ 142| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_mul(m, mf, finv3); 143| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, m); ------------------ | | 26| 95|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 95|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 95|#define NTRU_N 821 | | | | ------------------ | | ------------------ ------------------ 144| | 145| 95| fail = 0; 146| | 147| | /* Check that the unused bits of the last byte of the ciphertext are zero */ 148| 95| fail |= owcpa_check_ciphertext(ciphertext); 149| | 150| | /* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */ 151| | /* We can avoid re-computing r*h + Lift(m) as long as we check that */ 152| | /* r (defined as b/h mod (q, Phi_n)) and m are in the message space. */ 153| | /* (m can take any value in S3 in NTRU_HRSS) */ 154| 95| fail |= owcpa_check_m(m); 155| | 156| | /* b = c - Lift(m) mod (q, x^n - 1) */ 157| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_lift(liftm, m); 158| 78.0k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 78.0k|#define NTRU_N 821 ------------------ | Branch (158:17): [True: 77.9k, False: 95] ------------------ 159| 77.9k| b->coeffs[i] = c->coeffs[i] - liftm->coeffs[i]; 160| 77.9k| } 161| | 162| | /* r = b / h mod (q, Phi_n) */ 163| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_frombytes(invh, secretkey + 2 * NTRU_PACK_TRINARY_BYTES); ------------------ | | 26| 95|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 25| 95|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 95|#define NTRU_N 821 | | | | ------------------ | | ------------------ ------------------ 164| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_mul(r, b, invh); 165| | 166| | /* NOTE: Our definition of r as b/h mod (q, Phi_n) follows Figure 4 of */ 167| | /* [Sch18] https://eprint.iacr.org/2018/1174/20181203:032458. */ 168| | /* This differs from Figure 10 of Saito--Xagawa--Yamakawa */ 169| | /* [SXY17] https://eprint.iacr.org/2017/1005/20180516:055500 */ 170| | /* where r gets a final reduction modulo p. */ 171| | /* We need this change to use Proposition 1 of [Sch18]. */ 172| | 173| | /* Proposition 1 of [Sch18] shows that re-encryption with (r,m) yields c. */ 174| | /* if and only if fail==0 after the following call to owcpa_check_r */ 175| | /* The procedure given in Fig. 8 of [Sch18] can be skipped because we have */ 176| | /* c(1) = 0 due to the use of poly_Rq_sum_zero_{to,from}bytes. */ 177| 95| fail |= owcpa_check_r(r); 178| | 179| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_trinary_Zq_to_Z3(r); 180| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_tobytes(rm, r); 181| | 182| 95| return fail; 183| 95|} PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_tobytes: 3| 570|void PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_tobytes(unsigned char msg[NTRU_PACK_TRINARY_BYTES], const poly *a) { 4| 570| int i; 5| 570| unsigned char c; 6| | 7| 94.0k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 25| 94.0k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 94.0k|#define NTRU_N 821 | | ------------------ ------------------ | Branch (7:17): [True: 93.4k, False: 570] ------------------ 8| 93.4k| c = a->coeffs[5 * i + 4] & 255; 9| 93.4k| c = (3 * c + a->coeffs[5 * i + 3]) & 255; 10| 93.4k| c = (3 * c + a->coeffs[5 * i + 2]) & 255; 11| 93.4k| c = (3 * c + a->coeffs[5 * i + 1]) & 255; 12| 93.4k| c = (3 * c + a->coeffs[5 * i + 0]) & 255; 13| 93.4k| msg[i] = c; 14| 93.4k| } 15| 570|} PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_frombytes: 17| 190|void PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_frombytes(poly *r, const unsigned char msg[NTRU_PACK_TRINARY_BYTES]) { 18| 190| int i; 19| 190| unsigned char c; 20| | 21| 31.3k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 25| 31.3k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 31.3k|#define NTRU_N 821 | | ------------------ ------------------ | Branch (21:17): [True: 31.1k, False: 190] ------------------ 22| 31.1k| c = msg[i]; 23| 31.1k| r->coeffs[5 * i + 0] = c; 24| 31.1k| r->coeffs[5 * i + 1] = c * 171 >> 9; // this is division by 3 25| 31.1k| r->coeffs[5 * i + 2] = c * 57 >> 9; // division by 3^2 26| 31.1k| r->coeffs[5 * i + 3] = c * 19 >> 9; // division by 3^3 27| 31.1k| r->coeffs[5 * i + 4] = c * 203 >> 14; // etc. 28| 31.1k| } 29| 190| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 190|#define NTRU_N 821 ------------------ 30| 190| PQCLEAN_NTRUHPS4096821_AVX2_poly_mod_3_Phi_n(r); 31| 190|} PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_tobytes: 4| 285|void PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_tobytes(unsigned char *r, const poly *a) { 5| 285| int i; 6| | 7| 117k| for (i = 0; i < NTRU_PACK_DEG / 2; i++) { ------------------ | | 25| 117k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 117k|#define NTRU_N 821 | | ------------------ ------------------ | Branch (7:17): [True: 116k, False: 285] ------------------ 8| 116k| r[3 * i + 0] = (unsigned char) ( MODQ(a->coeffs[2 * i + 0]) & 0xff); ------------------ | | 9| 116k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 116k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 116k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 9| 116k| r[3 * i + 1] = (unsigned char) ((MODQ(a->coeffs[2 * i + 0]) >> 8) | ((MODQ(a->coeffs[2 * i + 1]) & 0x0f) << 4)); ------------------ | | 9| 116k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 116k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 116k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ r[3 * i + 1] = (unsigned char) ((MODQ(a->coeffs[2 * i + 0]) >> 8) | ((MODQ(a->coeffs[2 * i + 1]) & 0x0f) << 4)); ------------------ | | 9| 116k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 116k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 116k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 10| 116k| r[3 * i + 2] = (unsigned char) ((MODQ(a->coeffs[2 * i + 1]) >> 4)); ------------------ | | 9| 116k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 116k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 116k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 11| 116k| } 12| 285|} PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_frombytes: 14| 285|void PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_frombytes(poly *r, const unsigned char *a) { 15| 285| int i; 16| 117k| for (i = 0; i < NTRU_PACK_DEG / 2; i++) { ------------------ | | 25| 117k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 117k|#define NTRU_N 821 | | ------------------ ------------------ | Branch (16:17): [True: 116k, False: 285] ------------------ 17| 116k| r->coeffs[2 * i + 0] = (a[3 * i + 0] >> 0) | (((uint16_t)a[3 * i + 1] & 0x0f) << 8); 18| 116k| r->coeffs[2 * i + 1] = (a[3 * i + 1] >> 4) | (((uint16_t)a[3 * i + 2] & 0xff) << 4); 19| 116k| } 20| 285| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 285|#define NTRU_N 821 ------------------ 21| 285|} PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_sum_zero_tobytes: 23| 190|void PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_sum_zero_tobytes(unsigned char *r, const poly *a) { 24| 190| PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_tobytes(r, a); 25| 190|} PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_sum_zero_frombytes: 27| 190|void PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_sum_zero_frombytes(poly *r, const unsigned char *a) { 28| 190| int i; 29| 190| PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_frombytes(r, a); 30| | 31| | /* Set r[n-1] so that the sum of coefficients is zero mod q */ 32| 190| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 190|#define NTRU_N 821 ------------------ 33| 155k| for (i = 0; i < NTRU_PACK_DEG; i++) { ------------------ | | 25| 155k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 155k|#define NTRU_N 821 | | ------------------ ------------------ | Branch (33:17): [True: 155k, False: 190] ------------------ 34| 155k| r->coeffs[NTRU_N - 1] -= r->coeffs[i]; ------------------ | | 5| 155k|#define NTRU_N 821 ------------------ 35| 155k| } 36| 190|} PQCLEAN_NTRUHPS4096821_AVX2_poly_Z3_to_Zq: 4| 570|void PQCLEAN_NTRUHPS4096821_AVX2_poly_Z3_to_Zq(poly *r) { 5| 570| int i; 6| 468k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 468k|#define NTRU_N 821 ------------------ | Branch (6:17): [True: 467k, False: 570] ------------------ 7| 467k| r->coeffs[i] = r->coeffs[i] | ((-(r->coeffs[i] >> 1)) & (NTRU_Q - 1)); ------------------ | | 13| 467k|#define NTRU_Q (1 << NTRU_LOGQ) | | ------------------ | | | | 6| 467k|#define NTRU_LOGQ 12 | | ------------------ ------------------ 8| 467k| } 9| 570|} PQCLEAN_NTRUHPS4096821_AVX2_poly_trinary_Zq_to_Z3: 12| 95|void PQCLEAN_NTRUHPS4096821_AVX2_poly_trinary_Zq_to_Z3(poly *r) { 13| 95| int i; 14| 78.0k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 78.0k|#define NTRU_N 821 ------------------ | Branch (14:17): [True: 77.9k, False: 95] ------------------ 15| 77.9k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 77.9k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 77.9k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 77.9k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 16| 77.9k| r->coeffs[i] = 3 & (r->coeffs[i] ^ (r->coeffs[i] >> (NTRU_LOGQ - 1))); ------------------ | | 6| 77.9k|#define NTRU_LOGQ 12 ------------------ 17| 77.9k| } 18| 95|} PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_mul: 20| 190|void PQCLEAN_NTRUHPS4096821_AVX2_poly_Sq_mul(poly *r, const poly *a, const poly *b) { 21| 190| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(r, a, b); 22| 190| PQCLEAN_NTRUHPS4096821_AVX2_poly_mod_q_Phi_n(r); 23| 190|} PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_mul: 25| 95|void PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_mul(poly *r, const poly *a, const poly *b) { 26| 95| int i; 27| | 28| | /* Our S3 multiplications do not overflow mod q, */ 29| | /* so we can re-purpose PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul, as long as we */ 30| | /* follow with an explicit reduction mod q. */ 31| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(r, a, b); 32| 78.0k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 78.0k|#define NTRU_N 821 ------------------ | Branch (32:17): [True: 77.9k, False: 95] ------------------ 33| 77.9k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 77.9k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 77.9k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 77.9k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ 34| 77.9k| } 35| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_mod_3_Phi_n(r); 36| 95|} PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_inv: 71| 95|void PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_inv(poly *r, const poly *a) { 72| 95| poly ai2; 73| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_inv(&ai2, a); 74| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_inv_to_Rq_inv(r, &ai2, a); 75| 95|} poly.c:PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_inv_to_Rq_inv: 38| 95|static void PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_inv_to_Rq_inv(poly *r, const poly *ai, const poly *a) { 39| | 40| 95| int i; 41| 95| poly b, c; 42| 95| poly s; 43| | 44| | // for 0..4 45| | // ai = ai * (2 - a*ai) mod q 46| 78.0k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 78.0k|#define NTRU_N 821 ------------------ | Branch (46:17): [True: 77.9k, False: 95] ------------------ 47| 77.9k| b.coeffs[i] = -(a->coeffs[i]); 48| 77.9k| } 49| | 50| 78.0k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 78.0k|#define NTRU_N 821 ------------------ | Branch (50:17): [True: 77.9k, False: 95] ------------------ 51| 77.9k| r->coeffs[i] = ai->coeffs[i]; 52| 77.9k| } 53| | 54| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(&c, r, &b); 55| 95| c.coeffs[0] += 2; // c = 2 - a*ai 56| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(&s, &c, r); // s = ai*c 57| | 58| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(&c, &s, &b); 59| 95| c.coeffs[0] += 2; // c = 2 - a*s 60| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(r, &c, &s); // r = s*c 61| | 62| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(&c, r, &b); 63| 95| c.coeffs[0] += 2; // c = 2 - a*r 64| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(&s, &c, r); // s = r*c 65| | 66| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(&c, &s, &b); 67| 95| c.coeffs[0] += 2; // c = 2 - a*s 68| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_Rq_mul(r, &c, &s); // r = s*c 69| 95|} PQCLEAN_NTRUHPS4096821_AVX2_poly_lift: 3| 190|void PQCLEAN_NTRUHPS4096821_AVX2_poly_lift(poly *r, const poly *a) { 4| 190| int i; 5| 156k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 156k|#define NTRU_N 821 ------------------ | Branch (5:17): [True: 155k, False: 190] ------------------ 6| 155k| r->coeffs[i] = a->coeffs[i]; 7| 155k| } 8| 190| PQCLEAN_NTRUHPS4096821_AVX2_poly_Z3_to_Zq(r); 9| 190|} PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_tobytes: 6| 95|void PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_tobytes(unsigned char *out, const poly *a) { 7| 95| int i, j, k; 8| 1.61k| for (i = 0; i < 16; i++) { ------------------ | Branch (8:17): [True: 1.52k, False: 95] ------------------ 9| 13.6k| for (k = 0; k < 8; k++) { ------------------ | Branch (9:21): [True: 12.1k, False: 1.52k] ------------------ 10| 12.1k| out[i * 8 + k] = 0; 11| 109k| for (j = 0; j < 8; j++) { ------------------ | Branch (11:25): [True: 97.2k, False: 12.1k] ------------------ 12| 97.2k| if ((i * 8 + k) * 8 + j < NTRU_N) { ------------------ | | 5| 97.2k|#define NTRU_N 821 ------------------ | Branch (12:21): [True: 77.9k, False: 19.2k] ------------------ 13| 77.9k| out[i * 8 + k] |= (a->coeffs[(i * 8 + k) * 8 + j] & 1) << j; 14| 77.9k| } 15| 97.2k| } 16| 12.1k| } 17| 1.52k| } 18| 95|} PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_frombytes: 20| 95|void PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_frombytes(poly *a, const unsigned char *in) { 21| 95| int i, j, k; 22| 1.61k| for (i = 0; i < 16; i++) { ------------------ | Branch (22:17): [True: 1.52k, False: 95] ------------------ 23| 13.6k| for (k = 0; k < 8; k++) { ------------------ | Branch (23:21): [True: 12.1k, False: 1.52k] ------------------ 24| 109k| for (j = 0; j < 8; j++) { ------------------ | Branch (24:25): [True: 97.2k, False: 12.1k] ------------------ 25| 97.2k| if ((i * 8 + k) * 8 + j < NTRU_N) { ------------------ | | 5| 97.2k|#define NTRU_N 821 ------------------ | Branch (25:21): [True: 77.9k, False: 19.2k] ------------------ 26| 77.9k| a->coeffs[(i * 8 + k) * 8 + j] = (in[i * 8 + k] >> j) & 1; 27| 77.9k| } 28| 97.2k| } 29| 12.1k| } 30| 1.52k| } 31| 95|} PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_inv: 48| 95|void PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_inv(poly *r, const poly *a) { 49| 95| union { 50| 95| unsigned char s[128]; 51| 95| __m256i s_x32[4]; 52| 95| } squares[13]; 53| 95|#define s(x) squares[(x)].s 54| | 55| | // This relies on the following addition chain: 56| | // 1, 2, 3, 6, 12, 24, 48, 51, 102, 204, 408, 816, 819 57| | 58| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_tobytes(s(0), a); // TODO alignment ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ 59| | 60| 95| PQCLEAN_NTRUHPS4096821_AVX2_square_1_821(s(1), s(0)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_1_821(s(1), s(0)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ 61| 95| _poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ 62| 95| PQCLEAN_NTRUHPS4096821_AVX2_square_1_821(s(2), s(1)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_1_821(s(2), s(1)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ 63| 95| _poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ 64| 95| PQCLEAN_NTRUHPS4096821_AVX2_square_3_821(s(3), s(2)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_3_821(s(3), s(2)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ 65| 95| _poly_R2_mul(s(3), s(3), s(2)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(3), s(3), s(2)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(3), s(3), s(2)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ 66| 95| PQCLEAN_NTRUHPS4096821_AVX2_square_6_821(s(4), s(3)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_6_821(s(4), s(3)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ 67| 95| _poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ 68| 95| PQCLEAN_NTRUHPS4096821_AVX2_square_12_821(s(5), s(4)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_12_821(s(5), s(4)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ 69| 95| _poly_R2_mul(s(5), s(5), s(4)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(5), s(5), s(4)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(5), s(5), s(4)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ 70| 95| PQCLEAN_NTRUHPS4096821_AVX2_square_24_821(s(6), s(5)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_24_821(s(6), s(5)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ 71| 95| _poly_R2_mul(s(6), s(6), s(5)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(6), s(6), s(5)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(6), s(6), s(5)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ 72| 95| PQCLEAN_NTRUHPS4096821_AVX2_square_3_821(s(7), s(6)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_3_821(s(7), s(6)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ 73| 95| _poly_R2_mul(s(7), s(7), s(2)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(7), s(7), s(2)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(7), s(7), s(2)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ 74| 95| PQCLEAN_NTRUHPS4096821_AVX2_square_51_821(s(8), s(7)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_51_821(s(8), s(7)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ 75| 95| _poly_R2_mul(s(8), s(8), s(7)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(8), s(8), s(7)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(8), s(8), s(7)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ 76| 95| PQCLEAN_NTRUHPS4096821_AVX2_square_102_821(s(9), s(8)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_102_821(s(9), s(8)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ 77| 95| _poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ 78| 95| PQCLEAN_NTRUHPS4096821_AVX2_square_204_821(s(10), s(9)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_204_821(s(10), s(9)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ 79| 95| _poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ 80| 95| PQCLEAN_NTRUHPS4096821_AVX2_square_408_821(s(11), s(10)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_408_821(s(11), s(10)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ 81| 95| _poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ 82| 95| PQCLEAN_NTRUHPS4096821_AVX2_square_3_821(s(12), s(11)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_3_821(s(12), s(11)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ 83| 95| _poly_R2_mul(s(12), s(12), s(2)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(12), s(12), s(2)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ _poly_R2_mul(s(12), s(12), s(2)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ 84| 95| PQCLEAN_NTRUHPS4096821_AVX2_square_1_821(s(0), s(12)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHPS4096821_AVX2_square_1_821(s(0), s(12)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ 85| | 86| | 87| 95| PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_frombytes(r, s(0)); ------------------ | | 53| 95|#define s(x) squares[(x)].s ------------------ 88| 95|#undef s 89| 95|} poly_r2_inv.c:_poly_R2_mul: 34| 1.14k|static void _poly_R2_mul(unsigned char r[128], unsigned char a[128], unsigned char b[128]) { 35| | // TODO: Try to avoid copying input 36| 1.14k| int i; 37| 1.14k| union { 38| 1.14k| unsigned char b[128]; 39| 1.14k| __m256i b_x32[4]; 40| 1.14k| } rt; 41| | 42| 1.14k| PQCLEAN_NTRUHPS4096821_AVX2_poly_R2_mul(rt.b, a, b); 43| 147k| for (i = 0; i < 128; i++) { ------------------ | Branch (43:17): [True: 145k, False: 1.14k] ------------------ 44| 145k| r[i] = rt.b[i]; 45| 145k| } 46| 1.14k|} PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_inv: 661| 95|void PQCLEAN_NTRUHPS4096821_AVX2_poly_S3_inv(poly *r_out, const poly *a) { 662| 95| const unsigned char *in = (void *) a; 663| 95| unsigned char *out = (void *) r_out; 664| | 665| 95| small input[ppad]; 666| 95| small output[ppad]; 667| 95| int i; 668| | 669| | /* XXX: obviously input/output format should be packed into bytes */ 670| | 671| 77.9k| for (i = 0; i < p; ++i) { ------------------ | | 7| 77.9k|#define p 820 ------------------ | Branch (671:17): [True: 77.9k, False: 95] ------------------ 672| 77.9k| small x = in[2 * i] & 3; /* 0 1 2 3 */ 673| 77.9k| x += 1; /* 0 1 2 3 4 5 6, offset by 1 */ 674| 77.9k| x &= (x - 3) >> 5; /* 0 1 2, offset by 1 */ 675| 77.9k| input[i] = x - 1; 676| 77.9k| } 677| | /* XXX: merge with vec256_init */ 678| | 679| 95| __poly_S3_inv((unsigned char *)output, (unsigned char *)input); 680| | 681| 77.9k| for (i = 0; i < p; ++i) { ------------------ | | 7| 77.9k|#define p 820 ------------------ | Branch (681:17): [True: 77.9k, False: 95] ------------------ 682| 77.9k| out[2 * i] = (3 & output[i]) ^ ((3 & output[i]) >> 1); 683| 77.9k| out[2 * i + 1] = 0; 684| 77.9k| } 685| 95|} poly_s3_inv.c:vec256_divx_4: 302| 165k|static inline void vec256_divx_4(vec256 *f) { 303| 165k| vec256 f0 = f[0]; 304| 165k| vec256 f1 = f[1]; 305| 165k| vec256 f2 = f[2]; 306| 165k| vec256 f3 = f[3]; 307| | 308| 165k| unsigned long long low0 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f0)); 309| 165k| unsigned long long low1 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f1)); 310| 165k| unsigned long long low2 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f2)); 311| 165k| unsigned long long low3 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f3)); 312| | 313| 165k| low0 = (low0 >> 1) | (low1 << 63); 314| 165k| low1 = (low1 >> 1) | (low2 << 63); 315| 165k| low2 = (low2 >> 1) | (low3 << 63); 316| 165k| low3 = low3 >> 1; 317| | 318| 165k| f0 = _mm256_blend_epi32(f0, _mm256_set_epi64x(0, 0, 0, low0), 0x3); 319| 165k| f1 = _mm256_blend_epi32(f1, _mm256_set_epi64x(0, 0, 0, low1), 0x3); 320| 165k| f2 = _mm256_blend_epi32(f2, _mm256_set_epi64x(0, 0, 0, low2), 0x3); 321| 165k| f3 = _mm256_blend_epi32(f3, _mm256_set_epi64x(0, 0, 0, low3), 0x3); 322| | 323| 165k| f[0] = _mm256_permute4x64_epi64(f0, 0x39); 324| 165k| f[1] = _mm256_permute4x64_epi64(f1, 0x39); 325| 165k| f[2] = _mm256_permute4x64_epi64(f2, 0x39); 326| | f[3] = _mm256_permute4x64_epi64(f3, 0x39); 327| 165k|} poly_s3_inv.c:vec256_timesx_4: 380| 165k|static inline void vec256_timesx_4(vec256 *f) { 381| 165k| vec256 f0 = _mm256_permute4x64_epi64(f[0], 0x93); 382| 165k| vec256 f1 = _mm256_permute4x64_epi64(f[1], 0x93); 383| 165k| vec256 f2 = _mm256_permute4x64_epi64(f[2], 0x93); 384| 165k| vec256 f3 = _mm256_permute4x64_epi64(f[3], 0x93); 385| | 386| 165k| unsigned long long low0 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f0)); 387| 165k| unsigned long long low1 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f1)); 388| 165k| unsigned long long low2 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f2)); 389| 165k| unsigned long long low3 = _mm_cvtsi128_si64(_mm256_castsi256_si128(f3)); 390| | 391| 165k| low3 = (low3 << 1) | (low2 >> 63); 392| 165k| low2 = (low2 << 1) | (low1 >> 63); 393| 165k| low1 = (low1 << 1) | (low0 >> 63); 394| 165k| low0 = low0 << 1; 395| | 396| 165k| f0 = _mm256_blend_epi32(f0, _mm256_set_epi64x(0, 0, 0, low0), 0x3); 397| 165k| f1 = _mm256_blend_epi32(f1, _mm256_set_epi64x(0, 0, 0, low1), 0x3); 398| 165k| f2 = _mm256_blend_epi32(f2, _mm256_set_epi64x(0, 0, 0, low2), 0x3); 399| 165k| f3 = _mm256_blend_epi32(f3, _mm256_set_epi64x(0, 0, 0, low3), 0x3); 400| | 401| 165k| f[0] = f0; 402| 165k| f[1] = f1; 403| 165k| f[2] = f2; 404| 165k| f[3] = f3; 405| 165k|} PQCLEAN_NTRUHPS4096821_AVX2_sample_fg: 3| 95|void PQCLEAN_NTRUHPS4096821_AVX2_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]) { 4| | 5| 95| PQCLEAN_NTRUHPS4096821_AVX2_sample_iid(f, uniformbytes); 6| 95| PQCLEAN_NTRUHPS4096821_AVX2_sample_fixed_type(g, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 20| 95|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 95|#define NTRU_N 821 | | ------------------ ------------------ 7| 95|} PQCLEAN_NTRUHPS4096821_AVX2_sample_rm: 9| 95|void PQCLEAN_NTRUHPS4096821_AVX2_sample_rm(poly *r, poly *m, const unsigned char uniformbytes[NTRU_SAMPLE_RM_BYTES]) { 10| | 11| 95| PQCLEAN_NTRUHPS4096821_AVX2_sample_iid(r, uniformbytes); 12| 95| PQCLEAN_NTRUHPS4096821_AVX2_sample_fixed_type(m, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 20| 95|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 95|#define NTRU_N 821 | | ------------------ ------------------ 13| 95|} PQCLEAN_NTRUHPS4096821_AVX2_sample_fixed_type: 16| 190|void PQCLEAN_NTRUHPS4096821_AVX2_sample_fixed_type(poly *r, const unsigned char u[NTRU_SAMPLE_FT_BYTES]) { 17| | // Assumes NTRU_SAMPLE_FT_BYTES = ceil(30*(n-1)/8) 18| | 19| 190| int32_t s[NTRU_N - 1]; 20| 190| int i; 21| | 22| | // Use 30 bits of u per word 23| 39.1k| for (i = 0; i < (NTRU_N - 1) / 4; i++) { ------------------ | | 5| 39.1k|#define NTRU_N 821 ------------------ | Branch (23:17): [True: 38.9k, False: 190] ------------------ 24| 38.9k| s[4 * i + 0] = (u[15 * i + 0] << 2) + (u[15 * i + 1] << 10) + (u[15 * i + 2] << 18) + ((uint32_t) u[15 * i + 3] << 26); 25| 38.9k| s[4 * i + 1] = ((u[15 * i + 3] & 0xc0) >> 4) + (u[15 * i + 4] << 4) + (u[15 * i + 5] << 12) + (u[15 * i + 6] << 20) + ((uint32_t) u[15 * i + 7] << 28); 26| 38.9k| s[4 * i + 2] = ((u[15 * i + 7] & 0xf0) >> 2) + (u[15 * i + 8] << 6) + (u[15 * i + 9] << 14) + (u[15 * i + 10] << 22) + ((uint32_t) u[15 * i + 11] << 30); 27| 38.9k| s[4 * i + 3] = (u[15 * i + 11] & 0xfc) + (u[15 * i + 12] << 8) + (u[15 * i + 13] << 16) + ((uint32_t) u[15 * i + 14] << 24); 28| 38.9k| } 29| | 30| 48.6k| for (i = 0; i < NTRU_WEIGHT / 2; i++) { ------------------ | | 14| 48.6k|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 48.6k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 48.6k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ | Branch (30:17): [True: 48.4k, False: 190] ------------------ 31| 48.4k| s[i] |= 1; 32| 48.4k| } 33| | 34| 48.6k| for (i = NTRU_WEIGHT / 2; i < NTRU_WEIGHT; i++) { ------------------ | | 14| 190|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 190|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 190|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ for (i = NTRU_WEIGHT / 2; i < NTRU_WEIGHT; i++) { ------------------ | | 14| 48.6k|#define NTRU_WEIGHT (NTRU_Q/8 - 2) | | ------------------ | | | | 13| 48.6k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 48.6k|#define NTRU_LOGQ 12 | | | | ------------------ | | ------------------ ------------------ | Branch (34:31): [True: 48.4k, False: 190] ------------------ 35| 48.4k| s[i] |= 2; 36| 48.4k| } 37| | 38| 190| PQCLEAN_NTRUHPS4096821_AVX2_crypto_sort_int32(s, NTRU_N - 1); ------------------ | | 5| 190|#define NTRU_N 821 ------------------ 39| | 40| 155k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 155k|#define NTRU_N 821 ------------------ | Branch (40:17): [True: 155k, False: 190] ------------------ 41| 155k| r->coeffs[i] = ((uint16_t) (s[i] & 3)); 42| 155k| } 43| | 44| 190| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 190|#define NTRU_N 821 ------------------ 45| 190|} PQCLEAN_NTRUHPS4096821_AVX2_sample_iid: 7| 190|void PQCLEAN_NTRUHPS4096821_AVX2_sample_iid(poly *r, const unsigned char uniformbytes[NTRU_SAMPLE_IID_BYTES]) { 8| 190| int i; 9| 190| union { /* align to 32 byte boundary for vmovdqa */ 10| 190| unsigned char b[PAD32(NTRU_SAMPLE_IID_BYTES)]; 11| 190| __m256i b_x32[PAD32(NTRU_SAMPLE_IID_BYTES) / 32]; 12| 190| } buffer; 13| | 14| 155k| for (i = 0; i < NTRU_SAMPLE_IID_BYTES; i++) { ------------------ | | 20| 155k|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 155k|#define NTRU_N 821 | | ------------------ ------------------ | Branch (14:17): [True: 155k, False: 190] ------------------ 15| 155k| buffer.b[i] = uniformbytes[i]; 16| 155k| } 17| 2.47k| for (i = NTRU_SAMPLE_IID_BYTES; i < PAD32(NTRU_SAMPLE_IID_BYTES); i++) { ------------------ | | 20| 190|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 190|#define NTRU_N 821 | | ------------------ ------------------ for (i = NTRU_SAMPLE_IID_BYTES; i < PAD32(NTRU_SAMPLE_IID_BYTES); i++) { ------------------ | | 11| 2.47k|#define PAD32(X) ((((X) + 31)/32)*32) ------------------ | Branch (17:37): [True: 2.28k, False: 190] ------------------ 18| 2.28k| buffer.b[i] = 0; 19| 2.28k| } 20| 190| PQCLEAN_NTRUHPS4096821_AVX2_vec32_sample_iid(r, buffer.b); 21| 190|} PQCLEAN_NTRUHRSS1373_CLEAN_cmov: 4| 2|void PQCLEAN_NTRUHRSS1373_CLEAN_cmov(unsigned char *r, const unsigned char *x, size_t len, unsigned char b) { 5| 2| size_t i; 6| | 7| 2| b = (~b + 1); 8| 66| for (i = 0; i < len; i++) { ------------------ | Branch (8:17): [True: 64, False: 2] ------------------ 9| 64| r[i] ^= b & (x[i] ^ r[i]); 10| 64| } 11| 2|} PQCLEAN_NTRUHRSS1373_CLEAN_crypto_kem_keypair: 10| 2|int PQCLEAN_NTRUHRSS1373_CLEAN_crypto_kem_keypair(uint8_t *pk, uint8_t *sk) { 11| 2| uint8_t seed[NTRU_SAMPLE_FG_BYTES]; 12| | 13| 2| randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 8| 2|#define randombytes OQS_randombytes ------------------ randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 20| 2|#define NTRU_SAMPLE_FG_BYTES (2*NTRU_SAMPLE_IID_BYTES) | | ------------------ | | | | 19| 2|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 2|#define NTRU_N 1373 | | | | ------------------ | | ------------------ ------------------ 14| 2| PQCLEAN_NTRUHRSS1373_CLEAN_owcpa_keypair(pk, sk, seed); 15| | 16| 2| randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 8| 2|#define randombytes OQS_randombytes ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 28| 2|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 24| 2|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 23| 2|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 2|#define NTRU_N 1373 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 27| 2|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 2|#define NTRU_LOGQ 14 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 23| 2|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 2|#define NTRU_N 1373 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 16| 2|#define NTRU_PRFKEYBYTES 32 ------------------ 17| | 18| 2| return 0; 19| 2|} PQCLEAN_NTRUHRSS1373_CLEAN_crypto_kem_enc: 21| 2|int PQCLEAN_NTRUHRSS1373_CLEAN_crypto_kem_enc(uint8_t *c, uint8_t *k, const uint8_t *pk) { 22| 2| poly r, m; 23| 2| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 24| 2| uint8_t rm_seed[NTRU_SAMPLE_RM_BYTES]; 25| | 26| 2| randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 8| 2|#define randombytes OQS_randombytes ------------------ randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 21| 2|#define NTRU_SAMPLE_RM_BYTES (2*NTRU_SAMPLE_IID_BYTES) | | ------------------ | | | | 19| 2|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 2|#define NTRU_N 1373 | | | | ------------------ | | ------------------ ------------------ 27| | 28| 2| PQCLEAN_NTRUHRSS1373_CLEAN_sample_rm(&r, &m, rm_seed); 29| | 30| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_tobytes(rm, &r); 31| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, &m); ------------------ | | 24| 2|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 2|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 2|#define NTRU_N 1373 | | | | ------------------ | | ------------------ ------------------ 32| 2| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 2|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 26| 2|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 24| 2|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 23| 2|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 2|#define NTRU_N 1373 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 33| | 34| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Z3_to_Zq(&r); 35| 2| PQCLEAN_NTRUHRSS1373_CLEAN_owcpa_enc(c, &r, &m, pk); 36| | 37| 2| return 0; 38| 2|} PQCLEAN_NTRUHRSS1373_CLEAN_crypto_kem_dec: 40| 2|int PQCLEAN_NTRUHRSS1373_CLEAN_crypto_kem_dec(uint8_t *k, const uint8_t *c, const uint8_t *sk) { 41| 2| int i, fail; 42| 2| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 43| 2| uint8_t buf[NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES]; 44| | 45| 2| fail = PQCLEAN_NTRUHRSS1373_CLEAN_owcpa_dec(rm, c, sk); 46| | /* If fail = 0 then c = Enc(h, rm). There is no need to re-encapsulate. */ 47| | /* See comment in PQCLEAN_NTRUHRSS1373_CLEAN_owcpa_dec for details. */ 48| | 49| 2| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 2|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 26| 2|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 24| 2|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 23| 2|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 2|#define NTRU_N 1373 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 50| | 51| | /* shake(secret PRF key || input ciphertext) */ 52| 66| for (i = 0; i < NTRU_PRFKEYBYTES; i++) { ------------------ | | 16| 66|#define NTRU_PRFKEYBYTES 32 ------------------ | Branch (52:17): [True: 64, False: 2] ------------------ 53| 64| buf[i] = sk[i + NTRU_OWCPA_SECRETKEYBYTES]; ------------------ | | 28| 64|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 24| 64|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 23| 64|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 64|#define NTRU_N 1373 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 27| 64|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 64|#define NTRU_LOGQ 14 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 23| 64|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 64|#define NTRU_N 1373 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 64| } 55| 4.80k| for (i = 0; i < NTRU_CIPHERTEXTBYTES; i++) { ------------------ | | 33| 4.80k|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 29| 4.80k|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 4.80k|#define NTRU_LOGQ 14 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 23| 4.80k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 4.80k|#define NTRU_N 1373 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (55:17): [True: 4.80k, False: 2] ------------------ 56| 4.80k| buf[NTRU_PRFKEYBYTES + i] = c[i]; ------------------ | | 16| 4.80k|#define NTRU_PRFKEYBYTES 32 ------------------ 57| 4.80k| } 58| 2| sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 15| 2|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 16| 2|#define NTRU_PRFKEYBYTES 32 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 33| 2|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 29| 2|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 2|#define NTRU_LOGQ 14 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 23| 2|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 2|#define NTRU_N 1373 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 59| | 60| 2| PQCLEAN_NTRUHRSS1373_CLEAN_cmov(k, rm, NTRU_SHAREDKEYBYTES, (unsigned char) fail); ------------------ | | 17| 2|#define NTRU_SHAREDKEYBYTES 32 ------------------ 61| | 62| 2| return 0; 63| 2|} PQCLEAN_NTRUHRSS1373_CLEAN_owcpa_keypair: 41| 2| const unsigned char seed[NTRU_SAMPLE_FG_BYTES]) { 42| 2| int i; 43| | 44| 2| poly x1, x2, x3, x4, x5; 45| | 46| 2| poly *f = &x1, *g = &x2, *invf_mod3 = &x3; 47| 2| poly *gf = &x3, *invgf = &x4, *tmp = &x5; 48| 2| poly *invh = &x3, *h = &x3; 49| | 50| 2| PQCLEAN_NTRUHRSS1373_CLEAN_sample_fg(f, g, seed); 51| | 52| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_inv(invf_mod3, f); 53| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_tobytes(sk, f); 54| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_tobytes(sk + NTRU_PACK_TRINARY_BYTES, invf_mod3); ------------------ | | 24| 2|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 2|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 2|#define NTRU_N 1373 | | | | ------------------ | | ------------------ ------------------ 55| | 56| | /* Lift coeffs of f and g from Z_p to Z_q */ 57| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Z3_to_Zq(f); 58| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Z3_to_Zq(g); 59| | 60| | /* g = 3*(x-1)*g */ 61| 2.74k| for (i = NTRU_N - 1; i > 0; i--) { ------------------ | | 5| 2|#define NTRU_N 1373 ------------------ | Branch (61:26): [True: 2.74k, False: 2] ------------------ 62| 2.74k| g->coeffs[i] = 3 * (g->coeffs[i - 1] - g->coeffs[i]); 63| 2.74k| } 64| 2| g->coeffs[0] = -(3 * g->coeffs[0]); 65| | 66| | 67| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(gf, g, f); 68| | 69| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_inv(invgf, gf); 70| | 71| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(tmp, invgf, f); 72| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_mul(invh, tmp, f); 73| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_tobytes(sk + 2 * NTRU_PACK_TRINARY_BYTES, invh); ------------------ | | 24| 2|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 2|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 2|#define NTRU_N 1373 | | | | ------------------ | | ------------------ ------------------ 74| | 75| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(tmp, invgf, g); 76| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(h, tmp, g); 77| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_sum_zero_tobytes(pk, h); 78| 2|} PQCLEAN_NTRUHRSS1373_CLEAN_owcpa_enc: 84| 2| const unsigned char *pk) { 85| 2| int i; 86| 2| poly x1, x2; 87| 2| poly *h = &x1, *liftm = &x1; 88| 2| poly *ct = &x2; 89| | 90| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_sum_zero_frombytes(h, pk); 91| | 92| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(ct, r, h); 93| | 94| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_lift(liftm, m); 95| 2.74k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (95:17): [True: 2.74k, False: 2] ------------------ 96| 2.74k| ct->coeffs[i] = ct->coeffs[i] + liftm->coeffs[i]; 97| 2.74k| } 98| | 99| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_sum_zero_tobytes(c, ct); 100| 2|} PQCLEAN_NTRUHRSS1373_CLEAN_owcpa_dec: 104| 2| const unsigned char *secretkey) { 105| 2| int i; 106| 2| int fail; 107| 2| poly x1, x2, x3, x4; 108| | 109| 2| poly *c = &x1, *f = &x2, *cf = &x3; 110| 2| poly *mf = &x2, *finv3 = &x3, *m = &x4; 111| 2| poly *liftm = &x2, *invh = &x3, *r = &x4; 112| 2| poly *b = &x1; 113| | 114| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_sum_zero_frombytes(c, ciphertext); 115| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_frombytes(f, secretkey); 116| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Z3_to_Zq(f); 117| | 118| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(cf, c, f); 119| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_to_S3(mf, cf); 120| | 121| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_frombytes(finv3, secretkey + NTRU_PACK_TRINARY_BYTES); ------------------ | | 24| 2|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 2|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 2|#define NTRU_N 1373 | | | | ------------------ | | ------------------ ------------------ 122| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_mul(m, mf, finv3); 123| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, m); ------------------ | | 24| 2|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 2|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 2|#define NTRU_N 1373 | | | | ------------------ | | ------------------ ------------------ 124| | 125| 2| fail = 0; 126| | 127| | /* Check that the unused bits of the last byte of the ciphertext are zero */ 128| 2| fail |= owcpa_check_ciphertext(ciphertext); 129| | 130| | /* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */ 131| | /* We can avoid re-computing r*h + Lift(m) as long as we check that */ 132| | /* r (defined as b/h mod (q, Phi_n)) and m are in the message space. */ 133| | /* (m can take any value in S3 in NTRU_HRSS) */ 134| | 135| | /* b = c - Lift(m) mod (q, x^n - 1) */ 136| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_lift(liftm, m); 137| 2.74k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (137:17): [True: 2.74k, False: 2] ------------------ 138| 2.74k| b->coeffs[i] = c->coeffs[i] - liftm->coeffs[i]; 139| 2.74k| } 140| | 141| | /* r = b / h mod (q, Phi_n) */ 142| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_frombytes(invh, secretkey + 2 * NTRU_PACK_TRINARY_BYTES); ------------------ | | 24| 2|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 2|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 2|#define NTRU_N 1373 | | | | ------------------ | | ------------------ ------------------ 143| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_mul(r, b, invh); 144| | 145| | /* NOTE: Our definition of r as b/h mod (q, Phi_n) follows Figure 4 of */ 146| | /* [Sch18] https://eprint.iacr.org/2018/1174/20181203:032458. */ 147| | /* This differs from Figure 10 of Saito--Xagawa--Yamakawa */ 148| | /* [SXY17] https://eprint.iacr.org/2017/1005/20180516:055500 */ 149| | /* where r gets a final reduction modulo p. */ 150| | /* We need this change to use Proposition 1 of [Sch18]. */ 151| | 152| | /* Proposition 1 of [Sch18] shows that re-encryption with (r,m) yields c. */ 153| | /* if and only if fail==0 after the following call to owcpa_check_r */ 154| | /* The procedure given in Fig. 8 of [Sch18] can be skipped because we have */ 155| | /* c(1) = 0 due to the use of poly_Rq_sum_zero_{to,from}bytes. */ 156| 2| fail |= owcpa_check_r(r); 157| | 158| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_trinary_Zq_to_Z3(r); 159| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_tobytes(rm, r); 160| | 161| 2| return fail; 162| 2|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_tobytes: 3| 12|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_tobytes(unsigned char msg[NTRU_PACK_TRINARY_BYTES], const poly *a) { 4| 12| int i; 5| 12| unsigned char c; 6| 12| int j; 7| | 8| 3.30k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 23| 3.30k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 3.30k|#define NTRU_N 1373 | | ------------------ ------------------ | Branch (8:17): [True: 3.28k, False: 12] ------------------ 9| 3.28k| c = a->coeffs[5 * i + 4] & 255; 10| 3.28k| c = (3 * c + a->coeffs[5 * i + 3]) & 255; 11| 3.28k| c = (3 * c + a->coeffs[5 * i + 2]) & 255; 12| 3.28k| c = (3 * c + a->coeffs[5 * i + 1]) & 255; 13| 3.28k| c = (3 * c + a->coeffs[5 * i + 0]) & 255; 14| 3.28k| msg[i] = c; 15| 3.28k| } 16| 12| i = NTRU_PACK_DEG / 5; ------------------ | | 23| 12|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 12|#define NTRU_N 1373 | | ------------------ ------------------ 17| 12| c = 0; 18| 36| for (j = NTRU_PACK_DEG - (5 * i) - 1; j >= 0; j--) { ------------------ | | 23| 12|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 12|#define NTRU_N 1373 | | ------------------ ------------------ | Branch (18:43): [True: 24, False: 12] ------------------ 19| 24| c = (3 * c + a->coeffs[5 * i + j]) & 255; 20| 24| } 21| 12| msg[i] = c; 22| 12|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_frombytes: 24| 4|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_frombytes(poly *r, const unsigned char msg[NTRU_PACK_TRINARY_BYTES]) { 25| 4| int i; 26| 4| unsigned char c; 27| 4| int j; 28| | 29| 1.10k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 23| 1.10k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 1.10k|#define NTRU_N 1373 | | ------------------ ------------------ | Branch (29:17): [True: 1.09k, False: 4] ------------------ 30| 1.09k| c = msg[i]; 31| 1.09k| r->coeffs[5 * i + 0] = c; 32| 1.09k| r->coeffs[5 * i + 1] = c * 171 >> 9; // this is division by 3 33| 1.09k| r->coeffs[5 * i + 2] = c * 57 >> 9; // division by 3^2 34| 1.09k| r->coeffs[5 * i + 3] = c * 19 >> 9; // division by 3^3 35| 1.09k| r->coeffs[5 * i + 4] = c * 203 >> 14; // etc. 36| 1.09k| } 37| 4| i = NTRU_PACK_DEG / 5; ------------------ | | 23| 4|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 4|#define NTRU_N 1373 | | ------------------ ------------------ 38| 4| c = msg[i]; 39| 12| for (j = 0; (5 * i + j) < NTRU_PACK_DEG; j++) { ------------------ | | 23| 12|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 12|#define NTRU_N 1373 | | ------------------ ------------------ | Branch (39:17): [True: 8, False: 4] ------------------ 40| 8| r->coeffs[5 * i + j] = c; 41| 8| c = c * 171 >> 9; 42| 8| } 43| 4| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 4|#define NTRU_N 1373 ------------------ 44| 4| PQCLEAN_NTRUHRSS1373_CLEAN_poly_mod_3_Phi_n(r); 45| 4|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_tobytes: 4| 6|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_tobytes(unsigned char *r, const poly *a) { 5| 6| int i, j; 6| 6| uint16_t t[4]; 7| | 8| 2.06k| for (i = 0; i < NTRU_PACK_DEG / 4; i++) { ------------------ | | 23| 2.06k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 2.06k|#define NTRU_N 1373 | | ------------------ ------------------ | Branch (8:17): [True: 2.05k, False: 6] ------------------ 9| 10.2k| for (j = 0; j < 4; j++) { ------------------ | Branch (9:21): [True: 8.23k, False: 2.05k] ------------------ 10| 8.23k| t[j] = MODQ(a->coeffs[4 * i + j]); ------------------ | | 9| 8.23k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 8.23k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 8.23k|#define NTRU_LOGQ 14 | | | | ------------------ | | ------------------ ------------------ 11| 8.23k| } 12| | 13| | // t0 t1 t2 t3 14| | // r0 8 15| | // r1 6 | 2 16| | // r2 8 17| | // r3 4 | 4 18| | // r4 8 19| | // r5 2 | 6 20| | // r6 8 21| 2.05k| r[7 * i + 0] = (unsigned char) ( t[0] & 0xff ); 22| 2.05k| r[7 * i + 1] = (unsigned char) ((t[0] >> 8) | ((t[1] & 0x03) << 6)); 23| 2.05k| r[7 * i + 2] = (unsigned char) ((t[1] >> 2) & 0xff); 24| 2.05k| r[7 * i + 3] = (unsigned char) ((t[1] >> 10) | ((t[2] & 0x0f) << 4)); 25| 2.05k| r[7 * i + 4] = (unsigned char) ((t[2] >> 4) & 0xff); 26| 2.05k| r[7 * i + 5] = (unsigned char) ((t[2] >> 12) | ((t[3] & 0x3f) << 2)); 27| 2.05k| r[7 * i + 6] = (unsigned char) ( t[3] >> 6); 28| 2.05k| } 29| | 30| | // i=NTRU_PACK_DEG/4; 31| 6| if (NTRU_PACK_DEG % 4 == 2) { ------------------ | | 23| 6|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 6|#define NTRU_N 1373 | | ------------------ ------------------ | Branch (31:9): [Folded, False: 6] ------------------ 32| 0| t[0] = MODQ(a->coeffs[NTRU_PACK_DEG - 2]); ------------------ | | 9| 0|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 0|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 0|#define NTRU_LOGQ 14 | | | | ------------------ | | ------------------ ------------------ 33| 0| t[1] = MODQ(a->coeffs[NTRU_PACK_DEG - 1]); ------------------ | | 9| 0|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 0|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 0|#define NTRU_LOGQ 14 | | | | ------------------ | | ------------------ ------------------ 34| 0| r[7 * i + 0] = (unsigned char) ( t[0] & 0xff ); 35| 0| r[7 * i + 1] = (unsigned char) ((t[0] >> 8) | ((t[1] & 0x03) << 6)); 36| 0| r[7 * i + 2] = (unsigned char) ((t[1] >> 2) & 0xff); 37| 0| r[7 * i + 3] = (unsigned char) ( t[1] >> 10 ); 38| 0| } 39| 6|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_frombytes: 41| 6|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_frombytes(poly *r, const unsigned char *a) { 42| 6| int i; 43| 2.06k| for (i = 0; i < NTRU_PACK_DEG / 4; i++) { ------------------ | | 23| 2.06k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 2.06k|#define NTRU_N 1373 | | ------------------ ------------------ | Branch (43:17): [True: 2.05k, False: 6] ------------------ 44| 2.05k| r->coeffs[4 * i + 0] = a[7 * i + 0] | (((uint16_t)a[7 * i + 1] & 0x3f) << 8); 45| 2.05k| r->coeffs[4 * i + 1] = (a[7 * i + 1] >> 6) | (((uint16_t)a[7 * i + 2] ) << 2) | (((uint16_t)a[7 * i + 3] & 0x0f) << 10); 46| 2.05k| r->coeffs[4 * i + 2] = (a[7 * i + 3] >> 4) | (((uint16_t)a[7 * i + 4] & 0xff) << 4) | (((uint16_t)a[7 * i + 5] & 0x03) << 12); 47| 2.05k| r->coeffs[4 * i + 3] = (a[7 * i + 5] >> 2) | (((uint16_t)a[7 * i + 6] ) << 6); 48| 2.05k| } 49| | 50| | // i=NTRU_PACK_DEG/4; 51| 6| if (NTRU_PACK_DEG % 4 == 2) { ------------------ | | 23| 6|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 6|#define NTRU_N 1373 | | ------------------ ------------------ | Branch (51:9): [Folded, False: 6] ------------------ 52| 0| r->coeffs[4 * i + 0] = a[7 * i + 0] | (((uint16_t)a[7 * i + 1] & 0x3f) << 8); 53| 0| r->coeffs[4 * i + 1] = (a[7 * i + 1] >> 6) | (((uint16_t)a[7 * i + 2] ) << 2) | (((uint16_t)a[7 * i + 3] & 0x0f) << 10); 54| 0| } 55| 6| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 6|#define NTRU_N 1373 ------------------ 56| 6|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_sum_zero_tobytes: 58| 4|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_sum_zero_tobytes(unsigned char *r, const poly *a) { 59| 4| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_tobytes(r, a); 60| 4|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_sum_zero_frombytes: 62| 4|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_sum_zero_frombytes(poly *r, const unsigned char *a) { 63| 4| int i; 64| 4| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_frombytes(r, a); 65| | 66| | /* Set r[n-1] so that the sum of coefficients is zero mod q */ 67| 4| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 4|#define NTRU_N 1373 ------------------ 68| 5.49k| for (i = 0; i < NTRU_PACK_DEG; i++) { ------------------ | | 23| 5.49k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 5.49k|#define NTRU_N 1373 | | ------------------ ------------------ | Branch (68:17): [True: 5.48k, False: 4] ------------------ 69| 5.48k| r->coeffs[NTRU_N - 1] -= r->coeffs[i]; ------------------ | | 5| 5.48k|#define NTRU_N 1373 ------------------ 70| 5.48k| } 71| 4|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_Z3_to_Zq: 4| 12|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_Z3_to_Zq(poly *r) { 5| 12| int i; 6| 16.4k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 16.4k|#define NTRU_N 1373 ------------------ | Branch (6:17): [True: 16.4k, False: 12] ------------------ 7| 16.4k| r->coeffs[i] = r->coeffs[i] | ((-(r->coeffs[i] >> 1)) & (NTRU_Q - 1)); ------------------ | | 13| 16.4k|#define NTRU_Q (1 << NTRU_LOGQ) | | ------------------ | | | | 6| 16.4k|#define NTRU_LOGQ 14 | | ------------------ ------------------ 8| 16.4k| } 9| 12|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_trinary_Zq_to_Z3: 12| 2|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_trinary_Zq_to_Z3(poly *r) { 13| 2| int i; 14| 2.74k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (14:17): [True: 2.74k, False: 2] ------------------ 15| 2.74k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 2.74k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 2.74k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 2.74k|#define NTRU_LOGQ 14 | | | | ------------------ | | ------------------ ------------------ 16| 2.74k| r->coeffs[i] = 3 & (r->coeffs[i] ^ (r->coeffs[i] >> (NTRU_LOGQ - 1))); ------------------ | | 6| 2.74k|#define NTRU_LOGQ 14 ------------------ 17| 2.74k| } 18| 2|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_mul: 20| 4|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_Sq_mul(poly *r, const poly *a, const poly *b) { 21| 4| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(r, a, b); 22| 4| PQCLEAN_NTRUHRSS1373_CLEAN_poly_mod_q_Phi_n(r); 23| 4|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_mul: 25| 2|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_mul(poly *r, const poly *a, const poly *b) { 26| 2| int i; 27| | 28| | /* Our S3 multiplications do not overflow mod q, */ 29| | /* so we can re-purpose PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul, as long as we */ 30| | /* follow with an explicit reduction mod q. */ 31| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(r, a, b); 32| 2.74k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (32:17): [True: 2.74k, False: 2] ------------------ 33| 2.74k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 2.74k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 2.74k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 2.74k|#define NTRU_LOGQ 14 | | | | ------------------ | | ------------------ ------------------ 34| 2.74k| } 35| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_mod_3_Phi_n(r); 36| 2|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_inv: 71| 2|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_inv(poly *r, const poly *a) { 72| 2| poly ai2; 73| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_R2_inv(&ai2, a); 74| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_R2_inv_to_Rq_inv(r, &ai2, a); 75| 2|} poly.c:PQCLEAN_NTRUHRSS1373_CLEAN_poly_R2_inv_to_Rq_inv: 38| 2|static void PQCLEAN_NTRUHRSS1373_CLEAN_poly_R2_inv_to_Rq_inv(poly *r, const poly *ai, const poly *a) { 39| | 40| 2| int i; 41| 2| poly b, c; 42| 2| poly s; 43| | 44| | // for 0..4 45| | // ai = ai * (2 - a*ai) mod q 46| 2.74k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (46:17): [True: 2.74k, False: 2] ------------------ 47| 2.74k| b.coeffs[i] = -(a->coeffs[i]); 48| 2.74k| } 49| | 50| 2.74k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (50:17): [True: 2.74k, False: 2] ------------------ 51| 2.74k| r->coeffs[i] = ai->coeffs[i]; 52| 2.74k| } 53| | 54| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(&c, r, &b); 55| 2| c.coeffs[0] += 2; // c = 2 - a*ai 56| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(&s, &c, r); // s = ai*c 57| | 58| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(&c, &s, &b); 59| 2| c.coeffs[0] += 2; // c = 2 - a*s 60| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(r, &c, &s); // r = s*c 61| | 62| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(&c, r, &b); 63| 2| c.coeffs[0] += 2; // c = 2 - a*r 64| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(&s, &c, r); // s = r*c 65| | 66| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(&c, &s, &b); 67| 2| c.coeffs[0] += 2; // c = 2 - a*s 68| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(r, &c, &s); // r = s*c 69| 2|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_lift: 4| 4|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_lift(poly *r, const poly *a) { 5| | /* NOTE: Assumes input is in {0,1,2}^N */ 6| | /* Produces output in [0,Q-1]^N */ 7| 4| int i; 8| 4| poly b; 9| 4| uint16_t t, zj; 10| | 11| | /* Define z by = delta_{i,0} mod 3: */ 12| | /* t = -1/N mod p = -N mod 3 */ 13| | /* z[0] = 2 - t mod 3 */ 14| | /* z[1] = 0 mod 3 */ 15| | /* z[j] = z[j-1] + t mod 3 */ 16| | /* We'll compute b = a/(x-1) mod (3, Phi) using */ 17| | /* b[0] = , b[1] = , b[2] = */ 18| | /* b[i] = b[i-3] - (a[i] + a[i-1] + a[i-2]) */ 19| 4| t = 3 - (NTRU_N % 3); ------------------ | | 5| 4|#define NTRU_N 1373 ------------------ 20| 4| b.coeffs[0] = a->coeffs[0] * (2 - t) + a->coeffs[1] * 0 + a->coeffs[2] * t; 21| 4| b.coeffs[1] = a->coeffs[1] * (2 - t) + a->coeffs[2] * 0; 22| 4| b.coeffs[2] = a->coeffs[2] * (2 - t); 23| | 24| 4| zj = 0; /* z[1] */ 25| 5.48k| for (i = 3; i < NTRU_N; i++) { ------------------ | | 5| 5.48k|#define NTRU_N 1373 ------------------ | Branch (25:17): [True: 5.48k, False: 4] ------------------ 26| 5.48k| b.coeffs[0] += a->coeffs[i] * (zj + 2 * t); 27| 5.48k| b.coeffs[1] += a->coeffs[i] * (zj + t); 28| 5.48k| b.coeffs[2] += a->coeffs[i] * zj; 29| 5.48k| zj = (zj + t) % 3; 30| 5.48k| } 31| 4| b.coeffs[1] += a->coeffs[0] * (zj + t); 32| 4| b.coeffs[2] += a->coeffs[0] * zj; 33| 4| b.coeffs[2] += a->coeffs[1] * (zj + t); 34| | 35| 4| b.coeffs[0] = b.coeffs[0]; 36| 4| b.coeffs[1] = b.coeffs[1]; 37| 4| b.coeffs[2] = b.coeffs[2]; 38| 5.48k| for (i = 3; i < NTRU_N; i++) { ------------------ | | 5| 5.48k|#define NTRU_N 1373 ------------------ | Branch (38:17): [True: 5.48k, False: 4] ------------------ 39| 5.48k| b.coeffs[i] = b.coeffs[i - 3] + 2 * (a->coeffs[i] + a->coeffs[i - 1] + a->coeffs[i - 2]); 40| 5.48k| } 41| | 42| | /* Finish reduction mod Phi by subtracting Phi * b[N-1] */ 43| 4| PQCLEAN_NTRUHRSS1373_CLEAN_poly_mod_3_Phi_n(&b); 44| | 45| | /* Switch from {0,1,2} to {0,1,q-1} coefficient representation */ 46| 4| PQCLEAN_NTRUHRSS1373_CLEAN_poly_Z3_to_Zq(&b); 47| | 48| | /* Multiply by (x-1) */ 49| 4| r->coeffs[0] = -(b.coeffs[0]); 50| 5.49k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 5.49k|#define NTRU_N 1373 ------------------ | Branch (50:17): [True: 5.48k, False: 4] ------------------ 51| 5.48k| r->coeffs[i + 1] = b.coeffs[i] - b.coeffs[i + 1]; 52| 5.48k| } 53| 4|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_mod_3_Phi_n: 18| 12|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_mod_3_Phi_n(poly *r) { 19| 12| int i; 20| 16.4k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 16.4k|#define NTRU_N 1373 ------------------ | Branch (20:17): [True: 16.4k, False: 12] ------------------ 21| 16.4k| r->coeffs[i] = mod3(r->coeffs[i] + 2 * r->coeffs[NTRU_N - 1]); ------------------ | | 5| 16.4k|#define NTRU_N 1373 ------------------ 22| 16.4k| } 23| 12|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_mod_q_Phi_n: 25| 4|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_mod_q_Phi_n(poly *r) { 26| 4| int i; 27| 5.49k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 5.49k|#define NTRU_N 1373 ------------------ | Branch (27:17): [True: 5.49k, False: 4] ------------------ 28| 5.49k| r->coeffs[i] = r->coeffs[i] - r->coeffs[NTRU_N - 1]; ------------------ | | 5| 5.49k|#define NTRU_N 1373 ------------------ 29| 5.49k| } 30| 4|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_to_S3: 32| 2|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_to_S3(poly *r, const poly *a) { 33| 2| int i; 34| 2| uint16_t flag; 35| | 36| | /* The coefficients of a are stored as non-negative integers. */ 37| | /* We must translate to representatives in [-q/2, q/2) before */ 38| | /* reduction mod 3. */ 39| 2.74k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (39:17): [True: 2.74k, False: 2] ------------------ 40| | /* Need an explicit reduction mod q here */ 41| 2.74k| r->coeffs[i] = MODQ(a->coeffs[i]); ------------------ | | 9| 2.74k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 2.74k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 2.74k|#define NTRU_LOGQ 14 | | | | ------------------ | | ------------------ ------------------ 42| | 43| | /* flag = 1 if r[i] >= q/2 else 0 */ 44| 2.74k| flag = r->coeffs[i] >> (NTRU_LOGQ - 1); ------------------ | | 6| 2.74k|#define NTRU_LOGQ 14 ------------------ 45| | 46| | /* Now we will add (-q) mod 3 if r[i] >= q/2 */ 47| | /* Note (-q) mod 3=(-2^k) mod 3=1<<(1-(k&1)) */ 48| 2.74k| r->coeffs[i] += flag << (1 - (NTRU_LOGQ & 1)); ------------------ | | 6| 2.74k|#define NTRU_LOGQ 14 ------------------ 49| 2.74k| } 50| | 51| 2| PQCLEAN_NTRUHRSS1373_CLEAN_poly_mod_3_Phi_n(r); 52| 2|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_R2_inv: 10| 2|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_R2_inv(poly *r, const poly *a) { 11| 2| poly f, g, v, w; 12| 2| size_t i, loop; 13| 2| int16_t delta, sign, swap, t; 14| | 15| 2.74k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (15:17): [True: 2.74k, False: 2] ------------------ 16| 2.74k| v.coeffs[i] = 0; 17| 2.74k| } 18| 2.74k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (18:17): [True: 2.74k, False: 2] ------------------ 19| 2.74k| w.coeffs[i] = 0; 20| 2.74k| } 21| 2| w.coeffs[0] = 1; 22| | 23| 2.74k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (23:17): [True: 2.74k, False: 2] ------------------ 24| 2.74k| f.coeffs[i] = 1; 25| 2.74k| } 26| 2.74k| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (26:17): [True: 2.74k, False: 2] ------------------ 27| 2.74k| g.coeffs[NTRU_N - 2 - i] = (a->coeffs[i] ^ a->coeffs[NTRU_N - 1]) & 1; ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ g.coeffs[NTRU_N - 2 - i] = (a->coeffs[i] ^ a->coeffs[NTRU_N - 1]) & 1; ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ 28| 2.74k| } 29| 2| g.coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 2|#define NTRU_N 1373 ------------------ 30| | 31| 2| delta = 1; 32| | 33| 5.48k| for (loop = 0; loop < 2 * (NTRU_N - 1) - 1; ++loop) { ------------------ | | 5| 5.48k|#define NTRU_N 1373 ------------------ | Branch (33:20): [True: 5.48k, False: 2] ------------------ 34| 7.53M| for (i = NTRU_N - 1; i > 0; --i) { ------------------ | | 5| 5.48k|#define NTRU_N 1373 ------------------ | Branch (34:30): [True: 7.52M, False: 5.48k] ------------------ 35| 7.52M| v.coeffs[i] = v.coeffs[i - 1]; 36| 7.52M| } 37| 5.48k| v.coeffs[0] = 0; 38| | 39| 5.48k| sign = g.coeffs[0] & f.coeffs[0]; 40| 5.48k| swap = both_negative_mask(-delta, -(int16_t) g.coeffs[0]); 41| 5.48k| delta ^= swap & (delta ^ -delta); 42| 5.48k| delta += 1; 43| | 44| 7.53M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 7.53M|#define NTRU_N 1373 ------------------ | Branch (44:21): [True: 7.53M, False: 5.48k] ------------------ 45| 7.53M| t = swap & (f.coeffs[i] ^ g.coeffs[i]); 46| 7.53M| f.coeffs[i] ^= t; 47| 7.53M| g.coeffs[i] ^= t; 48| 7.53M| t = swap & (v.coeffs[i] ^ w.coeffs[i]); 49| 7.53M| v.coeffs[i] ^= t; 50| 7.53M| w.coeffs[i] ^= t; 51| 7.53M| } 52| | 53| 7.53M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 7.53M|#define NTRU_N 1373 ------------------ | Branch (53:21): [True: 7.53M, False: 5.48k] ------------------ 54| 7.53M| g.coeffs[i] = g.coeffs[i] ^ (sign & f.coeffs[i]); 55| 7.53M| } 56| 7.53M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 7.53M|#define NTRU_N 1373 ------------------ | Branch (56:21): [True: 7.53M, False: 5.48k] ------------------ 57| 7.53M| w.coeffs[i] = w.coeffs[i] ^ (sign & v.coeffs[i]); 58| 7.53M| } 59| 7.53M| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 7.53M|#define NTRU_N 1373 ------------------ | Branch (59:21): [True: 7.52M, False: 5.48k] ------------------ 60| 7.52M| g.coeffs[i] = g.coeffs[i + 1]; 61| 7.52M| } 62| 5.48k| g.coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 5.48k|#define NTRU_N 1373 ------------------ 63| 5.48k| } 64| | 65| 2.74k| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (65:17): [True: 2.74k, False: 2] ------------------ 66| 2.74k| r->coeffs[i] = v.coeffs[NTRU_N - 2 - i]; ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ 67| 2.74k| } 68| 2| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 2|#define NTRU_N 1373 ------------------ 69| 2|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul: 29| 34|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_Rq_mul(poly *r, const poly *a, const poly *b) { 30| 34| size_t i; 31| 34| uint16_t ab[2 * L]; 32| | 33| 46.7k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 46.7k|#define NTRU_N 1373 ------------------ | Branch (33:17): [True: 46.6k, False: 34] ------------------ 34| 46.6k| ab[i] = a->coeffs[i]; 35| 46.6k| ab[L + i] = b->coeffs[i]; ------------------ | | 6| 46.6k|#define L PAD32(NTRU_N) | | ------------------ | | | | 11| 46.6k|#define PAD32(X) ((((X) + 31)/32)*32) | | ------------------ ------------------ 36| 46.6k| } 37| 136| for (i = NTRU_N; i < L; i++) { ------------------ | | 5| 34|#define NTRU_N 1373 ------------------ for (i = NTRU_N; i < L; i++) { ------------------ | | 6| 136|#define L PAD32(NTRU_N) | | ------------------ | | | | 11| 136|#define PAD32(X) ((((X) + 31)/32)*32) | | ------------------ ------------------ | Branch (37:22): [True: 102, False: 34] ------------------ 38| 102| ab[i] = 0; 39| 102| ab[L + i] = 0; ------------------ | | 6| 102|#define L PAD32(NTRU_N) | | ------------------ | | | | 11| 102|#define PAD32(X) ((((X) + 31)/32)*32) | | ------------------ ------------------ 40| 102| } 41| | 42| 34| k2x4_mul(ab, ab, ab + L); ------------------ | | 6| 34|#define L PAD32(NTRU_N) | | ------------------ | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | ------------------ ------------------ 43| | 44| 46.7k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 46.7k|#define NTRU_N 1373 ------------------ | Branch (44:17): [True: 46.6k, False: 34] ------------------ 45| 46.6k| r->coeffs[i] = ab[i] + ab[NTRU_N + i]; ------------------ | | 5| 46.6k|#define NTRU_N 1373 ------------------ 46| 46.6k| } 47| 34|} poly_rq_mul.c:k2x4_mul: 49| 34|static void k2x4_mul(uint16_t ab[2 * L], const uint16_t a[L], const uint16_t b[L]) { 50| 34| uint16_t tmpA[9 * K]; 51| 34| uint16_t tmpB[9 * K]; 52| 34| uint16_t eC[81 * 2 * K]; 53| | 54| 34| k2x4_eval_00(tmpA, a); 55| 34| k2x4_eval_00(tmpB, b); 56| 34| k2x4_basemul(eC + 0 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 57| | 58| 34| k2x4_eval_0inf(tmpA, a); 59| 34| k2x4_eval_0inf(tmpB, b); 60| 34| k2x4_basemul(eC + 1 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 61| | 62| 34| k2x4_eval_inf0(tmpA, a); 63| 34| k2x4_eval_inf0(tmpB, b); 64| 34| k2x4_basemul(eC + 2 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 65| | 66| 34| k2x4_eval_infinf(tmpA, a); 67| 34| k2x4_eval_infinf(tmpB, b); 68| 34| k2x4_basemul(eC + 3 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 69| | 70| 34| k2x4_eval_01(tmpA, a); 71| 34| k2x4_eval_01(tmpB, b); 72| 34| k2x4_basemul(eC + 4 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 73| | 74| 34| k2x4_eval_1inf(tmpA, a); 75| 34| k2x4_eval_1inf(tmpB, b); 76| 34| k2x4_basemul(eC + 5 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 77| | 78| 34| k2x4_eval_10(tmpA, a); 79| 34| k2x4_eval_10(tmpB, b); 80| 34| k2x4_basemul(eC + 6 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 81| | 82| 34| k2x4_eval_inf1(tmpA, a); 83| 34| k2x4_eval_inf1(tmpB, b); 84| 34| k2x4_basemul(eC + 7 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 85| | 86| 34| k2x4_eval_11(tmpA, a); 87| 34| k2x4_eval_11(tmpB, b); 88| 34| k2x4_basemul(eC + 8 * 9 * 2 * K, tmpA, tmpB); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 89| | 90| 34| k2x4_interpolate(ab, eC); 91| 34|} poly_rq_mul.c:k2x4_eval_00: 93| 68|static void k2x4_eval_00(uint16_t r[9 * K], const uint16_t a[L]) { 94| 23.4k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 23.4k|#define M (L/4) | | ------------------ | | | | 6| 23.4k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.4k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (94:24): [True: 23.3k, False: 68] ------------------ 95| 23.3k| r[i] = a[i]; 96| 23.3k| } 97| 68| k2x2_eval(r); 98| 68|} poly_rq_mul.c:k2x4_basemul: 181| 306|static void k2x4_basemul(uint16_t r[18 * K], const uint16_t a[9 * K], const uint16_t b[9 * K]) { 182| 306| schoolbook_KxK(r + 0 * 2 * K, a + 0 * K, b + 0 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 0 * 2 * K, a + 0 * K, b + 0 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 0 * 2 * K, a + 0 * K, b + 0 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 183| 306| schoolbook_KxK(r + 1 * 2 * K, a + 1 * K, b + 1 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 1 * 2 * K, a + 1 * K, b + 1 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 1 * 2 * K, a + 1 * K, b + 1 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 184| 306| schoolbook_KxK(r + 2 * 2 * K, a + 2 * K, b + 2 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 2 * 2 * K, a + 2 * K, b + 2 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 2 * 2 * K, a + 2 * K, b + 2 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 185| 306| schoolbook_KxK(r + 3 * 2 * K, a + 3 * K, b + 3 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 3 * 2 * K, a + 3 * K, b + 3 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 3 * 2 * K, a + 3 * K, b + 3 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 186| 306| schoolbook_KxK(r + 4 * 2 * K, a + 4 * K, b + 4 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 4 * 2 * K, a + 4 * K, b + 4 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 4 * 2 * K, a + 4 * K, b + 4 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 187| 306| schoolbook_KxK(r + 5 * 2 * K, a + 5 * K, b + 5 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 5 * 2 * K, a + 5 * K, b + 5 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 5 * 2 * K, a + 5 * K, b + 5 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 188| 306| schoolbook_KxK(r + 6 * 2 * K, a + 6 * K, b + 6 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 6 * 2 * K, a + 6 * K, b + 6 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 6 * 2 * K, a + 6 * K, b + 6 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 189| 306| schoolbook_KxK(r + 7 * 2 * K, a + 7 * K, b + 7 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 7 * 2 * K, a + 7 * K, b + 7 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 7 * 2 * K, a + 7 * K, b + 7 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 190| 306| schoolbook_KxK(r + 8 * 2 * K, a + 8 * K, b + 8 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 8 * 2 * K, a + 8 * K, b + 8 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ schoolbook_KxK(r + 8 * 2 * K, a + 8 * K, b + 8 * K); ------------------ | | 8| 306|#define K (L/16) | | ------------------ | | | | 6| 306|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 306|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 191| 306|} poly_rq_mul.c:k2x4_eval_0inf: 108| 68|static void k2x4_eval_0inf(uint16_t r[9 * K], const uint16_t a[L]) { 109| 23.4k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 23.4k|#define M (L/4) | | ------------------ | | | | 6| 23.4k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.4k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (109:24): [True: 23.3k, False: 68] ------------------ 110| 23.3k| r[i] = a[1 * M + i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 111| 23.3k| } 112| 68| k2x2_eval(r); 113| 68|} poly_rq_mul.c:k2x4_eval_inf0: 141| 68|static void k2x4_eval_inf0(uint16_t r[9 * K], const uint16_t a[L]) { 142| 23.4k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 23.4k|#define M (L/4) | | ------------------ | | | | 6| 23.4k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.4k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (142:24): [True: 23.3k, False: 68] ------------------ 143| 23.3k| r[i] = a[2 * M + i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 144| 23.3k| } 145| 68| k2x2_eval(r); 146| 68|} poly_rq_mul.c:k2x4_eval_infinf: 156| 68|static void k2x4_eval_infinf(uint16_t r[9 * K], const uint16_t a[L]) { 157| 23.4k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 23.4k|#define M (L/4) | | ------------------ | | | | 6| 23.4k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.4k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (157:24): [True: 23.3k, False: 68] ------------------ 158| 23.3k| r[i] = a[3 * M + i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 159| 23.3k| } 160| 68| k2x2_eval(r); 161| 68|} poly_rq_mul.c:k2x4_eval_01: 100| 68|static void k2x4_eval_01(uint16_t r[9 * K], const uint16_t a[L]) { 101| 23.4k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 23.4k|#define M (L/4) | | ------------------ | | | | 6| 23.4k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.4k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (101:24): [True: 23.3k, False: 68] ------------------ 102| 23.3k| r[i] = a[0 * M + i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 103| 23.3k| r[i] += a[1 * M + i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 104| 23.3k| } 105| 68| k2x2_eval(r); 106| 68|} poly_rq_mul.c:k2x4_eval_1inf: 133| 68|static void k2x4_eval_1inf(uint16_t r[9 * K], const uint16_t a[L]) { 134| 23.4k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 23.4k|#define M (L/4) | | ------------------ | | | | 6| 23.4k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.4k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (134:24): [True: 23.3k, False: 68] ------------------ 135| 23.3k| r[i] = a[1 * M + i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 136| 23.3k| r[i] += a[3 * M + i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 137| 23.3k| } 138| 68| k2x2_eval(r); 139| 68|} poly_rq_mul.c:k2x4_eval_10: 115| 68|static void k2x4_eval_10(uint16_t r[9 * K], const uint16_t a[L]) { 116| 23.4k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 23.4k|#define M (L/4) | | ------------------ | | | | 6| 23.4k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.4k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (116:24): [True: 23.3k, False: 68] ------------------ 117| 23.3k| r[i] = a[0 * M + i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 118| 23.3k| r[i] += a[2 * M + i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 119| 23.3k| } 120| 68| k2x2_eval(r); 121| 68|} poly_rq_mul.c:k2x4_eval_inf1: 148| 68|static void k2x4_eval_inf1(uint16_t r[9 * K], const uint16_t a[L]) { 149| 23.4k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 23.4k|#define M (L/4) | | ------------------ | | | | 6| 23.4k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.4k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (149:24): [True: 23.3k, False: 68] ------------------ 150| 23.3k| r[i] = a[2 * M + i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 151| 23.3k| r[i] += a[3 * M + i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 152| 23.3k| } 153| 68| k2x2_eval(r); 154| 68|} poly_rq_mul.c:k2x4_eval_11: 123| 68|static void k2x4_eval_11(uint16_t r[9 * K], const uint16_t a[L]) { 124| 23.4k| for (size_t i = 0; i < M; i++) { ------------------ | | 7| 23.4k|#define M (L/4) | | ------------------ | | | | 6| 23.4k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.4k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (124:24): [True: 23.3k, False: 68] ------------------ 125| 23.3k| r[i] = a[0 * M + i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 126| 23.3k| r[i] += a[1 * M + i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 127| 23.3k| r[i] += a[2 * M + i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 128| 23.3k| r[i] += a[3 * M + i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 129| 23.3k| } 130| 68| k2x2_eval(r); 131| 68|} poly_rq_mul.c:k2x4_interpolate: 207| 34|static void k2x4_interpolate(uint16_t r[2 * L], const uint16_t a[81 * 2 * K]) { 208| 34| size_t i; 209| | 210| 34| uint16_t tmp[4 * M]; 211| | 212| 34| uint16_t P1[2 * M]; 213| 34| uint16_t P2[2 * M]; 214| 34| uint16_t P3[2 * M]; 215| | 216| 34| k2x2_interpolate(P1, a + 0 * 9 * 2 * K); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 217| 34| k2x2_interpolate(P2, a + 1 * 9 * 2 * K); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 218| 34| k2x2_interpolate(P3, a + 4 * 9 * 2 * K); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 219| 23.4k| for (i = 0; i < 2 * M; i++) { ------------------ | | 7| 23.4k|#define M (L/4) | | ------------------ | | | | 6| 23.4k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.4k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (219:17): [True: 23.3k, False: 34] ------------------ 220| 23.3k| r[0 * M + i] = P1[i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 221| 23.3k| r[2 * M + i] = P2[i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 222| 23.3k| } 223| | 224| 23.4k| for (i = 0; i < 2 * M; i++) { ------------------ | | 7| 23.4k|#define M (L/4) | | ------------------ | | | | 6| 23.4k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.4k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (224:17): [True: 23.3k, False: 34] ------------------ 225| 23.3k| r[1 * M + i] += P3[i] - P1[i] - P2[i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 226| 23.3k| } 227| | 228| 34| k2x2_interpolate(P1, a + 2 * 9 * 2 * K); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 229| 34| k2x2_interpolate(P2, a + 3 * 9 * 2 * K); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 230| 34| k2x2_interpolate(P3, a + 7 * 9 * 2 * K); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 231| 23.4k| for (i = 0; i < 2 * M; i++) { ------------------ | | 7| 23.4k|#define M (L/4) | | ------------------ | | | | 6| 23.4k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.4k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (231:17): [True: 23.3k, False: 34] ------------------ 232| 23.3k| r[4 * M + i] = P1[i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 233| 23.3k| r[6 * M + i] = P2[i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 234| 23.3k| } 235| | 236| 23.4k| for (i = 0; i < 2 * M; i++) { ------------------ | | 7| 23.4k|#define M (L/4) | | ------------------ | | | | 6| 23.4k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.4k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (236:17): [True: 23.3k, False: 34] ------------------ 237| 23.3k| r[5 * M + i] += P3[i] - P1[i] - P2[i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 238| 23.3k| } 239| | 240| 34| k2x2_interpolate(P1, a + 6 * 9 * 2 * K); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 241| 34| k2x2_interpolate(P2, a + 5 * 9 * 2 * K); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 242| 34| k2x2_interpolate(P3, a + 8 * 9 * 2 * K); ------------------ | | 8| 34|#define K (L/16) | | ------------------ | | | | 6| 34|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 34|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 243| 23.4k| for (i = 0; i < 2 * M; i++) { ------------------ | | 7| 23.4k|#define M (L/4) | | ------------------ | | | | 6| 23.4k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.4k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (243:17): [True: 23.3k, False: 34] ------------------ 244| 23.3k| tmp[0 * M + i] = P1[i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 245| 23.3k| tmp[2 * M + i] = P2[i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 246| 23.3k| } 247| | 248| 23.4k| for (i = 0; i < 2 * M; i++) { ------------------ | | 7| 23.4k|#define M (L/4) | | ------------------ | | | | 6| 23.4k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.4k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (248:17): [True: 23.3k, False: 34] ------------------ 249| 23.3k| tmp[1 * M + i] += P3[i] - P1[i] - P2[i]; ------------------ | | 7| 23.3k|#define M (L/4) | | ------------------ | | | | 6| 23.3k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 23.3k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 250| 23.3k| } 251| | 252| 46.8k| for (i = 0; i < 4 * M; i++) { ------------------ | | 7| 46.8k|#define M (L/4) | | ------------------ | | | | 6| 46.8k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 46.8k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (252:17): [True: 46.7k, False: 34] ------------------ 253| 46.7k| tmp[0 * M + i] = tmp[0 * M + i] - r[0 * M + i] - r[4 * M + i]; ------------------ | | 7| 46.7k|#define M (L/4) | | ------------------ | | | | 6| 46.7k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 46.7k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[0 * M + i] = tmp[0 * M + i] - r[0 * M + i] - r[4 * M + i]; ------------------ | | 7| 46.7k|#define M (L/4) | | ------------------ | | | | 6| 46.7k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 46.7k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[0 * M + i] = tmp[0 * M + i] - r[0 * M + i] - r[4 * M + i]; ------------------ | | 7| 46.7k|#define M (L/4) | | ------------------ | | | | 6| 46.7k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 46.7k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ tmp[0 * M + i] = tmp[0 * M + i] - r[0 * M + i] - r[4 * M + i]; ------------------ | | 7| 46.7k|#define M (L/4) | | ------------------ | | | | 6| 46.7k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 46.7k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 254| 46.7k| } 255| | 256| 46.8k| for (i = 0; i < 4 * M; i++) { ------------------ | | 7| 46.8k|#define M (L/4) | | ------------------ | | | | 6| 46.8k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 46.8k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ | Branch (256:17): [True: 46.7k, False: 34] ------------------ 257| 46.7k| r[2 * M + i] += tmp[0 * M + i]; ------------------ | | 7| 46.7k|#define M (L/4) | | ------------------ | | | | 6| 46.7k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 46.7k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ r[2 * M + i] += tmp[0 * M + i]; ------------------ | | 7| 46.7k|#define M (L/4) | | ------------------ | | | | 6| 46.7k|#define L PAD32(NTRU_N) | | | | ------------------ | | | | | | 11| 46.7k|#define PAD32(X) ((((X) + 31)/32)*32) | | | | ------------------ | | ------------------ ------------------ 258| 46.7k| } 259| 34|} PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_inv: 18| 2|void PQCLEAN_NTRUHRSS1373_CLEAN_poly_S3_inv(poly *r, const poly *a) { 19| 2| poly f, g, v, w; 20| 2| size_t i, loop; 21| 2| int16_t delta, sign, swap, t; 22| | 23| 2.74k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (23:17): [True: 2.74k, False: 2] ------------------ 24| 2.74k| v.coeffs[i] = 0; 25| 2.74k| } 26| 2.74k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (26:17): [True: 2.74k, False: 2] ------------------ 27| 2.74k| w.coeffs[i] = 0; 28| 2.74k| } 29| 2| w.coeffs[0] = 1; 30| | 31| 2.74k| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (31:17): [True: 2.74k, False: 2] ------------------ 32| 2.74k| f.coeffs[i] = 1; 33| 2.74k| } 34| 2.74k| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (34:17): [True: 2.74k, False: 2] ------------------ 35| 2.74k| g.coeffs[NTRU_N - 2 - i] = mod3((a->coeffs[i] & 3) + 2 * (a->coeffs[NTRU_N - 1] & 3)); ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ g.coeffs[NTRU_N - 2 - i] = mod3((a->coeffs[i] & 3) + 2 * (a->coeffs[NTRU_N - 1] & 3)); ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ 36| 2.74k| } 37| 2| g.coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 2|#define NTRU_N 1373 ------------------ 38| | 39| 2| delta = 1; 40| | 41| 5.48k| for (loop = 0; loop < 2 * (NTRU_N - 1) - 1; ++loop) { ------------------ | | 5| 5.48k|#define NTRU_N 1373 ------------------ | Branch (41:20): [True: 5.48k, False: 2] ------------------ 42| 7.53M| for (i = NTRU_N - 1; i > 0; --i) { ------------------ | | 5| 5.48k|#define NTRU_N 1373 ------------------ | Branch (42:30): [True: 7.52M, False: 5.48k] ------------------ 43| 7.52M| v.coeffs[i] = v.coeffs[i - 1]; 44| 7.52M| } 45| 5.48k| v.coeffs[0] = 0; 46| | 47| 5.48k| sign = mod3((uint8_t) (2 * g.coeffs[0] * f.coeffs[0])); 48| 5.48k| swap = both_negative_mask(-delta, -(int16_t) g.coeffs[0]); 49| 5.48k| delta ^= swap & (delta ^ -delta); 50| 5.48k| delta += 1; 51| | 52| 7.53M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 7.53M|#define NTRU_N 1373 ------------------ | Branch (52:21): [True: 7.53M, False: 5.48k] ------------------ 53| 7.53M| t = swap & (f.coeffs[i] ^ g.coeffs[i]); 54| 7.53M| f.coeffs[i] ^= t; 55| 7.53M| g.coeffs[i] ^= t; 56| 7.53M| t = swap & (v.coeffs[i] ^ w.coeffs[i]); 57| 7.53M| v.coeffs[i] ^= t; 58| 7.53M| w.coeffs[i] ^= t; 59| 7.53M| } 60| | 61| 7.53M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 7.53M|#define NTRU_N 1373 ------------------ | Branch (61:21): [True: 7.53M, False: 5.48k] ------------------ 62| 7.53M| g.coeffs[i] = mod3((uint8_t) (g.coeffs[i] + sign * f.coeffs[i])); 63| 7.53M| } 64| 7.53M| for (i = 0; i < NTRU_N; ++i) { ------------------ | | 5| 7.53M|#define NTRU_N 1373 ------------------ | Branch (64:21): [True: 7.53M, False: 5.48k] ------------------ 65| 7.53M| w.coeffs[i] = mod3((uint8_t) (w.coeffs[i] + sign * v.coeffs[i])); 66| 7.53M| } 67| 7.53M| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 7.53M|#define NTRU_N 1373 ------------------ | Branch (67:21): [True: 7.52M, False: 5.48k] ------------------ 68| 7.52M| g.coeffs[i] = g.coeffs[i + 1]; 69| 7.52M| } 70| 5.48k| g.coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 5.48k|#define NTRU_N 1373 ------------------ 71| 5.48k| } 72| | 73| 2| sign = f.coeffs[0]; 74| 2.74k| for (i = 0; i < NTRU_N - 1; ++i) { ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ | Branch (74:17): [True: 2.74k, False: 2] ------------------ 75| 2.74k| r->coeffs[i] = mod3((uint8_t) (sign * v.coeffs[NTRU_N - 2 - i])); ------------------ | | 5| 2.74k|#define NTRU_N 1373 ------------------ 76| 2.74k| } 77| 2| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 2|#define NTRU_N 1373 ------------------ 78| 2|} PQCLEAN_NTRUHRSS1373_CLEAN_sample_fg: 3| 2|void PQCLEAN_NTRUHRSS1373_CLEAN_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]) { 4| 2| PQCLEAN_NTRUHRSS1373_CLEAN_sample_iid_plus(f, uniformbytes); 5| 2| PQCLEAN_NTRUHRSS1373_CLEAN_sample_iid_plus(g, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 19| 2|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 2|#define NTRU_N 1373 | | ------------------ ------------------ 6| | 7| 2|} PQCLEAN_NTRUHRSS1373_CLEAN_sample_rm: 9| 2|void PQCLEAN_NTRUHRSS1373_CLEAN_sample_rm(poly *r, poly *m, const unsigned char uniformbytes[NTRU_SAMPLE_RM_BYTES]) { 10| 2| PQCLEAN_NTRUHRSS1373_CLEAN_sample_iid(r, uniformbytes); 11| 2| PQCLEAN_NTRUHRSS1373_CLEAN_sample_iid(m, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 19| 2|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 2|#define NTRU_N 1373 | | ------------------ ------------------ 12| | 13| 2|} PQCLEAN_NTRUHRSS1373_CLEAN_sample_iid_plus: 15| 4|void PQCLEAN_NTRUHRSS1373_CLEAN_sample_iid_plus(poly *r, const unsigned char uniformbytes[NTRU_SAMPLE_IID_BYTES]) { 16| | /* Sample r using PQCLEAN_NTRUHRSS1373_CLEAN_sample_iid then conditionally flip */ 17| | /* signs of even index coefficients so that >= 0. */ 18| | 19| 4| int i; 20| 4| uint16_t s = 0; 21| | 22| 4| PQCLEAN_NTRUHRSS1373_CLEAN_sample_iid(r, uniformbytes); 23| | 24| | /* Map {0,1,2} -> {0, 1, 2^16 - 1} */ 25| 5.49k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 5.49k|#define NTRU_N 1373 ------------------ | Branch (25:17): [True: 5.48k, False: 4] ------------------ 26| 5.48k| r->coeffs[i] = r->coeffs[i] | (-(r->coeffs[i] >> 1)); 27| 5.48k| } 28| | 29| | /* s = . (r[n-1] = 0) */ 30| 5.49k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 5.49k|#define NTRU_N 1373 ------------------ | Branch (30:17): [True: 5.48k, False: 4] ------------------ 31| 5.48k| s += (uint16_t)((uint32_t)r->coeffs[i + 1] * (uint32_t)r->coeffs[i]); 32| 5.48k| } 33| | 34| | /* Extract sign of s (sign(0) = 1) */ 35| 4| s = 1 | (-(s >> 15)); 36| | 37| 2.75k| for (i = 0; i < NTRU_N; i += 2) { ------------------ | | 5| 2.75k|#define NTRU_N 1373 ------------------ | Branch (37:17): [True: 2.74k, False: 4] ------------------ 38| 2.74k| r->coeffs[i] = (uint16_t)((uint32_t)s * (uint32_t)r->coeffs[i]); 39| 2.74k| } 40| | 41| | /* Map {0,1,2^16-1} -> {0, 1, 2} */ 42| 5.49k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 5.49k|#define NTRU_N 1373 ------------------ | Branch (42:17): [True: 5.49k, False: 4] ------------------ 43| 5.49k| r->coeffs[i] = 3 & (r->coeffs[i] ^ (r->coeffs[i] >> 15)); 44| 5.49k| } 45| 4|} PQCLEAN_NTRUHRSS1373_CLEAN_sample_iid: 18| 8|void PQCLEAN_NTRUHRSS1373_CLEAN_sample_iid(poly *r, const unsigned char uniformbytes[NTRU_SAMPLE_IID_BYTES]) { 19| 8| int i; 20| | /* {0,1,...,255} -> {0,1,2}; Pr[0] = 86/256, Pr[1] = Pr[-1] = 85/256 */ 21| 10.9k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 10.9k|#define NTRU_N 1373 ------------------ | Branch (21:17): [True: 10.9k, False: 8] ------------------ 22| 10.9k| r->coeffs[i] = mod3(uniformbytes[i]); 23| 10.9k| } 24| | 25| 8| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 8|#define NTRU_N 1373 ------------------ 26| 8|} PQCLEAN_NTRUHRSS701_AVX2_cmov: 4| 9|void PQCLEAN_NTRUHRSS701_AVX2_cmov(unsigned char *r, const unsigned char *x, size_t len, unsigned char b) { 5| 9| size_t i; 6| | 7| 9| b = (~b + 1); 8| 297| for (i = 0; i < len; i++) { ------------------ | Branch (8:17): [True: 288, False: 9] ------------------ 9| 288| r[i] ^= b & (x[i] ^ r[i]); 10| 288| } 11| 9|} PQCLEAN_NTRUHRSS701_AVX2_crypto_kem_keypair: 10| 9|int PQCLEAN_NTRUHRSS701_AVX2_crypto_kem_keypair(uint8_t *pk, uint8_t *sk) { 11| 9| uint8_t seed[NTRU_SAMPLE_FG_BYTES]; 12| | 13| 9| randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 8| 9|#define randombytes OQS_randombytes ------------------ randombytes(seed, NTRU_SAMPLE_FG_BYTES); ------------------ | | 20| 9|#define NTRU_SAMPLE_FG_BYTES (2*NTRU_SAMPLE_IID_BYTES) | | ------------------ | | | | 19| 9|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 9|#define NTRU_N 701 | | | | ------------------ | | ------------------ ------------------ 14| 9| PQCLEAN_NTRUHRSS701_AVX2_owcpa_keypair(pk, sk, seed); 15| | 16| 9| randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 8| 9|#define randombytes OQS_randombytes ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 28| 9|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 24| 9|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 23| 9|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 9|#define NTRU_N 701 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 27| 9|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 9|#define NTRU_LOGQ 13 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 23| 9|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 9|#define NTRU_N 701 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ randombytes(sk + NTRU_OWCPA_SECRETKEYBYTES, NTRU_PRFKEYBYTES); ------------------ | | 16| 9|#define NTRU_PRFKEYBYTES 32 ------------------ 17| | 18| 9| return 0; 19| 9|} PQCLEAN_NTRUHRSS701_AVX2_crypto_kem_enc: 21| 9|int PQCLEAN_NTRUHRSS701_AVX2_crypto_kem_enc(uint8_t *c, uint8_t *k, const uint8_t *pk) { 22| 9| poly r, m; 23| 9| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 24| 9| uint8_t rm_seed[NTRU_SAMPLE_RM_BYTES]; 25| | 26| 9| randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 8| 9|#define randombytes OQS_randombytes ------------------ randombytes(rm_seed, NTRU_SAMPLE_RM_BYTES); ------------------ | | 21| 9|#define NTRU_SAMPLE_RM_BYTES (2*NTRU_SAMPLE_IID_BYTES) | | ------------------ | | | | 19| 9|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | | | ------------------ | | | | | | 5| 9|#define NTRU_N 701 | | | | ------------------ | | ------------------ ------------------ 27| | 28| 9| PQCLEAN_NTRUHRSS701_AVX2_sample_rm(&r, &m, rm_seed); 29| | 30| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_S3_tobytes(rm, &r); 31| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, &m); ------------------ | | 24| 9|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 9|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 9|#define NTRU_N 701 | | | | ------------------ | | ------------------ ------------------ 32| 9| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 9|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 26| 9|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 24| 9|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 23| 9|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 9|#define NTRU_N 701 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 33| | 34| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_Z3_to_Zq(&r); 35| 9| PQCLEAN_NTRUHRSS701_AVX2_owcpa_enc(c, &r, &m, pk); 36| | 37| 9| return 0; 38| 9|} PQCLEAN_NTRUHRSS701_AVX2_crypto_kem_dec: 40| 9|int PQCLEAN_NTRUHRSS701_AVX2_crypto_kem_dec(uint8_t *k, const uint8_t *c, const uint8_t *sk) { 41| 9| int i, fail; 42| 9| uint8_t rm[NTRU_OWCPA_MSGBYTES]; 43| 9| uint8_t buf[NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES]; 44| | 45| 9| fail = PQCLEAN_NTRUHRSS701_AVX2_owcpa_dec(rm, c, sk); 46| | /* If fail = 0 then c = Enc(h, rm). There is no need to re-encapsulate. */ 47| | /* See comment in PQCLEAN_NTRUHRSS701_AVX2_owcpa_dec for details. */ 48| | 49| 9| sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 15| 9|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(k, rm, NTRU_OWCPA_MSGBYTES); ------------------ | | 26| 9|#define NTRU_OWCPA_MSGBYTES (2*NTRU_PACK_TRINARY_BYTES) | | ------------------ | | | | 24| 9|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 23| 9|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 9|#define NTRU_N 701 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 50| | 51| | /* shake(secret PRF key || input ciphertext) */ 52| 297| for (i = 0; i < NTRU_PRFKEYBYTES; i++) { ------------------ | | 16| 297|#define NTRU_PRFKEYBYTES 32 ------------------ | Branch (52:17): [True: 288, False: 9] ------------------ 53| 288| buf[i] = sk[i + NTRU_OWCPA_SECRETKEYBYTES]; ------------------ | | 28| 288|#define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 24| 288|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | | | ------------------ | | | | | | 23| 288|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 288|#define NTRU_N 701 | | | | | | ------------------ | | | | ------------------ | | ------------------ | | #define NTRU_OWCPA_SECRETKEYBYTES (2*NTRU_PACK_TRINARY_BYTES + NTRU_OWCPA_PUBLICKEYBYTES) | | ------------------ | | | | 27| 288|#define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 288|#define NTRU_LOGQ 13 | | | | ------------------ | | | | #define NTRU_OWCPA_PUBLICKEYBYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 23| 288|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 288|#define NTRU_N 701 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 54| 288| } 55| 10.2k| for (i = 0; i < NTRU_CIPHERTEXTBYTES; i++) { ------------------ | | 33| 10.2k|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 29| 10.2k|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 10.2k|#define NTRU_LOGQ 13 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 23| 10.2k|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 10.2k|#define NTRU_N 701 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ | Branch (55:17): [True: 10.2k, False: 9] ------------------ 56| 10.2k| buf[NTRU_PRFKEYBYTES + i] = c[i]; ------------------ | | 16| 10.2k|#define NTRU_PRFKEYBYTES 32 ------------------ 57| 10.2k| } 58| 9| sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 15| 9|#define sha3_256 OQS_SHA3_sha3_256 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 16| 9|#define NTRU_PRFKEYBYTES 32 ------------------ sha3_256(rm, buf, NTRU_PRFKEYBYTES + NTRU_CIPHERTEXTBYTES); ------------------ | | 33| 9|#define NTRU_CIPHERTEXTBYTES (NTRU_OWCPA_BYTES) | | ------------------ | | | | 29| 9|#define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 6| 9|#define NTRU_LOGQ 13 | | | | ------------------ | | | | #define NTRU_OWCPA_BYTES ((NTRU_LOGQ*NTRU_PACK_DEG+7)/8) | | | | ------------------ | | | | | | 23| 9|#define NTRU_PACK_DEG (NTRU_N-1) | | | | | | ------------------ | | | | | | | | 5| 9|#define NTRU_N 701 | | | | | | ------------------ | | | | ------------------ | | ------------------ ------------------ 59| | 60| 9| PQCLEAN_NTRUHRSS701_AVX2_cmov(k, rm, NTRU_SHAREDKEYBYTES, (unsigned char) fail); ------------------ | | 17| 9|#define NTRU_SHAREDKEYBYTES 32 ------------------ 61| | 62| 9| return 0; 63| 9|} PQCLEAN_NTRUHRSS701_AVX2_owcpa_keypair: 41| 9| const unsigned char seed[NTRU_SAMPLE_FG_BYTES]) { 42| 9| int i; 43| | 44| 9| poly x1, x2, x3, x4, x5; 45| | 46| 9| poly *f = &x1, *g = &x2, *invf_mod3 = &x3; 47| 9| poly *gf = &x3, *invgf = &x4, *tmp = &x5; 48| 9| poly *invh = &x3, *h = &x3; 49| | 50| 9| PQCLEAN_NTRUHRSS701_AVX2_sample_fg(f, g, seed); 51| | 52| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_S3_inv(invf_mod3, f); 53| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_S3_tobytes(sk, f); 54| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_S3_tobytes(sk + NTRU_PACK_TRINARY_BYTES, invf_mod3); ------------------ | | 24| 9|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 9|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 9|#define NTRU_N 701 | | | | ------------------ | | ------------------ ------------------ 55| | 56| | /* Lift coeffs of f and g from Z_p to Z_q */ 57| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_Z3_to_Zq(f); 58| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_Z3_to_Zq(g); 59| | 60| | /* g = 3*(x-1)*g */ 61| 6.30k| for (i = NTRU_N - 1; i > 0; i--) { ------------------ | | 5| 9|#define NTRU_N 701 ------------------ | Branch (61:26): [True: 6.30k, False: 9] ------------------ 62| 6.30k| g->coeffs[i] = 3 * (g->coeffs[i - 1] - g->coeffs[i]); 63| 6.30k| } 64| 9| g->coeffs[0] = -(3 * g->coeffs[0]); 65| | 66| | 67| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(gf, g, f); 68| | 69| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_inv(invgf, gf); 70| | 71| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(tmp, invgf, f); 72| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_mul(invh, tmp, f); 73| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_tobytes(sk + 2 * NTRU_PACK_TRINARY_BYTES, invh); ------------------ | | 24| 9|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 9|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 9|#define NTRU_N 701 | | | | ------------------ | | ------------------ ------------------ 74| | 75| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(tmp, invgf, g); 76| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(h, tmp, g); 77| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_sum_zero_tobytes(pk, h); 78| 9|} PQCLEAN_NTRUHRSS701_AVX2_owcpa_enc: 84| 9| const unsigned char *pk) { 85| 9| int i; 86| 9| poly x1, x2; 87| 9| poly *h = &x1, *liftm = &x1; 88| 9| poly *ct = &x2; 89| | 90| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_sum_zero_frombytes(h, pk); 91| | 92| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(ct, r, h); 93| | 94| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_lift(liftm, m); 95| 6.31k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 6.31k|#define NTRU_N 701 ------------------ | Branch (95:17): [True: 6.30k, False: 9] ------------------ 96| 6.30k| ct->coeffs[i] = ct->coeffs[i] + liftm->coeffs[i]; 97| 6.30k| } 98| | 99| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_sum_zero_tobytes(c, ct); 100| 9|} PQCLEAN_NTRUHRSS701_AVX2_owcpa_dec: 104| 9| const unsigned char *secretkey) { 105| 9| int i; 106| 9| int fail; 107| 9| poly x1, x2, x3, x4; 108| | 109| 9| poly *c = &x1, *f = &x2, *cf = &x3; 110| 9| poly *mf = &x2, *finv3 = &x3, *m = &x4; 111| 9| poly *liftm = &x2, *invh = &x3, *r = &x4; 112| 9| poly *b = &x1; 113| | 114| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_sum_zero_frombytes(c, ciphertext); 115| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_S3_frombytes(f, secretkey); 116| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_Z3_to_Zq(f); 117| | 118| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(cf, c, f); 119| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_to_S3(mf, cf); 120| | 121| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_S3_frombytes(finv3, secretkey + NTRU_PACK_TRINARY_BYTES); ------------------ | | 24| 9|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 9|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 9|#define NTRU_N 701 | | | | ------------------ | | ------------------ ------------------ 122| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_S3_mul(m, mf, finv3); 123| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_S3_tobytes(rm + NTRU_PACK_TRINARY_BYTES, m); ------------------ | | 24| 9|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 9|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 9|#define NTRU_N 701 | | | | ------------------ | | ------------------ ------------------ 124| | 125| 9| fail = 0; 126| | 127| | /* Check that the unused bits of the last byte of the ciphertext are zero */ 128| 9| fail |= owcpa_check_ciphertext(ciphertext); 129| | 130| | /* For the IND-CCA2 KEM we must ensure that c = Enc(h, (r,m)). */ 131| | /* We can avoid re-computing r*h + Lift(m) as long as we check that */ 132| | /* r (defined as b/h mod (q, Phi_n)) and m are in the message space. */ 133| | /* (m can take any value in S3 in NTRU_HRSS) */ 134| | 135| | /* b = c - Lift(m) mod (q, x^n - 1) */ 136| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_lift(liftm, m); 137| 6.31k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 6.31k|#define NTRU_N 701 ------------------ | Branch (137:17): [True: 6.30k, False: 9] ------------------ 138| 6.30k| b->coeffs[i] = c->coeffs[i] - liftm->coeffs[i]; 139| 6.30k| } 140| | 141| | /* r = b / h mod (q, Phi_n) */ 142| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_frombytes(invh, secretkey + 2 * NTRU_PACK_TRINARY_BYTES); ------------------ | | 24| 9|#define NTRU_PACK_TRINARY_BYTES ((NTRU_PACK_DEG+4)/5) | | ------------------ | | | | 23| 9|#define NTRU_PACK_DEG (NTRU_N-1) | | | | ------------------ | | | | | | 5| 9|#define NTRU_N 701 | | | | ------------------ | | ------------------ ------------------ 143| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_mul(r, b, invh); 144| | 145| | /* NOTE: Our definition of r as b/h mod (q, Phi_n) follows Figure 4 of */ 146| | /* [Sch18] https://eprint.iacr.org/2018/1174/20181203:032458. */ 147| | /* This differs from Figure 10 of Saito--Xagawa--Yamakawa */ 148| | /* [SXY17] https://eprint.iacr.org/2017/1005/20180516:055500 */ 149| | /* where r gets a final reduction modulo p. */ 150| | /* We need this change to use Proposition 1 of [Sch18]. */ 151| | 152| | /* Proposition 1 of [Sch18] shows that re-encryption with (r,m) yields c. */ 153| | /* if and only if fail==0 after the following call to owcpa_check_r */ 154| | /* The procedure given in Fig. 8 of [Sch18] can be skipped because we have */ 155| | /* c(1) = 0 due to the use of poly_Rq_sum_zero_{to,from}bytes. */ 156| 9| fail |= owcpa_check_r(r); 157| | 158| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_trinary_Zq_to_Z3(r); 159| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_S3_tobytes(rm, r); 160| | 161| 9| return fail; 162| 9|} PQCLEAN_NTRUHRSS701_AVX2_poly_S3_tobytes: 3| 54|void PQCLEAN_NTRUHRSS701_AVX2_poly_S3_tobytes(unsigned char msg[NTRU_PACK_TRINARY_BYTES], const poly *a) { 4| 54| int i; 5| 54| unsigned char c; 6| | 7| 7.61k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 23| 7.61k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 7.61k|#define NTRU_N 701 | | ------------------ ------------------ | Branch (7:17): [True: 7.56k, False: 54] ------------------ 8| 7.56k| c = a->coeffs[5 * i + 4] & 255; 9| 7.56k| c = (3 * c + a->coeffs[5 * i + 3]) & 255; 10| 7.56k| c = (3 * c + a->coeffs[5 * i + 2]) & 255; 11| 7.56k| c = (3 * c + a->coeffs[5 * i + 1]) & 255; 12| 7.56k| c = (3 * c + a->coeffs[5 * i + 0]) & 255; 13| 7.56k| msg[i] = c; 14| 7.56k| } 15| 54|} PQCLEAN_NTRUHRSS701_AVX2_poly_S3_frombytes: 17| 18|void PQCLEAN_NTRUHRSS701_AVX2_poly_S3_frombytes(poly *r, const unsigned char msg[NTRU_PACK_TRINARY_BYTES]) { 18| 18| int i; 19| 18| unsigned char c; 20| | 21| 2.53k| for (i = 0; i < NTRU_PACK_DEG / 5; i++) { ------------------ | | 23| 2.53k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 2.53k|#define NTRU_N 701 | | ------------------ ------------------ | Branch (21:17): [True: 2.52k, False: 18] ------------------ 22| 2.52k| c = msg[i]; 23| 2.52k| r->coeffs[5 * i + 0] = c; 24| 2.52k| r->coeffs[5 * i + 1] = c * 171 >> 9; // this is division by 3 25| 2.52k| r->coeffs[5 * i + 2] = c * 57 >> 9; // division by 3^2 26| 2.52k| r->coeffs[5 * i + 3] = c * 19 >> 9; // division by 3^3 27| 2.52k| r->coeffs[5 * i + 4] = c * 203 >> 14; // etc. 28| 2.52k| } 29| 18| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 18|#define NTRU_N 701 ------------------ 30| 18| PQCLEAN_NTRUHRSS701_AVX2_poly_mod_3_Phi_n(r); 31| 18|} PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_tobytes: 4| 27|void PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_tobytes(unsigned char *r, const poly *a) { 5| 27| int i, j; 6| 27| uint16_t t[8]; 7| | 8| 2.37k| for (i = 0; i < NTRU_PACK_DEG / 8; i++) { ------------------ | | 23| 2.37k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 2.37k|#define NTRU_N 701 | | ------------------ ------------------ | Branch (8:17): [True: 2.34k, False: 27] ------------------ 9| 21.1k| for (j = 0; j < 8; j++) { ------------------ | Branch (9:21): [True: 18.7k, False: 2.34k] ------------------ 10| 18.7k| t[j] = MODQ(a->coeffs[8 * i + j]); ------------------ | | 9| 18.7k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 18.7k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 18.7k|#define NTRU_LOGQ 13 | | | | ------------------ | | ------------------ ------------------ 11| 18.7k| } 12| | 13| 2.34k| r[13 * i + 0] = (unsigned char) ( t[0] & 0xff); 14| 2.34k| r[13 * i + 1] = (unsigned char) ((t[0] >> 8) | ((t[1] & 0x07) << 5)); 15| 2.34k| r[13 * i + 2] = (unsigned char) ((t[1] >> 3) & 0xff); 16| 2.34k| r[13 * i + 3] = (unsigned char) ((t[1] >> 11) | ((t[2] & 0x3f) << 2)); 17| 2.34k| r[13 * i + 4] = (unsigned char) ((t[2] >> 6) | ((t[3] & 0x01) << 7)); 18| 2.34k| r[13 * i + 5] = (unsigned char) ((t[3] >> 1) & 0xff); 19| 2.34k| r[13 * i + 6] = (unsigned char) ((t[3] >> 9) | ((t[4] & 0x0f) << 4)); 20| 2.34k| r[13 * i + 7] = (unsigned char) ((t[4] >> 4) & 0xff); 21| 2.34k| r[13 * i + 8] = (unsigned char) ((t[4] >> 12) | ((t[5] & 0x7f) << 1)); 22| 2.34k| r[13 * i + 9] = (unsigned char) ((t[5] >> 7) | ((t[6] & 0x03) << 6)); 23| 2.34k| r[13 * i + 10] = (unsigned char) ((t[6] >> 2) & 0xff); 24| 2.34k| r[13 * i + 11] = (unsigned char) ((t[6] >> 10) | ((t[7] & 0x1f) << 3)); 25| 2.34k| r[13 * i + 12] = (unsigned char) ((t[7] >> 5)); 26| 2.34k| } 27| | 28| 135| for (j = 0; j < NTRU_PACK_DEG - 8 * i; j++) { ------------------ | | 23| 135|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 135|#define NTRU_N 701 | | ------------------ ------------------ | Branch (28:17): [True: 108, False: 27] ------------------ 29| 108| t[j] = MODQ(a->coeffs[8 * i + j]); ------------------ | | 9| 108|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 108|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 108|#define NTRU_LOGQ 13 | | | | ------------------ | | ------------------ ------------------ 30| 108| } 31| 135| for (; j < 8; j++) { ------------------ | Branch (31:12): [True: 108, False: 27] ------------------ 32| 108| t[j] = 0; 33| 108| } 34| | 35| 27| switch (NTRU_PACK_DEG - 8 * (NTRU_PACK_DEG / 8)) { ------------------ | | 23| 27|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 27|#define NTRU_N 701 | | ------------------ ------------------ switch (NTRU_PACK_DEG - 8 * (NTRU_PACK_DEG / 8)) { ------------------ | | 23| 27|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 27|#define NTRU_N 701 | | ------------------ ------------------ | Branch (35:13): [True: 27, Folded] ------------------ 36| | // cases 0 and 6 are impossible since 2 generates (Z/n)* and 37| | // p mod 8 in {1, 7} implies that 2 is a quadratic residue. 38| 27| case 4: ------------------ | Branch (38:5): [True: 27, False: 0] ------------------ 39| 27| r[13 * i + 0] = (unsigned char) ( t[0] & 0xff); 40| 27| r[13 * i + 1] = (unsigned char) (t[0] >> 8) | ((t[1] & 0x07) << 5); 41| 27| r[13 * i + 2] = (unsigned char) (t[1] >> 3) & 0xff; 42| 27| r[13 * i + 3] = (unsigned char) (t[1] >> 11) | ((t[2] & 0x3f) << 2); 43| 27| r[13 * i + 4] = (unsigned char) (t[2] >> 6) | ((t[3] & 0x01) << 7); 44| 27| r[13 * i + 5] = (unsigned char) (t[3] >> 1) & 0xff; 45| 27| r[13 * i + 6] = (unsigned char) (t[3] >> 9) | ((t[4] & 0x0f) << 4); 46| 27| break; 47| 0| case 2: ------------------ | Branch (47:5): [True: 0, False: 27] ------------------ 48| 0| r[13 * i + 0] = (unsigned char) ( t[0] & 0xff); 49| 0| r[13 * i + 1] = (unsigned char) (t[0] >> 8) | ((t[1] & 0x07) << 5); 50| 0| r[13 * i + 2] = (unsigned char) (t[1] >> 3) & 0xff; 51| 0| r[13 * i + 3] = (unsigned char) (t[1] >> 11) | ((t[2] & 0x3f) << 2); 52| 0| break; 53| 27| } 54| 27|} PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_frombytes: 56| 27|void PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_frombytes(poly *r, const unsigned char *a) { 57| 27| int i; 58| 2.37k| for (i = 0; i < NTRU_PACK_DEG / 8; i++) { ------------------ | | 23| 2.37k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 2.37k|#define NTRU_N 701 | | ------------------ ------------------ | Branch (58:17): [True: 2.34k, False: 27] ------------------ 59| 2.34k| r->coeffs[8 * i + 0] = a[13 * i + 0] | (((uint16_t)a[13 * i + 1] & 0x1f) << 8); 60| 2.34k| r->coeffs[8 * i + 1] = (a[13 * i + 1] >> 5) | (((uint16_t)a[13 * i + 2] ) << 3) | (((uint16_t)a[13 * i + 3] & 0x03) << 11); 61| 2.34k| r->coeffs[8 * i + 2] = (a[13 * i + 3] >> 2) | (((uint16_t)a[13 * i + 4] & 0x7f) << 6); 62| 2.34k| r->coeffs[8 * i + 3] = (a[13 * i + 4] >> 7) | (((uint16_t)a[13 * i + 5] ) << 1) | (((uint16_t)a[13 * i + 6] & 0x0f) << 9); 63| 2.34k| r->coeffs[8 * i + 4] = (a[13 * i + 6] >> 4) | (((uint16_t)a[13 * i + 7] ) << 4) | (((uint16_t)a[13 * i + 8] & 0x01) << 12); 64| 2.34k| r->coeffs[8 * i + 5] = (a[13 * i + 8] >> 1) | (((uint16_t)a[13 * i + 9] & 0x3f) << 7); 65| 2.34k| r->coeffs[8 * i + 6] = (a[13 * i + 9] >> 6) | (((uint16_t)a[13 * i + 10] ) << 2) | (((uint16_t)a[13 * i + 11] & 0x07) << 10); 66| 2.34k| r->coeffs[8 * i + 7] = (a[13 * i + 11] >> 3) | (((uint16_t)a[13 * i + 12] ) << 5); 67| 2.34k| } 68| 27| switch (NTRU_PACK_DEG & 0x07) { ------------------ | | 23| 27|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 27|#define NTRU_N 701 | | ------------------ ------------------ | Branch (68:13): [True: 27, Folded] ------------------ 69| | // cases 0 and 6 are impossible since 2 generates (Z/n)* and 70| | // p mod 8 in {1, 7} implies that 2 is a quadratic residue. 71| 27| case 4: ------------------ | Branch (71:5): [True: 27, False: 0] ------------------ 72| 27| r->coeffs[8 * i + 0] = a[13 * i + 0] | (((uint16_t)a[13 * i + 1] & 0x1f) << 8); 73| 27| r->coeffs[8 * i + 1] = (a[13 * i + 1] >> 5) | (((uint16_t)a[13 * i + 2] ) << 3) | (((uint16_t)a[13 * i + 3] & 0x03) << 11); 74| 27| r->coeffs[8 * i + 2] = (a[13 * i + 3] >> 2) | (((uint16_t)a[13 * i + 4] & 0x7f) << 6); 75| 27| r->coeffs[8 * i + 3] = (a[13 * i + 4] >> 7) | (((uint16_t)a[13 * i + 5] ) << 1) | (((uint16_t)a[13 * i + 6] & 0x0f) << 9); 76| 27| break; 77| 0| case 2: ------------------ | Branch (77:5): [True: 0, False: 27] ------------------ 78| 0| r->coeffs[8 * i + 0] = a[13 * i + 0] | (((uint16_t)a[13 * i + 1] & 0x1f) << 8); 79| 0| r->coeffs[8 * i + 1] = (a[13 * i + 1] >> 5) | (((uint16_t)a[13 * i + 2] ) << 3) | (((uint16_t)a[13 * i + 3] & 0x03) << 11); 80| 0| break; 81| 27| } 82| 27| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 27|#define NTRU_N 701 ------------------ 83| 27|} PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_sum_zero_tobytes: 85| 18|void PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_sum_zero_tobytes(unsigned char *r, const poly *a) { 86| 18| PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_tobytes(r, a); 87| 18|} PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_sum_zero_frombytes: 89| 18|void PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_sum_zero_frombytes(poly *r, const unsigned char *a) { 90| 18| int i; 91| 18| PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_frombytes(r, a); 92| | 93| | /* Set r[n-1] so that the sum of coefficients is zero mod q */ 94| 18| r->coeffs[NTRU_N - 1] = 0; ------------------ | | 5| 18|#define NTRU_N 701 ------------------ 95| 12.6k| for (i = 0; i < NTRU_PACK_DEG; i++) { ------------------ | | 23| 12.6k|#define NTRU_PACK_DEG (NTRU_N-1) | | ------------------ | | | | 5| 12.6k|#define NTRU_N 701 | | ------------------ ------------------ | Branch (95:17): [True: 12.6k, False: 18] ------------------ 96| 12.6k| r->coeffs[NTRU_N - 1] -= r->coeffs[i]; ------------------ | | 5| 12.6k|#define NTRU_N 701 ------------------ 97| 12.6k| } 98| 18|} PQCLEAN_NTRUHRSS701_AVX2_poly_Z3_to_Zq: 4| 36|void PQCLEAN_NTRUHRSS701_AVX2_poly_Z3_to_Zq(poly *r) { 5| 36| int i; 6| 25.2k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 25.2k|#define NTRU_N 701 ------------------ | Branch (6:17): [True: 25.2k, False: 36] ------------------ 7| 25.2k| r->coeffs[i] = r->coeffs[i] | ((-(r->coeffs[i] >> 1)) & (NTRU_Q - 1)); ------------------ | | 13| 25.2k|#define NTRU_Q (1 << NTRU_LOGQ) | | ------------------ | | | | 6| 25.2k|#define NTRU_LOGQ 13 | | ------------------ ------------------ 8| 25.2k| } 9| 36|} PQCLEAN_NTRUHRSS701_AVX2_poly_trinary_Zq_to_Z3: 12| 9|void PQCLEAN_NTRUHRSS701_AVX2_poly_trinary_Zq_to_Z3(poly *r) { 13| 9| int i; 14| 6.31k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 6.31k|#define NTRU_N 701 ------------------ | Branch (14:17): [True: 6.30k, False: 9] ------------------ 15| 6.30k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 6.30k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 6.30k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 6.30k|#define NTRU_LOGQ 13 | | | | ------------------ | | ------------------ ------------------ 16| 6.30k| r->coeffs[i] = 3 & (r->coeffs[i] ^ (r->coeffs[i] >> (NTRU_LOGQ - 1))); ------------------ | | 6| 6.30k|#define NTRU_LOGQ 13 ------------------ 17| 6.30k| } 18| 9|} PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_mul: 20| 18|void PQCLEAN_NTRUHRSS701_AVX2_poly_Sq_mul(poly *r, const poly *a, const poly *b) { 21| 18| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(r, a, b); 22| 18| PQCLEAN_NTRUHRSS701_AVX2_poly_mod_q_Phi_n(r); 23| 18|} PQCLEAN_NTRUHRSS701_AVX2_poly_S3_mul: 25| 9|void PQCLEAN_NTRUHRSS701_AVX2_poly_S3_mul(poly *r, const poly *a, const poly *b) { 26| 9| int i; 27| | 28| | /* Our S3 multiplications do not overflow mod q, */ 29| | /* so we can re-purpose PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul, as long as we */ 30| | /* follow with an explicit reduction mod q. */ 31| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(r, a, b); 32| 6.31k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 6.31k|#define NTRU_N 701 ------------------ | Branch (32:17): [True: 6.30k, False: 9] ------------------ 33| 6.30k| r->coeffs[i] = MODQ(r->coeffs[i]); ------------------ | | 9| 6.30k|#define MODQ(X) ((X) & (NTRU_Q-1)) | | ------------------ | | | | 13| 6.30k|#define NTRU_Q (1 << NTRU_LOGQ) | | | | ------------------ | | | | | | 6| 6.30k|#define NTRU_LOGQ 13 | | | | ------------------ | | ------------------ ------------------ 34| 6.30k| } 35| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_mod_3_Phi_n(r); 36| 9|} PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_inv: 71| 9|void PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_inv(poly *r, const poly *a) { 72| 9| poly ai2; 73| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_inv(&ai2, a); 74| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_inv_to_Rq_inv(r, &ai2, a); 75| 9|} poly.c:PQCLEAN_NTRUHRSS701_AVX2_poly_R2_inv_to_Rq_inv: 38| 9|static void PQCLEAN_NTRUHRSS701_AVX2_poly_R2_inv_to_Rq_inv(poly *r, const poly *ai, const poly *a) { 39| | 40| 9| int i; 41| 9| poly b, c; 42| 9| poly s; 43| | 44| | // for 0..4 45| | // ai = ai * (2 - a*ai) mod q 46| 6.31k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 6.31k|#define NTRU_N 701 ------------------ | Branch (46:17): [True: 6.30k, False: 9] ------------------ 47| 6.30k| b.coeffs[i] = -(a->coeffs[i]); 48| 6.30k| } 49| | 50| 6.31k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 6.31k|#define NTRU_N 701 ------------------ | Branch (50:17): [True: 6.30k, False: 9] ------------------ 51| 6.30k| r->coeffs[i] = ai->coeffs[i]; 52| 6.30k| } 53| | 54| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(&c, r, &b); 55| 9| c.coeffs[0] += 2; // c = 2 - a*ai 56| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(&s, &c, r); // s = ai*c 57| | 58| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(&c, &s, &b); 59| 9| c.coeffs[0] += 2; // c = 2 - a*s 60| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(r, &c, &s); // r = s*c 61| | 62| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(&c, r, &b); 63| 9| c.coeffs[0] += 2; // c = 2 - a*r 64| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(&s, &c, r); // s = r*c 65| | 66| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(&c, &s, &b); 67| 9| c.coeffs[0] += 2; // c = 2 - a*s 68| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_Rq_mul(r, &c, &s); // r = s*c 69| 9|} PQCLEAN_NTRUHRSS701_AVX2_poly_R2_tobytes: 6| 9|void PQCLEAN_NTRUHRSS701_AVX2_poly_R2_tobytes(unsigned char *out, const poly *a) { 7| 9| int i, j, k; 8| 117| for (i = 0; i < 12; i++) { ------------------ | Branch (8:17): [True: 108, False: 9] ------------------ 9| 972| for (k = 0; k < 8; k++) { ------------------ | Branch (9:21): [True: 864, False: 108] ------------------ 10| 864| out[i * 8 + k] = 0; 11| 7.77k| for (j = 0; j < 8; j++) { ------------------ | Branch (11:25): [True: 6.91k, False: 864] ------------------ 12| 6.91k| if ((i * 8 + k) * 8 + j < NTRU_N) { ------------------ | | 5| 6.91k|#define NTRU_N 701 ------------------ | Branch (12:21): [True: 6.30k, False: 603] ------------------ 13| 6.30k| out[i * 8 + k] |= (a->coeffs[(i * 8 + k) * 8 + j] & 1) << j; 14| 6.30k| } 15| 6.91k| } 16| 864| } 17| 108| } 18| 9|} PQCLEAN_NTRUHRSS701_AVX2_poly_R2_frombytes: 20| 9|void PQCLEAN_NTRUHRSS701_AVX2_poly_R2_frombytes(poly *a, const unsigned char *in) { 21| 9| int i, j, k; 22| 117| for (i = 0; i < 12; i++) { ------------------ | Branch (22:17): [True: 108, False: 9] ------------------ 23| 972| for (k = 0; k < 8; k++) { ------------------ | Branch (23:21): [True: 864, False: 108] ------------------ 24| 7.77k| for (j = 0; j < 8; j++) { ------------------ | Branch (24:25): [True: 6.91k, False: 864] ------------------ 25| 6.91k| if ((i * 8 + k) * 8 + j < NTRU_N) { ------------------ | | 5| 6.91k|#define NTRU_N 701 ------------------ | Branch (25:21): [True: 6.30k, False: 603] ------------------ 26| 6.30k| a->coeffs[(i * 8 + k) * 8 + j] = (in[i * 8 + k] >> j) & 1; 27| 6.30k| } 28| 6.91k| } 29| 864| } 30| 108| } 31| 9|} PQCLEAN_NTRUHRSS701_AVX2_poly_R2_inv: 33| 9|void PQCLEAN_NTRUHRSS701_AVX2_poly_R2_inv(poly *r, const poly *a) { 34| 9| union { 35| 9| unsigned char s[96]; 36| 9| __m256i s_x32[3]; 37| 9| } squares[13]; 38| 9|#define s(x) squares[(x)].s 39| | 40| | // This relies on the following addition chain: 41| | // 1, 2, 3, 6, 12, 15, 27, 42, 84, 168, 336, 672, 699 42| | 43| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_tobytes(s(0), a); // TODO alignment ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ 44| | 45| 9| PQCLEAN_NTRUHRSS701_AVX2_square_1_701(s(1), s(0)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_1_701(s(1), s(0)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ 46| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(1), s(1), s(0)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ 47| 9| PQCLEAN_NTRUHRSS701_AVX2_square_1_701(s(2), s(1)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_1_701(s(2), s(1)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ 48| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(2), s(2), s(0)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ 49| 9| PQCLEAN_NTRUHRSS701_AVX2_square_3_701(s(3), s(2)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_3_701(s(3), s(2)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ 50| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(3), s(3), s(2)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(3), s(3), s(2)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(3), s(3), s(2)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ 51| 9| PQCLEAN_NTRUHRSS701_AVX2_square_6_701(s(4), s(3)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_6_701(s(4), s(3)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ 52| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(4), s(4), s(3)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ 53| 9| PQCLEAN_NTRUHRSS701_AVX2_square_3_701(s(5), s(4)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_3_701(s(5), s(4)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ 54| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(5), s(5), s(2)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(5), s(5), s(2)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(5), s(5), s(2)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ 55| 9| PQCLEAN_NTRUHRSS701_AVX2_square_12_701(s(6), s(5)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_12_701(s(6), s(5)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ 56| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(6), s(6), s(4)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(6), s(6), s(4)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(6), s(6), s(4)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ 57| 9| PQCLEAN_NTRUHRSS701_AVX2_square_15_701(s(7), s(6)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_15_701(s(7), s(6)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ 58| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(7), s(7), s(5)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(7), s(7), s(5)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(7), s(7), s(5)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ 59| 9| PQCLEAN_NTRUHRSS701_AVX2_square_42_701(s(8), s(7)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_42_701(s(8), s(7)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ 60| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(8), s(8), s(7)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(8), s(8), s(7)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(8), s(8), s(7)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ 61| 9| PQCLEAN_NTRUHRSS701_AVX2_square_84_701(s(9), s(8)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_84_701(s(9), s(8)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ 62| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(9), s(9), s(8)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ 63| 9| PQCLEAN_NTRUHRSS701_AVX2_square_168_701(s(10), s(9)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_168_701(s(10), s(9)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ 64| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(10), s(10), s(9)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ 65| 9| PQCLEAN_NTRUHRSS701_AVX2_square_336_701(s(11), s(10)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_336_701(s(11), s(10)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ 66| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(11), s(11), s(10)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ 67| 9| PQCLEAN_NTRUHRSS701_AVX2_square_27_701(s(12), s(11)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_27_701(s(12), s(11)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ 68| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(12), s(12), s(6)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(12), s(12), s(6)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_poly_R2_mul(s(12), s(12), s(6)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ 69| 9| PQCLEAN_NTRUHRSS701_AVX2_square_1_701(s(0), s(12)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ PQCLEAN_NTRUHRSS701_AVX2_square_1_701(s(0), s(12)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ 70| | 71| 9| PQCLEAN_NTRUHRSS701_AVX2_poly_R2_frombytes(r, s(0)); ------------------ | | 38| 9|#define s(x) squares[(x)].s ------------------ 72| 9|#undef s 73| 9|} PQCLEAN_NTRUHRSS701_AVX2_poly_S3_inv: 545| 9|void PQCLEAN_NTRUHRSS701_AVX2_poly_S3_inv(poly *r_out, const poly *a) { 546| 9| const unsigned char *in = (void *) a; 547| 9| unsigned char *out = (void *) r_out; 548| | 549| 9| small input[ppad]; 550| 9| small output[ppad]; 551| 9| int i; 552| | 553| | /* XXX: obviously input/output format should be packed into bytes */ 554| | 555| 6.30k| for (i = 0; i < p; ++i) { ------------------ | | 7| 6.30k|#define p 700 ------------------ | Branch (555:17): [True: 6.30k, False: 9] ------------------ 556| 6.30k| small x = in[2 * i] & 3; /* 0 1 2 3 */ 557| 6.30k| x += 1; /* 0 1 2 3 4 5 6, offset by 1 */ 558| 6.30k| x &= (x - 3) >> 5; /* 0 1 2, offset by 1 */ 559| 6.30k| input[i] = x - 1; 560| 6.30k| } 561| | /* XXX: merge with vec256_init */ 562| | 563| 9| __poly_S3_inv((unsigned char *)output, (unsigned char *)input); 564| | 565| 6.30k| for (i = 0; i < p; ++i) { ------------------ | | 7| 6.30k|#define p 700 ------------------ | Branch (565:17): [True: 6.30k, False: 9] ------------------ 566| 6.30k| out[2 * i] = (3 & output[i]) ^ ((3 & output[i]) >> 1); 567| 6.30k| out[2 * i + 1] = 0; 568| 6.30k| } 569| 9|} PQCLEAN_NTRUHRSS701_AVX2_sample_fg: 3| 9|void PQCLEAN_NTRUHRSS701_AVX2_sample_fg(poly *f, poly *g, const unsigned char uniformbytes[NTRU_SAMPLE_FG_BYTES]) { 4| 9| PQCLEAN_NTRUHRSS701_AVX2_sample_iid_plus(f, uniformbytes); 5| 9| PQCLEAN_NTRUHRSS701_AVX2_sample_iid_plus(g, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 19| 9|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 9|#define NTRU_N 701 | | ------------------ ------------------ 6| | 7| 9|} PQCLEAN_NTRUHRSS701_AVX2_sample_rm: 9| 9|void PQCLEAN_NTRUHRSS701_AVX2_sample_rm(poly *r, poly *m, const unsigned char uniformbytes[NTRU_SAMPLE_RM_BYTES]) { 10| 9| PQCLEAN_NTRUHRSS701_AVX2_sample_iid(r, uniformbytes); 11| 9| PQCLEAN_NTRUHRSS701_AVX2_sample_iid(m, uniformbytes + NTRU_SAMPLE_IID_BYTES); ------------------ | | 19| 9|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 9|#define NTRU_N 701 | | ------------------ ------------------ 12| | 13| 9|} PQCLEAN_NTRUHRSS701_AVX2_sample_iid_plus: 15| 18|void PQCLEAN_NTRUHRSS701_AVX2_sample_iid_plus(poly *r, const unsigned char uniformbytes[NTRU_SAMPLE_IID_BYTES]) { 16| | /* Sample r using PQCLEAN_NTRUHRSS701_AVX2_sample_iid then conditionally flip */ 17| | /* signs of even index coefficients so that >= 0. */ 18| | 19| 18| int i; 20| 18| uint16_t s = 0; 21| | 22| 18| PQCLEAN_NTRUHRSS701_AVX2_sample_iid(r, uniformbytes); 23| | 24| | /* Map {0,1,2} -> {0, 1, 2^16 - 1} */ 25| 12.6k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 12.6k|#define NTRU_N 701 ------------------ | Branch (25:17): [True: 12.6k, False: 18] ------------------ 26| 12.6k| r->coeffs[i] = r->coeffs[i] | (-(r->coeffs[i] >> 1)); 27| 12.6k| } 28| | 29| | /* s = . (r[n-1] = 0) */ 30| 12.6k| for (i = 0; i < NTRU_N - 1; i++) { ------------------ | | 5| 12.6k|#define NTRU_N 701 ------------------ | Branch (30:17): [True: 12.6k, False: 18] ------------------ 31| 12.6k| s += (uint16_t)((uint32_t)r->coeffs[i + 1] * (uint32_t)r->coeffs[i]); 32| 12.6k| } 33| | 34| | /* Extract sign of s (sign(0) = 1) */ 35| 18| s = 1 | (-(s >> 15)); 36| | 37| 6.33k| for (i = 0; i < NTRU_N; i += 2) { ------------------ | | 5| 6.33k|#define NTRU_N 701 ------------------ | Branch (37:17): [True: 6.31k, False: 18] ------------------ 38| 6.31k| r->coeffs[i] = (uint16_t)((uint32_t)s * (uint32_t)r->coeffs[i]); 39| 6.31k| } 40| | 41| | /* Map {0,1,2^16-1} -> {0, 1, 2} */ 42| 12.6k| for (i = 0; i < NTRU_N; i++) { ------------------ | | 5| 12.6k|#define NTRU_N 701 ------------------ | Branch (42:17): [True: 12.6k, False: 18] ------------------ 43| 12.6k| r->coeffs[i] = 3 & (r->coeffs[i] ^ (r->coeffs[i] >> 15)); 44| 12.6k| } 45| 18|} PQCLEAN_NTRUHRSS701_AVX2_sample_iid: 7| 36|void PQCLEAN_NTRUHRSS701_AVX2_sample_iid(poly *r, const unsigned char uniformbytes[NTRU_SAMPLE_IID_BYTES]) { 8| 36| int i; 9| 36| union { /* align to 32 byte boundary for vmovdqa */ 10| 36| unsigned char b[PAD32(NTRU_SAMPLE_IID_BYTES)]; 11| 36| __m256i b_x32[PAD32(NTRU_SAMPLE_IID_BYTES) / 32]; 12| 36| } buffer; 13| | 14| 25.2k| for (i = 0; i < NTRU_SAMPLE_IID_BYTES; i++) { ------------------ | | 19| 25.2k|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 25.2k|#define NTRU_N 701 | | ------------------ ------------------ | Branch (14:17): [True: 25.2k, False: 36] ------------------ 15| 25.2k| buffer.b[i] = uniformbytes[i]; 16| 25.2k| } 17| 180| for (i = NTRU_SAMPLE_IID_BYTES; i < PAD32(NTRU_SAMPLE_IID_BYTES); i++) { ------------------ | | 19| 36|#define NTRU_SAMPLE_IID_BYTES (NTRU_N-1) | | ------------------ | | | | 5| 36|#define NTRU_N 701 | | ------------------ ------------------ for (i = NTRU_SAMPLE_IID_BYTES; i < PAD32(NTRU_SAMPLE_IID_BYTES); i++) { ------------------ | | 11| 180|#define PAD32(X) ((((X) + 31)/32)*32) ------------------ | Branch (17:37): [True: 144, False: 36] ------------------ 18| 144| buffer.b[i] = 0; 19| 144| } 20| 36| PQCLEAN_NTRUHRSS701_AVX2_vec32_sample_iid(r, buffer.b); 21| 36|} OQS_KEM_ntruprime_sntrup761_new: 9| 11|OQS_KEM *OQS_KEM_ntruprime_sntrup761_new(void) { 10| | 11| 11| OQS_KEM *kem = OQS_MEM_calloc(1, sizeof(OQS_KEM)); 12| 11| if (kem == NULL) { ------------------ | Branch (12:6): [True: 0, False: 11] ------------------ 13| 0| return NULL; 14| 0| } 15| 11| kem->method_name = OQS_KEM_alg_ntruprime_sntrup761; ------------------ | | 93| 11|#define OQS_KEM_alg_ntruprime_sntrup761 "sntrup761" ------------------ 16| 11| kem->alg_version = "v1.9.2026.01.20 via https://github.com/openssh/openssh-portable/blob/master/sntrup761.c"; 17| | 18| 11| kem->claimed_nist_level = 2; 19| 11| kem->ind_cca = true; 20| | 21| 11| kem->length_public_key = OQS_KEM_ntruprime_sntrup761_length_public_key; ------------------ | | 9| 11|#define OQS_KEM_ntruprime_sntrup761_length_public_key 1158 ------------------ 22| 11| kem->length_secret_key = OQS_KEM_ntruprime_sntrup761_length_secret_key; ------------------ | | 10| 11|#define OQS_KEM_ntruprime_sntrup761_length_secret_key 1763 ------------------ 23| 11| kem->length_ciphertext = OQS_KEM_ntruprime_sntrup761_length_ciphertext; ------------------ | | 11| 11|#define OQS_KEM_ntruprime_sntrup761_length_ciphertext 1039 ------------------ 24| 11| kem->length_shared_secret = OQS_KEM_ntruprime_sntrup761_length_shared_secret; ------------------ | | 12| 11|#define OQS_KEM_ntruprime_sntrup761_length_shared_secret 32 ------------------ 25| 11| kem->length_keypair_seed = OQS_KEM_ntruprime_sntrup761_length_keypair_seed; ------------------ | | 13| 11|#define OQS_KEM_ntruprime_sntrup761_length_keypair_seed 0 ------------------ 26| 11| kem->length_encaps_seed = OQS_KEM_ntruprime_sntrup761_length_encaps_seed; ------------------ | | 14| 11|#define OQS_KEM_ntruprime_sntrup761_length_encaps_seed 0 ------------------ 27| | 28| 11| kem->keypair = OQS_KEM_ntruprime_sntrup761_keypair; 29| 11| kem->keypair_derand = OQS_KEM_ntruprime_sntrup761_keypair_derand; 30| 11| kem->encaps = OQS_KEM_ntruprime_sntrup761_encaps; 31| 11| kem->encaps_derand = OQS_KEM_ntruprime_sntrup761_encaps_derand; 32| 11| kem->decaps = OQS_KEM_ntruprime_sntrup761_decaps; 33| | 34| 11| return kem; 35| 11|} OQS_KEM_ntruprime_sntrup761_keypair: 48| 11|OQS_API OQS_STATUS OQS_KEM_ntruprime_sntrup761_keypair(uint8_t *public_key, uint8_t *secret_key) { 49| 11| return (OQS_STATUS) OPENSSH_SNTRUP761_crypto_kem_keypair(public_key, secret_key); 50| 11|} OQS_KEM_ntruprime_sntrup761_encaps: 60| 11|OQS_API OQS_STATUS OQS_KEM_ntruprime_sntrup761_encaps(uint8_t *ciphertext, uint8_t *shared_secret, const uint8_t *public_key) { 61| 11| return (OQS_STATUS) OPENSSH_SNTRUP761_crypto_kem_enc(ciphertext, shared_secret, public_key); 62| 11|} OQS_KEM_ntruprime_sntrup761_decaps: 64| 11|OQS_API OQS_STATUS OQS_KEM_ntruprime_sntrup761_decaps(uint8_t *shared_secret, const uint8_t *ciphertext, const uint8_t *secret_key) { 65| 11| return (OQS_STATUS) OPENSSH_SNTRUP761_crypto_kem_dec(shared_secret, ciphertext, secret_key); 66| 11|} OPENSSH_SNTRUP761_crypto_kem_keypair: 2103| 11|int crypto_kem_sntrup761_keypair(unsigned char *pk, unsigned char *sk) { 2104| 11| int i; 2105| 11| ZKeyGen(pk, sk); 2106| 11| sk += SecretKeys_bytes; ------------------ | | 1703| 11|#define SecretKeys_bytes (2 * Small_bytes) | | ------------------ | | | | 1701| 11|#define Small_bytes ((p + 3) / 4) | | | | ------------------ | | | | | | 1694| 11|#define p 761 | | | | ------------------ | | ------------------ ------------------ 2107| 12.7k| for (i = 0; i < crypto_kem_sntrup761_PUBLICKEYBYTES; ++i) *sk++ = pk[i]; ------------------ | | 4| 12.7k|#define crypto_kem_sntrup761_PUBLICKEYBYTES 1158 ------------------ | Branch (2107:15): [True: 12.7k, False: 11] ------------------ 2108| 11| randombytes(sk, Small_bytes); ------------------ | | 10| 11|#define randombytes(buf,len) OQS_randombytes((uint8_t *)(buf),(len)) ------------------ 2109| 11| Hash_prefix(sk + Small_bytes, 4, pk, crypto_kem_sntrup761_PUBLICKEYBYTES); ------------------ | | 1701| 11|#define Small_bytes ((p + 3) / 4) | | ------------------ | | | | 1694| 11|#define p 761 | | ------------------ ------------------ Hash_prefix(sk + Small_bytes, 4, pk, crypto_kem_sntrup761_PUBLICKEYBYTES); ------------------ | | 4| 11|#define crypto_kem_sntrup761_PUBLICKEYBYTES 1158 ------------------ 2110| 11| return 0; 2111| 11|} OPENSSH_SNTRUP761_crypto_kem_enc: 2119| 11|int crypto_kem_sntrup761_enc(unsigned char *c, unsigned char *k, const unsigned char *pk) { 2120| 11| Inputs r; 2121| 11| unsigned char r_enc[Small_bytes], cache[Hash_bytes]; 2122| 11| Hash_prefix(cache, 4, pk, crypto_kem_sntrup761_PUBLICKEYBYTES); ------------------ | | 4| 11|#define crypto_kem_sntrup761_PUBLICKEYBYTES 1158 ------------------ 2123| 11| Short_random(r); 2124| 11| Hide(c, r_enc, r, pk, cache); 2125| 11| HashSession(k, 1, r_enc, c); 2126| 11| return 0; 2127| 11|} OPENSSH_SNTRUP761_crypto_kem_dec: 2136| 11|int crypto_kem_sntrup761_dec(unsigned char *k, const unsigned char *c, const unsigned char *sk) { 2137| 11| const unsigned char *pk = sk + SecretKeys_bytes; ------------------ | | 1703| 11|#define SecretKeys_bytes (2 * Small_bytes) | | ------------------ | | | | 1701| 11|#define Small_bytes ((p + 3) / 4) | | | | ------------------ | | | | | | 1694| 11|#define p 761 | | | | ------------------ | | ------------------ ------------------ 2138| 11| const unsigned char *rho = pk + crypto_kem_sntrup761_PUBLICKEYBYTES; ------------------ | | 4| 11|#define crypto_kem_sntrup761_PUBLICKEYBYTES 1158 ------------------ 2139| 11| const unsigned char *cache = rho + Small_bytes; ------------------ | | 1701| 11|#define Small_bytes ((p + 3) / 4) | | ------------------ | | | | 1694| 11|#define p 761 | | ------------------ ------------------ 2140| 11| Inputs r; 2141| 11| unsigned char r_enc[Small_bytes], cnew[crypto_kem_sntrup761_CIPHERTEXTBYTES]; 2142| 11| int mask, i; 2143| 11| ZDecrypt(r, c, sk); 2144| 11| Hide(cnew, r_enc, r, pk, cache); 2145| 11| mask = Ciphertexts_diff_mask(c, cnew); 2146| 2.11k| for (i = 0; i < Small_bytes; ++i) r_enc[i] ^= mask & (r_enc[i] ^ rho[i]); ------------------ | | 1701| 2.11k|#define Small_bytes ((p + 3) / 4) | | ------------------ | | | | 1694| 2.11k|#define p 761 | | ------------------ ------------------ | Branch (2146:15): [True: 2.10k, False: 11] ------------------ 2147| 11| HashSession(k, 1 + mask, r_enc, c); 2148| 11| return 0; 2149| 11|} sntrup761.c:ZKeyGen: 2062| 11|static void ZKeyGen(unsigned char *pk, unsigned char *sk) { 2063| 11| Fq h[p]; 2064| 11| small f[p], v[p]; 2065| 11| KeyGen(h, f, v); 2066| 11| Rq_encode(pk, h); 2067| 11| Small_encode(sk, f); 2068| 11| Small_encode(sk + Small_bytes, v); ------------------ | | 1701| 11|#define Small_bytes ((p + 3) / 4) | | ------------------ | | | | 1694| 11|#define p 761 | | ------------------ ------------------ 2069| 11|} sntrup761.c:KeyGen: 1977| 11|static void KeyGen(Fq *h, small *f, small *ginv) { 1978| 11| small g[p]; 1979| 11| Fq finv[p]; 1980| 11| for (;;) { 1981| 11| int result; 1982| 11| Small_random(g); 1983| 11| result = R3_recip(ginv, g); 1984| 11| crypto_declassify(&result, sizeof result); ------------------ | | 18| 11|#define crypto_declassify(x, y) do {} while (0) | | ------------------ | | | Branch (18:46): [Folded, False: 11] | | ------------------ ------------------ 1985| 11| if (result == 0) break; ------------------ | Branch (1985:9): [True: 11, False: 0] ------------------ 1986| 11| } 1987| 11| Short_random(f); 1988| 11| Rq_recip3(finv, f); 1989| 11| Rq_mult_small(h, finv, g); 1990| 11|} sntrup761.c:Small_random: 1970| 11|static void Small_random(small *out) { 1971| 11| int i; 1972| 11| uint32_t L[p]; 1973| 11| randombytes(L, sizeof(L)); ------------------ | | 10| 11|#define randombytes(buf,len) OQS_randombytes((uint8_t *)(buf),(len)) ------------------ 1974| 8.38k| for (i = 0; i < p; ++i) out[i] = (((L[i] & 0x3fffffff) * 3) >> 30) - 1; ------------------ | | 1694| 8.38k|#define p 761 ------------------ | Branch (1974:15): [True: 8.37k, False: 11] ------------------ 1975| 11| explicit_bzero(L, sizeof(L)); ------------------ | | 14| 11|#define explicit_bzero OQS_MEM_cleanse ------------------ 1976| 11|} sntrup761.c:R3_recip: 1840| 11|static int R3_recip(small *out, const small *in) { 1841| 11| small f[p + 1], g[p + 1], v[p + 1], r[p + 1]; 1842| 11| int sign, swap, t, i, loop, delta = 1; 1843| 8.39k| for (i = 0; i < p + 1; ++i) v[i] = 0; ------------------ | | 1694| 8.39k|#define p 761 ------------------ | Branch (1843:15): [True: 8.38k, False: 11] ------------------ 1844| 8.39k| for (i = 0; i < p + 1; ++i) r[i] = 0; ------------------ | | 1694| 8.39k|#define p 761 ------------------ | Branch (1844:15): [True: 8.38k, False: 11] ------------------ 1845| 11| r[0] = 1; 1846| 8.38k| for (i = 0; i < p; ++i) f[i] = 0; ------------------ | | 1694| 8.38k|#define p 761 ------------------ | Branch (1846:15): [True: 8.37k, False: 11] ------------------ 1847| 11| f[0] = 1; 1848| 11| f[p - 1] = f[p] = -1; ------------------ | | 1694| 11|#define p 761 ------------------ f[p - 1] = f[p] = -1; ------------------ | | 1694| 11|#define p 761 ------------------ 1849| 8.38k| for (i = 0; i < p; ++i) g[p - 1 - i] = in[i]; ------------------ | | 1694| 8.38k|#define p 761 ------------------ for (i = 0; i < p; ++i) g[p - 1 - i] = in[i]; ------------------ | | 1694| 8.37k|#define p 761 ------------------ | Branch (1849:15): [True: 8.37k, False: 11] ------------------ 1850| 11| g[p] = 0; ------------------ | | 1694| 11|#define p 761 ------------------ 1851| 16.7k| for (loop = 0; loop < 2 * p - 1; ++loop) { ------------------ | | 1694| 16.7k|#define p 761 ------------------ | Branch (1851:18): [True: 16.7k, False: 11] ------------------ 1852| 12.7M| for (i = p; i > 0; --i) v[i] = v[i - 1]; ------------------ | | 1694| 16.7k|#define p 761 ------------------ | Branch (1852:17): [True: 12.7M, False: 16.7k] ------------------ 1853| 16.7k| v[0] = 0; 1854| 16.7k| sign = -g[0] * f[0]; 1855| 16.7k| swap = crypto_int16_negative_mask(-delta) & crypto_int16_nonzero_mask(g[0]); 1856| 16.7k| delta ^= swap & (delta ^ -delta); 1857| 16.7k| delta += 1; 1858| 12.7M| for (i = 0; i < p + 1; ++i) { ------------------ | | 1694| 12.7M|#define p 761 ------------------ | Branch (1858:17): [True: 12.7M, False: 16.7k] ------------------ 1859| 12.7M| t = swap & (f[i] ^ g[i]); 1860| 12.7M| f[i] ^= t; 1861| 12.7M| g[i] ^= t; 1862| 12.7M| t = swap & (v[i] ^ r[i]); 1863| 12.7M| v[i] ^= t; 1864| 12.7M| r[i] ^= t; 1865| 12.7M| } 1866| 12.7M| for (i = 0; i < p + 1; ++i) g[i] = F3_freeze(g[i] + sign * f[i]); ------------------ | | 1694| 12.7M|#define p 761 ------------------ | Branch (1866:17): [True: 12.7M, False: 16.7k] ------------------ 1867| 12.7M| for (i = 0; i < p + 1; ++i) r[i] = F3_freeze(r[i] + sign * v[i]); ------------------ | | 1694| 12.7M|#define p 761 ------------------ | Branch (1867:17): [True: 12.7M, False: 16.7k] ------------------ 1868| 12.7M| for (i = 0; i < p; ++i) g[i] = g[i + 1]; ------------------ | | 1694| 12.7M|#define p 761 ------------------ | Branch (1868:17): [True: 12.7M, False: 16.7k] ------------------ 1869| 16.7k| g[p] = 0; ------------------ | | 1694| 16.7k|#define p 761 ------------------ 1870| 16.7k| } 1871| 11| sign = f[0]; 1872| 8.38k| for (i = 0; i < p; ++i) out[i] = sign * v[p - 1 - i]; ------------------ | | 1694| 8.38k|#define p 761 ------------------ for (i = 0; i < p; ++i) out[i] = sign * v[p - 1 - i]; ------------------ | | 1694| 8.37k|#define p 761 ------------------ | Branch (1872:15): [True: 8.37k, False: 11] ------------------ 1873| 11| return crypto_int16_nonzero_mask(delta); 1874| 11|} sntrup761.c:crypto_int16_negative_mask: 62| 33.4k|crypto_int16 crypto_int16_negative_mask(crypto_int16 crypto_int16_x) { 63| 33.4k|#if defined(__GNUC__) && defined(__x86_64__) 64| 33.4k| __asm__ ("sarw $15,%0" : "+r"(crypto_int16_x) : : "cc"); 65| 33.4k| return crypto_int16_x; 66| |#elif defined(__GNUC__) && defined(__aarch64__) 67| | crypto_int16 crypto_int16_y; 68| | __asm__ ("sbfx %w0,%w1,15,1" : "=r"(crypto_int16_y) : "r"(crypto_int16_x) : ); 69| | return crypto_int16_y; 70| |#else 71| | crypto_int16_x >>= 16-6; 72| | crypto_int16_x ^= crypto_int16_optblocker; 73| | crypto_int16_x >>= 5; 74| | return crypto_int16_x; 75| |#endif 76| 33.4k|} sntrup761.c:crypto_int16_nonzero_mask: 220| 33.4k|crypto_int16 crypto_int16_nonzero_mask(crypto_int16 crypto_int16_x) { 221| 33.4k|#if defined(__GNUC__) && defined(__x86_64__) 222| 33.4k| crypto_int16 crypto_int16_q,crypto_int16_z; ------------------ | | 39| 33.4k|#define crypto_int16 int16_t ------------------ 223| 33.4k| __asm__ ("xorw %0,%0\n movw $-1,%1\n testw %2,%2\n cmovnew %1,%0" : "=&r"(crypto_int16_z), "=&r"(crypto_int16_q) : "r"(crypto_int16_x) : "cc"); 224| 33.4k| return crypto_int16_z; 225| |#elif defined(__GNUC__) && defined(__aarch64__) 226| | crypto_int16 crypto_int16_z; 227| | __asm__ ("tst %w1,65535\n csetm %w0,ne" : "=r"(crypto_int16_z) : "r"(crypto_int16_x) : "cc"); 228| | return crypto_int16_z; 229| |#else 230| | crypto_int16_x |= -crypto_int16_x; 231| | return crypto_int16_negative_mask(crypto_int16_x); 232| |#endif 233| 33.4k|} sntrup761.c:F3_freeze: 1706| 25.5M|static small F3_freeze(int16_t x) { return x - 3 * ((10923 * x + 16384) >> 15); } sntrup761.c:Rq_recip3: 1902| 11|static int Rq_recip3(Fq *out, const small *in) { 1903| 11| Fq f[p + 1], g[p + 1], v[p + 1], r[p + 1], scale; 1904| 11| int swap, t, i, loop, delta = 1; 1905| 11| int32_t f0, g0; 1906| 8.39k| for (i = 0; i < p + 1; ++i) v[i] = 0; ------------------ | | 1694| 8.39k|#define p 761 ------------------ | Branch (1906:15): [True: 8.38k, False: 11] ------------------ 1907| 8.39k| for (i = 0; i < p + 1; ++i) r[i] = 0; ------------------ | | 1694| 8.39k|#define p 761 ------------------ | Branch (1907:15): [True: 8.38k, False: 11] ------------------ 1908| 11| r[0] = Fq_recip(3); 1909| 8.38k| for (i = 0; i < p; ++i) f[i] = 0; ------------------ | | 1694| 8.38k|#define p 761 ------------------ | Branch (1909:15): [True: 8.37k, False: 11] ------------------ 1910| 11| f[0] = 1; 1911| 11| f[p - 1] = f[p] = -1; ------------------ | | 1694| 11|#define p 761 ------------------ f[p - 1] = f[p] = -1; ------------------ | | 1694| 11|#define p 761 ------------------ 1912| 8.38k| for (i = 0; i < p; ++i) g[p - 1 - i] = in[i]; ------------------ | | 1694| 8.38k|#define p 761 ------------------ for (i = 0; i < p; ++i) g[p - 1 - i] = in[i]; ------------------ | | 1694| 8.37k|#define p 761 ------------------ | Branch (1912:15): [True: 8.37k, False: 11] ------------------ 1913| 11| g[p] = 0; ------------------ | | 1694| 11|#define p 761 ------------------ 1914| 16.7k| for (loop = 0; loop < 2 * p - 1; ++loop) { ------------------ | | 1694| 16.7k|#define p 761 ------------------ | Branch (1914:18): [True: 16.7k, False: 11] ------------------ 1915| 12.7M| for (i = p; i > 0; --i) v[i] = v[i - 1]; ------------------ | | 1694| 16.7k|#define p 761 ------------------ | Branch (1915:17): [True: 12.7M, False: 16.7k] ------------------ 1916| 16.7k| v[0] = 0; 1917| 16.7k| swap = crypto_int16_negative_mask(-delta) & crypto_int16_nonzero_mask(g[0]); 1918| 16.7k| delta ^= swap & (delta ^ -delta); 1919| 16.7k| delta += 1; 1920| 12.7M| for (i = 0; i < p + 1; ++i) { ------------------ | | 1694| 12.7M|#define p 761 ------------------ | Branch (1920:17): [True: 12.7M, False: 16.7k] ------------------ 1921| 12.7M| t = swap & (f[i] ^ g[i]); 1922| 12.7M| f[i] ^= t; 1923| 12.7M| g[i] ^= t; 1924| 12.7M| t = swap & (v[i] ^ r[i]); 1925| 12.7M| v[i] ^= t; 1926| 12.7M| r[i] ^= t; 1927| 12.7M| } 1928| 16.7k| f0 = f[0]; 1929| 16.7k| g0 = g[0]; 1930| 12.7M| for (i = 0; i < p + 1; ++i) g[i] = Fq_freeze(f0 * g[i] - g0 * f[i]); ------------------ | | 1694| 12.7M|#define p 761 ------------------ | Branch (1930:17): [True: 12.7M, False: 16.7k] ------------------ 1931| 12.7M| for (i = 0; i < p + 1; ++i) r[i] = Fq_freeze(f0 * r[i] - g0 * v[i]); ------------------ | | 1694| 12.7M|#define p 761 ------------------ | Branch (1931:17): [True: 12.7M, False: 16.7k] ------------------ 1932| 12.7M| for (i = 0; i < p; ++i) g[i] = g[i + 1]; ------------------ | | 1694| 12.7M|#define p 761 ------------------ | Branch (1932:17): [True: 12.7M, False: 16.7k] ------------------ 1933| 16.7k| g[p] = 0; ------------------ | | 1694| 16.7k|#define p 761 ------------------ 1934| 16.7k| } 1935| 11| scale = Fq_recip(f[0]); 1936| 8.38k| for (i = 0; i < p; ++i) out[i] = Fq_freeze(scale * (int32_t)v[p - 1 - i]); ------------------ | | 1694| 8.38k|#define p 761 ------------------ for (i = 0; i < p; ++i) out[i] = Fq_freeze(scale * (int32_t)v[p - 1 - i]); ------------------ | | 1694| 8.37k|#define p 761 ------------------ | Branch (1936:15): [True: 8.37k, False: 11] ------------------ 1937| 11| return crypto_int16_nonzero_mask(delta); 1938| 11|} sntrup761.c:Fq_recip: 1892| 22|static Fq Fq_recip(Fq a1) { 1893| 22| int i = 1; 1894| 22| Fq ai = a1; 1895| 100k| while (i < q - 2) { ------------------ | | 1695| 100k|#define q 4591 ------------------ | Branch (1895:10): [True: 100k, False: 22] ------------------ 1896| 100k| ai = Fq_freeze(a1 * (int32_t)ai); 1897| 100k| i += 1; 1898| 100k| } 1899| 22| return ai; 1900| 22|} sntrup761.c:Fq_freeze: 1708| 25.6M|static Fq Fq_freeze(int32_t x) { 1709| 25.6M| const int32_t q16 = (0x10000 + q / 2) / q; ------------------ | | 1695| 25.6M|#define q 4591 ------------------ const int32_t q16 = (0x10000 + q / 2) / q; ------------------ | | 1695| 25.6M|#define q 4591 ------------------ 1710| 25.6M| const int32_t q20 = (0x100000 + q / 2) / q; ------------------ | | 1695| 25.6M|#define q 4591 ------------------ const int32_t q20 = (0x100000 + q / 2) / q; ------------------ | | 1695| 25.6M|#define q 4591 ------------------ 1711| 25.6M| const int32_t q28 = (0x10000000 + q / 2) / q; ------------------ | | 1695| 25.6M|#define q 4591 ------------------ const int32_t q28 = (0x10000000 + q / 2) / q; ------------------ | | 1695| 25.6M|#define q 4591 ------------------ 1712| 25.6M| x -= q * ((q16 * x) >> 16); ------------------ | | 1695| 25.6M|#define q 4591 ------------------ 1713| 25.6M| x -= q * ((q20 * x) >> 20); ------------------ | | 1695| 25.6M|#define q 4591 ------------------ 1714| 25.6M| return x - q * ((q28 * x + 0x8000000) >> 28); ------------------ | | 1695| 25.6M|#define q 4591 ------------------ 1715| 25.6M|} sntrup761.c:Rq_mult_small: 1876| 44|static void Rq_mult_small(Fq *h, const Fq *f, const small *g) { 1877| 44| int32_t fg[p + p - 1]; 1878| 44| int i, j; 1879| 66.9k| for (i = 0; i < p + p - 1; ++i) fg[i] = 0; ------------------ | | 1694| 66.9k|#define p 761 ------------------ for (i = 0; i < p + p - 1; ++i) fg[i] = 0; ------------------ | | 1694| 66.9k|#define p 761 ------------------ | Branch (1879:15): [True: 66.9k, False: 44] ------------------ 1880| 33.5k| for (i = 0; i < p; ++i) ------------------ | | 1694| 33.5k|#define p 761 ------------------ | Branch (1880:15): [True: 33.4k, False: 44] ------------------ 1881| 25.5M| for (j = 0; j < p; ++j) fg[i + j] += f[i] * (int32_t)g[j]; ------------------ | | 1694| 25.5M|#define p 761 ------------------ | Branch (1881:17): [True: 25.4M, False: 33.4k] ------------------ 1882| 33.4k| for (i = p; i < p + p - 1; ++i) fg[i - p] += fg[i]; ------------------ | | 1694| 44|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p] += fg[i]; ------------------ | | 1694| 33.4k|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p] += fg[i]; ------------------ | | 1694| 33.4k|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p] += fg[i]; ------------------ | | 1694| 33.4k|#define p 761 ------------------ | Branch (1882:15): [True: 33.4k, False: 44] ------------------ 1883| 33.4k| for (i = p; i < p + p - 1; ++i) fg[i - p + 1] += fg[i]; ------------------ | | 1694| 44|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p + 1] += fg[i]; ------------------ | | 1694| 33.4k|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p + 1] += fg[i]; ------------------ | | 1694| 33.4k|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p + 1] += fg[i]; ------------------ | | 1694| 33.4k|#define p 761 ------------------ | Branch (1883:15): [True: 33.4k, False: 44] ------------------ 1884| 33.5k| for (i = 0; i < p; ++i) h[i] = Fq_freeze(fg[i]); ------------------ | | 1694| 33.5k|#define p 761 ------------------ | Branch (1884:15): [True: 33.4k, False: 44] ------------------ 1885| 44|} sntrup761.c:Rq_encode: 2030| 11|static void Rq_encode(unsigned char *s, const Fq *r) { 2031| 11| uint16_t R[p], M[p]; 2032| 11| int i; 2033| 8.38k| for (i = 0; i < p; ++i) R[i] = r[i] + q12; ------------------ | | 1694| 8.38k|#define p 761 ------------------ for (i = 0; i < p; ++i) R[i] = r[i] + q12; ------------------ | | 1697| 8.37k|#define q12 ((q - 1) / 2) | | ------------------ | | | | 1695| 8.37k|#define q 4591 | | ------------------ ------------------ | Branch (2033:15): [True: 8.37k, False: 11] ------------------ 2034| 8.38k| for (i = 0; i < p; ++i) M[i] = q; ------------------ | | 1694| 8.38k|#define p 761 ------------------ for (i = 0; i < p; ++i) M[i] = q; ------------------ | | 1695| 8.37k|#define q 4591 ------------------ | Branch (2034:15): [True: 8.37k, False: 11] ------------------ 2035| 11| Encode(s, R, M, p); ------------------ | | 1694| 11|#define p 761 ------------------ 2036| 11|} sntrup761.c:Encode: 1746| 363|static void Encode(unsigned char *out, const uint16_t *R, const uint16_t *M, long long len) { 1747| 363| if (len == 1) { ------------------ | Branch (1747:7): [True: 33, False: 330] ------------------ 1748| 33| uint16_t r = R[0], m = M[0]; 1749| 99| while (m > 1) { ------------------ | Branch (1749:12): [True: 66, False: 33] ------------------ 1750| 66| *out++ = r; 1751| 66| r >>= 8; 1752| 66| m = (m + 255) >> 8; 1753| 66| } 1754| 33| } 1755| 363| if (len > 1) { ------------------ | Branch (1755:7): [True: 330, False: 33] ------------------ 1756| 330| uint16_t *R2 = (uint16_t *)alloca(sizeof(uint16_t) * ((len + 1) / 2)), *M2 = (uint16_t *)alloca(sizeof(uint16_t) * ((len + 1) / 2)); 1757| 330| long long i; 1758| 25.4k| for (i = 0; i < len - 1; i += 2) { ------------------ | Branch (1758:17): [True: 25.0k, False: 330] ------------------ 1759| 25.0k| uint32_t m0 = M[i]; 1760| 25.0k| uint32_t r = R[i] + R[i + 1] * m0; 1761| 25.0k| uint32_t m = M[i + 1] * m0; 1762| 59.9k| while (m >= 16384) { ------------------ | Branch (1762:14): [True: 34.8k, False: 25.0k] ------------------ 1763| 34.8k| *out++ = r; 1764| 34.8k| r >>= 8; 1765| 34.8k| m = (m + 255) >> 8; 1766| 34.8k| } 1767| 25.0k| R2[i / 2] = r; 1768| 25.0k| M2[i / 2] = m; 1769| 25.0k| } 1770| 330| if (i < len) { ------------------ | Branch (1770:9): [True: 132, False: 198] ------------------ 1771| 132| R2[i / 2] = R[i]; 1772| 132| M2[i / 2] = M[i]; 1773| 132| } 1774| 330| Encode(out, R2, M2, (len + 1) / 2); 1775| 330| } 1776| 363|} sntrup761.c:Small_encode: 2011| 44|static void Small_encode(unsigned char *s, const small *f) { 2012| 44| int i, j; 2013| 8.40k| for (i = 0; i < p / 4; ++i) { ------------------ | | 1694| 8.40k|#define p 761 ------------------ | Branch (2013:15): [True: 8.36k, False: 44] ------------------ 2014| 8.36k| small x = 0; 2015| 41.8k| for (j = 0;j < 4;++j) x += (*f++ + 1) << (2 * j); ------------------ | Branch (2015:16): [True: 33.4k, False: 8.36k] ------------------ 2016| 8.36k| *s++ = x; 2017| 8.36k| } 2018| 44| *s = *f++ + 1; 2019| 44|} sntrup761.c:Hash_prefix: 1954| 110|static void Hash_prefix(unsigned char *out, int b, const unsigned char *in, int inlen) { 1955| 110| unsigned char *x = (unsigned char *)alloca(inlen + 1), h[64]; 1956| 110| int i; 1957| 110| x[0] = b; 1958| 58.9k| for (i = 0; i < inlen; ++i) x[i + 1] = in[i]; ------------------ | Branch (1958:15): [True: 58.8k, False: 110] ------------------ 1959| 110| crypto_hash_sha512(h, x, inlen + 1); ------------------ | | 9| 110|#define crypto_hash_sha512 OQS_SHA2_sha512 ------------------ 1960| 3.63k| for (i = 0; i < 32; ++i) out[i] = h[i]; ------------------ | Branch (1960:15): [True: 3.52k, False: 110] ------------------ 1961| 110|} sntrup761.c:Short_random: 1964| 22|static void Short_random(small *out) { 1965| 22| uint32_t L[p]; 1966| 22| randombytes(L, sizeof(L)); ------------------ | | 10| 22|#define randombytes(buf,len) OQS_randombytes((uint8_t *)(buf),(len)) ------------------ 1967| 22| Short_fromlist(out, L); 1968| 22| explicit_bzero(L, sizeof(L)); ------------------ | | 14| 22|#define explicit_bzero OQS_MEM_cleanse ------------------ 1969| 22|} sntrup761.c:Short_fromlist: 1945| 22|static void Short_fromlist(small *out, const uint32_t *in) { 1946| 22| uint32_t L[p]; 1947| 22| int i; 1948| 6.31k| for (i = 0; i < w; ++i) L[i] = in[i] & (uint32_t)-2; ------------------ | | 1696| 6.31k|#define w 286 ------------------ | Branch (1948:15): [True: 6.29k, False: 22] ------------------ 1949| 10.4k| for (i = w; i < p; ++i) L[i] = (in[i] & (uint32_t)-3) | 1; ------------------ | | 1696| 22|#define w 286 ------------------ for (i = w; i < p; ++i) L[i] = (in[i] & (uint32_t)-3) | 1; ------------------ | | 1694| 10.4k|#define p 761 ------------------ | Branch (1949:15): [True: 10.4k, False: 22] ------------------ 1950| 22| crypto_sort_uint32(L, p); ------------------ | | 1694| 22|#define p 761 ------------------ 1951| 16.7k| for (i = 0; i < p; ++i) out[i] = (L[i] & 3) - 1; ------------------ | | 1694| 16.7k|#define p 761 ------------------ | Branch (1951:15): [True: 16.7k, False: 22] ------------------ 1952| 22|} sntrup761.c:crypto_sort_uint32: 1683| 22|{ 1684| 22| crypto_uint32 *x = array; ------------------ | | 6| 22|#define crypto_uint32 uint32_t ------------------ 1685| 22| long long j; 1686| 16.7k| for (j = 0;j < n;++j) x[j] ^= 0x80000000; ------------------ | Branch (1686:14): [True: 16.7k, False: 22] ------------------ 1687| 22| crypto_sort_int32(array,n); 1688| 16.7k| for (j = 0;j < n;++j) x[j] ^= 0x80000000; ------------------ | Branch (1688:14): [True: 16.7k, False: 22] ------------------ 1689| 22|} sntrup761.c:crypto_sort_int32: 1620| 22|{ 1621| 22| long long top,p,q,r,i,j; 1622| 22| int32 *x = array; ------------------ | | 24| 22|#define int32 crypto_int32 | | ------------------ | | | | 562| 22|#define crypto_int32 int32_t | | ------------------ ------------------ 1623| | 1624| 22| if (n < 2) return; ------------------ | Branch (1624:7): [True: 0, False: 22] ------------------ 1625| 22| top = 1; 1626| 220| while (top < n - top) top += top; ------------------ | Branch (1626:10): [True: 198, False: 22] ------------------ 1627| | 1628| 242| for (p = top;p >= 1;p >>= 1) { ------------------ | Branch (1628:16): [True: 220, False: 22] ------------------ 1629| 220| i = 0; 1630| 16.8k| while (i + 2 * p <= n) { ------------------ | Branch (1630:12): [True: 16.5k, False: 220] ------------------ 1631| 84.0k| for (j = i;j < i + p;++j) ------------------ | Branch (1631:18): [True: 67.4k, False: 16.5k] ------------------ 1632| 67.4k| int32_MINMAX(x[j],x[j+p]); ------------------ | | 1617| 67.4k|#define int32_MINMAX(a,b) crypto_int32_minmax(&a,&b) ------------------ 1633| 16.5k| i += 2 * p; 1634| 16.5k| } 1635| 10.3k| for (j = i;j < n - p;++j) ------------------ | Branch (1635:16): [True: 10.1k, False: 220] ------------------ 1636| 10.1k| int32_MINMAX(x[j],x[j+p]); ------------------ | | 1617| 10.1k|#define int32_MINMAX(a,b) crypto_int32_minmax(&a,&b) ------------------ 1637| | 1638| 220| i = 0; 1639| 220| j = 0; 1640| 1.21k| for (q = top;q > p;q >>= 1) { ------------------ | Branch (1640:18): [True: 990, False: 220] ------------------ 1641| 990| if (j != i) for (;;) { ------------------ | Branch (1641:11): [True: 286, False: 704] ------------------ 1642| 550| if (j == n - q) goto done; ------------------ | Branch (1642:13): [True: 0, False: 550] ------------------ 1643| 550| int32 a = x[j + p]; ------------------ | | 24| 550|#define int32 crypto_int32 | | ------------------ | | | | 562| 550|#define crypto_int32 int32_t | | ------------------ ------------------ 1644| 2.55k| for (r = q;r > p;r >>= 1) ------------------ | Branch (1644:20): [True: 2.00k, False: 550] ------------------ 1645| 2.00k| int32_MINMAX(a,x[j + r]); ------------------ | | 1617| 2.55k|#define int32_MINMAX(a,b) crypto_int32_minmax(&a,&b) ------------------ 1646| 550| x[j + p] = a; 1647| 550| ++j; 1648| 550| if (j == i + p) { ------------------ | Branch (1648:13): [True: 286, False: 264] ------------------ 1649| 286| i += 2 * p; 1650| 286| break; 1651| 286| } 1652| 550| } 1653| 17.2k| while (i + p <= n - q) { ------------------ | Branch (1653:14): [True: 16.2k, False: 990] ------------------ 1654| 77.1k| for (j = i;j < i + p;++j) { ------------------ | Branch (1654:20): [True: 60.8k, False: 16.2k] ------------------ 1655| 60.8k| int32 a = x[j + p]; ------------------ | | 24| 60.8k|#define int32 crypto_int32 | | ------------------ | | | | 562| 60.8k|#define crypto_int32 int32_t | | ------------------ ------------------ 1656| 343k| for (r = q;r > p;r >>= 1) ------------------ | Branch (1656:22): [True: 282k, False: 60.8k] ------------------ 1657| 282k| int32_MINMAX(a,x[j+r]); ------------------ | | 1617| 282k|#define int32_MINMAX(a,b) crypto_int32_minmax(&a,&b) ------------------ 1658| 60.8k| x[j + p] = a; 1659| 60.8k| } 1660| 16.2k| i += 2 * p; 1661| 16.2k| } 1662| | /* now i + p > n - q */ 1663| 990| j = i; 1664| 6.79k| while (j < n - q) { ------------------ | Branch (1664:14): [True: 5.80k, False: 990] ------------------ 1665| 5.80k| int32 a = x[j + p]; ------------------ | | 24| 5.80k|#define int32 crypto_int32 | | ------------------ | | | | 562| 5.80k|#define crypto_int32 int32_t | | ------------------ ------------------ 1666| 12.6k| for (r = q;r > p;r >>= 1) ------------------ | Branch (1666:20): [True: 6.88k, False: 5.80k] ------------------ 1667| 6.88k| int32_MINMAX(a,x[j+r]); ------------------ | | 1617| 6.88k|#define int32_MINMAX(a,b) crypto_int32_minmax(&a,&b) ------------------ 1668| 5.80k| x[j + p] = a; 1669| 5.80k| ++j; 1670| 5.80k| } 1671| | 1672| 990| done: ; 1673| 990| } 1674| 220| } 1675| 22|} sntrup761.c:crypto_int32_minmax: 949| 368k|void crypto_int32_minmax(crypto_int32 *crypto_int32_p,crypto_int32 *crypto_int32_q) { 950| 368k| crypto_int32 crypto_int32_x = *crypto_int32_p; ------------------ | | 562| 368k|#define crypto_int32 int32_t ------------------ 951| 368k| crypto_int32 crypto_int32_y = *crypto_int32_q; ------------------ | | 562| 368k|#define crypto_int32 int32_t ------------------ 952| 368k|#if defined(__GNUC__) && defined(__x86_64__) 953| 368k| crypto_int32 crypto_int32_z; ------------------ | | 562| 368k|#define crypto_int32 int32_t ------------------ 954| 368k| __asm__ ("cmpl %2,%1\n movl %1,%0\n cmovgl %2,%1\n cmovgl %0,%2" : "=&r"(crypto_int32_z), "+&r"(crypto_int32_x), "+r"(crypto_int32_y) : : "cc"); 955| 368k| *crypto_int32_p = crypto_int32_x; 956| 368k| *crypto_int32_q = crypto_int32_y; 957| |#elif defined(__GNUC__) && defined(__aarch64__) 958| | crypto_int32 crypto_int32_r, crypto_int32_s; 959| | __asm__ ("cmp %w2,%w3\n csel %w0,%w2,%w3,lt\n csel %w1,%w3,%w2,lt" : "=&r"(crypto_int32_r), "=r"(crypto_int32_s) : "r"(crypto_int32_x), "r"(crypto_int32_y) : "cc"); 960| | *crypto_int32_p = crypto_int32_r; 961| | *crypto_int32_q = crypto_int32_s; 962| |#else 963| | crypto_int64 crypto_int32_r = (crypto_int64)crypto_int32_y ^ (crypto_int64)crypto_int32_x; 964| | crypto_int64 crypto_int32_z = (crypto_int64)crypto_int32_y - (crypto_int64)crypto_int32_x; 965| | crypto_int32_z ^= crypto_int32_r & (crypto_int32_z ^ crypto_int32_y); 966| | crypto_int32_z = crypto_int32_negative_mask(crypto_int32_z); 967| | crypto_int32_z &= crypto_int32_r; 968| | crypto_int32_x ^= crypto_int32_z; 969| | crypto_int32_y ^= crypto_int32_z; 970| | *crypto_int32_p = crypto_int32_x; 971| | *crypto_int32_q = crypto_int32_y; 972| |#endif 973| 368k|} sntrup761.c:Hide: 2113| 22|static void Hide(unsigned char *c, unsigned char *r_enc, const Inputs r, const unsigned char *pk, const unsigned char *cache) { 2114| 22| Small_encode(r_enc, r); 2115| 22| ZEncrypt(c, r, pk); 2116| 22| HashConfirm(c + crypto_kem_sntrup761_CIPHERTEXTBYTES - Confirm_bytes, r_enc, cache); ------------------ | | 6| 22|#define crypto_kem_sntrup761_CIPHERTEXTBYTES 1039 ------------------ HashConfirm(c + crypto_kem_sntrup761_CIPHERTEXTBYTES - Confirm_bytes, r_enc, cache); ------------------ | | 1704| 22|#define Confirm_bytes 32 ------------------ 2117| 22|} sntrup761.c:ZEncrypt: 2071| 22|static void ZEncrypt(unsigned char *C, const Inputs r, const unsigned char *pk) { 2072| 22| Fq h[p], c[p]; 2073| 22| Rq_decode(h, pk); 2074| 22| Encrypt(c, r, h); 2075| 22| Rounded_encode(C, c); 2076| 22|} sntrup761.c:Rq_decode: 2038| 22|static void Rq_decode(Fq *r, const unsigned char *s) { 2039| 22| uint16_t R[p], M[p]; 2040| 22| int i; 2041| 16.7k| for (i = 0; i < p; ++i) M[i] = q; ------------------ | | 1694| 16.7k|#define p 761 ------------------ for (i = 0; i < p; ++i) M[i] = q; ------------------ | | 1695| 16.7k|#define q 4591 ------------------ | Branch (2041:15): [True: 16.7k, False: 22] ------------------ 2042| 22| Decode(R, s, M, p); ------------------ | | 1694| 22|#define p 761 ------------------ 2043| 16.7k| for (i = 0; i < p; ++i) r[i] = ((Fq)R[i]) - q12; ------------------ | | 1694| 16.7k|#define p 761 ------------------ for (i = 0; i < p; ++i) r[i] = ((Fq)R[i]) - q12; ------------------ | | 1697| 16.7k|#define q12 ((q - 1) / 2) | | ------------------ | | | | 1695| 16.7k|#define q 4591 | | ------------------ ------------------ | Branch (2043:15): [True: 16.7k, False: 22] ------------------ 2044| 22|} sntrup761.c:Decode: 1778| 363|static void Decode(uint16_t *out, const unsigned char *S, const uint16_t *M, long long len) { 1779| 363| if (len == 1) { ------------------ | Branch (1779:7): [True: 33, False: 330] ------------------ 1780| 33| if (M[0] == 1) ------------------ | Branch (1780:9): [True: 0, False: 33] ------------------ 1781| 0| *out = 0; 1782| 33| else if (M[0] <= 256) ------------------ | Branch (1782:14): [True: 0, False: 33] ------------------ 1783| 0| *out = uint32_mod_uint14(S[0], M[0]); 1784| 33| else 1785| 33| *out = uint32_mod_uint14(S[0] + (((uint16_t)S[1]) << 8), M[0]); 1786| 33| } 1787| 363| if (len > 1) { ------------------ | Branch (1787:7): [True: 330, False: 33] ------------------ 1788| 330| uint16_t *R2 = (uint16_t *)alloca(sizeof(uint16_t) * ((len + 1) / 2)), *M2 = (uint16_t *)alloca(sizeof(uint16_t) * ((len + 1) / 2)), *bottomr = (uint16_t *)alloca(sizeof(uint16_t) * (len / 2)); 1789| 330| uint32_t *bottomt = (uint32_t *)alloca(sizeof(uint32_t) * (len / 2)); 1790| 330| long long i; 1791| 25.4k| for (i = 0; i < len - 1; i += 2) { ------------------ | Branch (1791:17): [True: 25.0k, False: 330] ------------------ 1792| 25.0k| uint32_t m = M[i] * (uint32_t)M[i + 1]; 1793| 25.0k| if (m > 256 * 16383) { ------------------ | Branch (1793:11): [True: 11.4k, False: 13.6k] ------------------ 1794| 11.4k| bottomt[i / 2] = 256 * 256; 1795| 11.4k| bottomr[i / 2] = S[0] + 256 * S[1]; 1796| 11.4k| S += 2; 1797| 11.4k| M2[i / 2] = (((m + 255) >> 8) + 255) >> 8; 1798| 13.6k| } else if (m >= 16384) { ------------------ | Branch (1798:18): [True: 13.6k, False: 0] ------------------ 1799| 13.6k| bottomt[i / 2] = 256; 1800| 13.6k| bottomr[i / 2] = S[0]; 1801| 13.6k| S += 1; 1802| 13.6k| M2[i / 2] = (m + 255) >> 8; 1803| 13.6k| } else { 1804| 0| bottomt[i / 2] = 1; 1805| 0| bottomr[i / 2] = 0; 1806| 0| M2[i / 2] = m; 1807| 0| } 1808| 25.0k| } 1809| 330| if (i < len) M2[i / 2] = M[i]; ------------------ | Branch (1809:9): [True: 132, False: 198] ------------------ 1810| 330| Decode(R2, S, M2, (len + 1) / 2); 1811| 25.4k| for (i = 0; i < len - 1; i += 2) { ------------------ | Branch (1811:17): [True: 25.0k, False: 330] ------------------ 1812| 25.0k| uint32_t r1, r = bottomr[i / 2]; 1813| 25.0k| uint16_t r0; 1814| 25.0k| r += bottomt[i / 2] * R2[i / 2]; 1815| 25.0k| uint32_divmod_uint14(&r1, &r0, r, M[i]); 1816| 25.0k| r1 = uint32_mod_uint14(r1, M[i + 1]); 1817| 25.0k| *out++ = r0; 1818| 25.0k| *out++ = r1; 1819| 25.0k| } 1820| 330| if (i < len) *out++ = R2[i / 2]; ------------------ | Branch (1820:9): [True: 132, False: 198] ------------------ 1821| 330| } 1822| 363|} sntrup761.c:uint32_mod_uint14: 1739| 25.1k|static uint16_t uint32_mod_uint14(uint32_t x, uint16_t m) { 1740| 25.1k| uint32_t Q; 1741| 25.1k| uint16_t r; 1742| 25.1k| uint32_divmod_uint14(&Q, &r, x, m); 1743| 25.1k| return r; 1744| 25.1k|} sntrup761.c:uint32_divmod_uint14: 1723| 50.1k|static void uint32_divmod_uint14(uint32_t *Q, uint16_t *r, uint32_t x, uint16_t m) { 1724| 50.1k| uint32_t qpart, mask, v = 0x80000000 / m; 1725| 50.1k| qpart = (x * (uint64_t)v) >> 31; 1726| 50.1k| x -= qpart * m; 1727| 50.1k| *Q = qpart; 1728| 50.1k| qpart = (x * (uint64_t)v) >> 31; 1729| 50.1k| x -= qpart * m; 1730| 50.1k| *Q += qpart; 1731| 50.1k| x -= m; 1732| 50.1k| *Q += 1; 1733| 50.1k| mask = crypto_int32_negative_mask(x); 1734| 50.1k| x += mask & (uint32_t)m; 1735| 50.1k| *Q += mask; 1736| 50.1k| *r = x; 1737| 50.1k|} sntrup761.c:crypto_int32_negative_mask: 589| 50.1k|crypto_int32 crypto_int32_negative_mask(crypto_int32 crypto_int32_x) { 590| 50.1k|#if defined(__GNUC__) && defined(__x86_64__) 591| 50.1k| __asm__ ("sarl $31,%0" : "+r"(crypto_int32_x) : : "cc"); 592| 50.1k| return crypto_int32_x; 593| |#elif defined(__GNUC__) && defined(__aarch64__) 594| | crypto_int32 crypto_int32_y; 595| | __asm__ ("asr %w0,%w1,31" : "=r"(crypto_int32_y) : "r"(crypto_int32_x) : ); 596| | return crypto_int32_y; 597| |#else 598| | crypto_int32_x >>= 32-6; 599| | crypto_int32_x ^= crypto_int32_optblocker; 600| | crypto_int32_x >>= 5; 601| | return crypto_int32_x; 602| |#endif 603| 50.1k|} sntrup761.c:Encrypt: 1992| 22|static void Encrypt(Fq *c, const small *r, const Fq *h) { 1993| 22| Fq hr[p]; 1994| 22| Rq_mult_small(hr, h, r); 1995| 22| Round(c, hr); 1996| 22|} sntrup761.c:Round: 1940| 22|static void Round(Fq *out, const Fq *a) { 1941| 22| int i; 1942| 16.7k| for (i = 0; i < p; ++i) out[i] = a[i] - F3_freeze(a[i]); ------------------ | | 1694| 16.7k|#define p 761 ------------------ | Branch (1942:15): [True: 16.7k, False: 22] ------------------ 1943| 22|} sntrup761.c:Rounded_encode: 2046| 22|static void Rounded_encode(unsigned char *s, const Fq *r) { 2047| 22| uint16_t R[p], M[p]; 2048| 22| int i; 2049| 16.7k| for (i = 0; i < p; ++i) R[i] = ((r[i] + q12) * 10923) >> 15; ------------------ | | 1694| 16.7k|#define p 761 ------------------ for (i = 0; i < p; ++i) R[i] = ((r[i] + q12) * 10923) >> 15; ------------------ | | 1697| 16.7k|#define q12 ((q - 1) / 2) | | ------------------ | | | | 1695| 16.7k|#define q 4591 | | ------------------ ------------------ | Branch (2049:15): [True: 16.7k, False: 22] ------------------ 2050| 16.7k| for (i = 0; i < p; ++i) M[i] = (q + 2) / 3; ------------------ | | 1694| 16.7k|#define p 761 ------------------ for (i = 0; i < p; ++i) M[i] = (q + 2) / 3; ------------------ | | 1695| 16.7k|#define q 4591 ------------------ | Branch (2050:15): [True: 16.7k, False: 22] ------------------ 2051| 22| Encode(s, R, M, p); ------------------ | | 1694| 22|#define p 761 ------------------ 2052| 22|} sntrup761.c:HashConfirm: 2087| 22|static void HashConfirm(unsigned char *h, const unsigned char *r, const unsigned char *cache) { 2088| 22| unsigned char x[Hash_bytes * 2]; 2089| 22| int i; 2090| 22| Hash_prefix(x, 3, r, Small_bytes); ------------------ | | 1701| 22|#define Small_bytes ((p + 3) / 4) | | ------------------ | | | | 1694| 22|#define p 761 | | ------------------ ------------------ 2091| 726| for (i = 0; i < Hash_bytes; ++i) x[Hash_bytes + i] = cache[i]; ------------------ | | 1700| 726|#define Hash_bytes 32 ------------------ for (i = 0; i < Hash_bytes; ++i) x[Hash_bytes + i] = cache[i]; ------------------ | | 1700| 704|#define Hash_bytes 32 ------------------ | Branch (2091:15): [True: 704, False: 22] ------------------ 2092| 22| Hash_prefix(h, 2, x, sizeof x); 2093| 22|} sntrup761.c:HashSession: 2095| 22|static void HashSession(unsigned char *k, int b, const unsigned char *y, const unsigned char *z) { 2096| 22| unsigned char x[Hash_bytes + crypto_kem_sntrup761_CIPHERTEXTBYTES]; 2097| 22| int i; 2098| 22| Hash_prefix(x, 3, y, Small_bytes); ------------------ | | 1701| 22|#define Small_bytes ((p + 3) / 4) | | ------------------ | | | | 1694| 22|#define p 761 | | ------------------ ------------------ 2099| 22.8k| for (i = 0; i < crypto_kem_sntrup761_CIPHERTEXTBYTES; ++i) x[Hash_bytes + i] = z[i]; ------------------ | | 6| 22.8k|#define crypto_kem_sntrup761_CIPHERTEXTBYTES 1039 ------------------ for (i = 0; i < crypto_kem_sntrup761_CIPHERTEXTBYTES; ++i) x[Hash_bytes + i] = z[i]; ------------------ | | 1700| 22.8k|#define Hash_bytes 32 ------------------ | Branch (2099:15): [True: 22.8k, False: 22] ------------------ 2100| 22| Hash_prefix(k, b, x, sizeof x); 2101| 22|} sntrup761.c:ZDecrypt: 2078| 11|static void ZDecrypt(Inputs r, const unsigned char *C, const unsigned char *sk) { 2079| 11| small f[p], v[p]; 2080| 11| Fq c[p]; 2081| 11| Small_decode(f, sk); 2082| 11| Small_decode(v, sk + Small_bytes); ------------------ | | 1701| 11|#define Small_bytes ((p + 3) / 4) | | ------------------ | | | | 1694| 11|#define p 761 | | ------------------ ------------------ 2083| 11| Rounded_decode(c, C); 2084| 11| Decrypt(r, c, f, v); 2085| 11|} sntrup761.c:Small_decode: 2021| 22|static void Small_decode(small *f, const unsigned char *s) { 2022| 22| int i, j; 2023| 4.20k| for (i = 0; i < p / 4; ++i) { ------------------ | | 1694| 4.20k|#define p 761 ------------------ | Branch (2023:15): [True: 4.18k, False: 22] ------------------ 2024| 4.18k| unsigned char x = *s++; 2025| 20.9k| for (j = 0;j < 4;++j) *f++ = ((small)((x >> (2 * j)) & 3)) - 1; ------------------ | Branch (2025:16): [True: 16.7k, False: 4.18k] ------------------ 2026| 4.18k| } 2027| 22| *f++ = ((small)(*s & 3)) - 1; 2028| 22|} sntrup761.c:Rounded_decode: 2054| 11|static void Rounded_decode(Fq *r, const unsigned char *s) { 2055| 11| uint16_t R[p], M[p]; 2056| 11| int i; 2057| 8.38k| for (i = 0; i < p; ++i) M[i] = (q + 2) / 3; ------------------ | | 1694| 8.38k|#define p 761 ------------------ for (i = 0; i < p; ++i) M[i] = (q + 2) / 3; ------------------ | | 1695| 8.37k|#define q 4591 ------------------ | Branch (2057:15): [True: 8.37k, False: 11] ------------------ 2058| 11| Decode(R, s, M, p); ------------------ | | 1694| 11|#define p 761 ------------------ 2059| 8.38k| for (i = 0; i < p; ++i) r[i] = R[i] * 3 - q12; ------------------ | | 1694| 8.38k|#define p 761 ------------------ for (i = 0; i < p; ++i) r[i] = R[i] * 3 - q12; ------------------ | | 1697| 8.37k|#define q12 ((q - 1) / 2) | | ------------------ | | | | 1695| 8.37k|#define q 4591 | | ------------------ ------------------ | Branch (2059:15): [True: 8.37k, False: 11] ------------------ 2060| 11|} sntrup761.c:Decrypt: 1998| 11|static void Decrypt(small *r, const Fq *c, const small *f, const small *ginv) { 1999| 11| Fq cf[p], cf3[p]; 2000| 11| small e[p], ev[p]; 2001| 11| int mask, i; 2002| 11| Rq_mult_small(cf, c, f); 2003| 11| Rq_mult3(cf3, cf); 2004| 11| R3_fromRq(e, cf3); 2005| 11| R3_mult(ev, e, ginv); 2006| 11| mask = Weightw_mask(ev); 2007| 3.15k| for (i = 0; i < w; ++i) r[i] = ((ev[i] ^ 1) & ~mask) ^ 1; ------------------ | | 1696| 3.15k|#define w 286 ------------------ | Branch (2007:15): [True: 3.14k, False: 11] ------------------ 2008| 5.23k| for (i = w; i < p; ++i) r[i] = ev[i] & ~mask; ------------------ | | 1696| 11|#define w 286 ------------------ for (i = w; i < p; ++i) r[i] = ev[i] & ~mask; ------------------ | | 1694| 5.23k|#define p 761 ------------------ | Branch (2008:15): [True: 5.22k, False: 11] ------------------ 2009| 11|} sntrup761.c:Rq_mult3: 1887| 11|static void Rq_mult3(Fq *h, const Fq *f) { 1888| 11| int i; 1889| 8.38k| for (i = 0; i < p; ++i) h[i] = Fq_freeze(3 * f[i]); ------------------ | | 1694| 8.38k|#define p 761 ------------------ | Branch (1889:15): [True: 8.37k, False: 11] ------------------ 1890| 11|} sntrup761.c:R3_fromRq: 1824| 11|static void R3_fromRq(small *out, const Fq *r) { 1825| 11| int i; 1826| 8.38k| for (i = 0; i < p; ++i) out[i] = F3_freeze(r[i]); ------------------ | | 1694| 8.38k|#define p 761 ------------------ | Branch (1826:15): [True: 8.37k, False: 11] ------------------ 1827| 11|} sntrup761.c:R3_mult: 1829| 11|static void R3_mult(small *h, const small *f, const small *g) { 1830| 11| int16_t fg[p + p - 1]; 1831| 11| int i, j; 1832| 16.7k| for (i = 0; i < p + p - 1; ++i) fg[i] = 0; ------------------ | | 1694| 16.7k|#define p 761 ------------------ for (i = 0; i < p + p - 1; ++i) fg[i] = 0; ------------------ | | 1694| 16.7k|#define p 761 ------------------ | Branch (1832:15): [True: 16.7k, False: 11] ------------------ 1833| 8.38k| for (i = 0; i < p; ++i) ------------------ | | 1694| 8.38k|#define p 761 ------------------ | Branch (1833:15): [True: 8.37k, False: 11] ------------------ 1834| 6.37M| for (j = 0; j < p; ++j) fg[i + j] += f[i] * (int16_t)g[j]; ------------------ | | 1694| 6.37M|#define p 761 ------------------ | Branch (1834:17): [True: 6.37M, False: 8.37k] ------------------ 1835| 8.37k| for (i = p; i < p + p - 1; ++i) fg[i - p] += fg[i]; ------------------ | | 1694| 11|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p] += fg[i]; ------------------ | | 1694| 8.37k|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p] += fg[i]; ------------------ | | 1694| 8.37k|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p] += fg[i]; ------------------ | | 1694| 8.36k|#define p 761 ------------------ | Branch (1835:15): [True: 8.36k, False: 11] ------------------ 1836| 8.37k| for (i = p; i < p + p - 1; ++i) fg[i - p + 1] += fg[i]; ------------------ | | 1694| 11|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p + 1] += fg[i]; ------------------ | | 1694| 8.37k|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p + 1] += fg[i]; ------------------ | | 1694| 8.37k|#define p 761 ------------------ for (i = p; i < p + p - 1; ++i) fg[i - p + 1] += fg[i]; ------------------ | | 1694| 8.36k|#define p 761 ------------------ | Branch (1836:15): [True: 8.36k, False: 11] ------------------ 1837| 8.38k| for (i = 0; i < p; ++i) h[i] = F3_freeze(fg[i]); ------------------ | | 1694| 8.38k|#define p 761 ------------------ | Branch (1837:15): [True: 8.37k, False: 11] ------------------ 1838| 11|} sntrup761.c:Weightw_mask: 1717| 11|static int Weightw_mask(small *r) { 1718| 11| int i, weight = 0; 1719| 8.38k| for (i = 0; i < p; ++i) weight += crypto_int64_bottombit_01(r[i]); ------------------ | | 1694| 8.38k|#define p 761 ------------------ | Branch (1719:15): [True: 8.37k, False: 11] ------------------ 1720| 11| return crypto_int16_nonzero_mask(weight - w); ------------------ | | 1696| 11|#define w 286 ------------------ 1721| 11|} sntrup761.c:crypto_int64_bottombit_01: 1193| 8.38k|crypto_int64 crypto_int64_bottombit_01(crypto_int64 crypto_int64_x) { 1194| 8.38k|#if defined(__GNUC__) && defined(__x86_64__) 1195| 8.38k| __asm__ ("andq $1,%0" : "+r"(crypto_int64_x) : : "cc"); 1196| 8.38k| return crypto_int64_x; 1197| |#elif defined(__GNUC__) && defined(__aarch64__) 1198| | crypto_int64 crypto_int64_y; 1199| | __asm__ ("ubfx %0,%1,0,1" : "=r"(crypto_int64_y) : "r"(crypto_int64_x) : ); 1200| | return crypto_int64_y; 1201| |#else 1202| | crypto_int64_x &= 1 ^ crypto_int64_optblocker; 1203| | return crypto_int64_x; 1204| |#endif 1205| 8.38k|} sntrup761.c:Ciphertexts_diff_mask: 2129| 11|static int Ciphertexts_diff_mask(const unsigned char *c, const unsigned char *c2) { 2130| 11| uint16_t differentbits = 0; 2131| 11| int len = crypto_kem_sntrup761_CIPHERTEXTBYTES; ------------------ | | 6| 11|#define crypto_kem_sntrup761_CIPHERTEXTBYTES 1039 ------------------ 2132| 11.4k| while (len-- > 0) differentbits |= (*c++) ^ (*c2++); ------------------ | Branch (2132:10): [True: 11.4k, False: 11] ------------------ 2133| 11| return (crypto_int64_bitmod_01((differentbits - 1),8)) - 1; 2134| 11|} sntrup761.c:crypto_int64_bitmod_01: 1272| 11|crypto_int64 crypto_int64_bitmod_01(crypto_int64 crypto_int64_x,crypto_int64 crypto_int64_s) { 1273| 11| crypto_int64_x = crypto_int64_shrmod(crypto_int64_x,crypto_int64_s); 1274| 11| return crypto_int64_bottombit_01(crypto_int64_x); 1275| 11|} sntrup761.c:crypto_int64_shrmod: 1250| 11|crypto_int64 crypto_int64_shrmod(crypto_int64 crypto_int64_x,crypto_int64 crypto_int64_s) { 1251| 11|#if defined(__GNUC__) && defined(__x86_64__) 1252| 11| __asm__ ("sarq %%cl,%0" : "+r"(crypto_int64_x) : "c"(crypto_int64_s) : "cc"); 1253| |#elif defined(__GNUC__) && defined(__aarch64__) 1254| | __asm__ ("asr %0,%0,%1" : "+r"(crypto_int64_x) : "r"(crypto_int64_s) : ); 1255| |#else 1256| | int crypto_int64_k, crypto_int64_l; 1257| | for (crypto_int64_l = 0,crypto_int64_k = 1;crypto_int64_k < 64;++crypto_int64_l,crypto_int64_k *= 2) 1258| | crypto_int64_x ^= (crypto_int64_x ^ (crypto_int64_x >> crypto_int64_k)) & crypto_int64_bitinrangepublicpos_mask(crypto_int64_s,crypto_int64_l); 1259| |#endif 1260| 11| return crypto_int64_x; 1261| 11|} min: 18| 1.87k|size_t min(size_t a, size_t b) { 19| 1.87k| return a < b ? a : b; ------------------ | Branch (19:9): [True: 1.84k, False: 32] ------------------ 20| 1.87k|} fuzz_rand: 36| 8.60k|void fuzz_rand(uint8_t *random_array, size_t bytes_to_read) { 37| 4.43M| for (size_t i = 0; i < bytes_to_read; i++) { ------------------ | Branch (37:21): [True: 4.42M, False: 8.60k] ------------------ 38| 4.42M| random_array[i] = (uint8_t)rand(); 39| 4.42M| } 40| 8.60k|} init_fuzz_context: 42| 1.87k|fuzz_ctx_t init_fuzz_context(const uint8_t *data, size_t data_len) { 43| | 44| 1.87k| fuzz_ctx_t ctx = {{0, 0}, NULL, 0}; 45| 1.87k| if (data_len > sizeof(fuzz_init_ctx_t)) { ------------------ | Branch (45:6): [True: 1.86k, False: 5] ------------------ 46| 1.86k| memcpy(&ctx.init, data, sizeof(fuzz_init_ctx_t)); 47| 1.86k| ctx.data = data + sizeof(fuzz_init_ctx_t); 48| 1.86k| ctx.data_len = data_len - sizeof(fuzz_init_ctx_t); 49| | 50| 1.86k| ctx.init.algorithm_index %= OQS_KEM_algs_length; ------------------ | | 122| 1.86k|#define OQS_KEM_algs_length 41 ------------------ 51| 1.86k| } else { 52| 5| ctx.data = data; 53| 5| ctx.data_len = data_len; 54| 5| } 55| | 56| 1.87k| srand(ctx.init.random_seed); 57| 1.87k| OQS_randombytes_custom_algorithm(&fuzz_rand); 58| | 59| 1.87k| return ctx; 60| 1.87k|} cleanup_heap: 134| 1.87k| uint8_t *ciphertext, OQS_KEM *kem) { 135| 1.87k| if (kem != NULL) { ------------------ | Branch (135:6): [True: 1.87k, False: 0] ------------------ 136| 1.87k| OQS_MEM_secure_free(secret_key, kem->length_secret_key); 137| 1.87k| OQS_MEM_secure_free(shared_secret_e, kem->length_shared_secret); 138| 1.87k| OQS_MEM_secure_free(shared_secret_d, kem->length_shared_secret); 139| 1.87k| } 140| 1.87k| OQS_MEM_insecure_free(public_key); 141| 1.87k| OQS_MEM_insecure_free(ciphertext); 142| 1.87k| OQS_KEM_free(kem); 143| 1.87k|} LLVMFuzzerTestOneInput: 145| 1.87k|int LLVMFuzzerTestOneInput(const char *data, size_t size) { 146| 1.87k| OQS_init(); 147| 1.87k| if (OQS_ERROR == fuzz_kem((const uint8_t *)data, size)) { ------------------ | Branch (147:6): [True: 0, False: 1.87k] ------------------ 148| | // If we get an error prune testcase from corpus. 149| 0| return -1; 150| 0| } 151| 1.87k| OQS_destroy(); 152| 1.87k| return 0; 153| 1.87k|} fuzz_test_kem.c:fuzz_kem: 68| 1.87k|static OQS_STATUS fuzz_kem(const uint8_t *data, size_t data_len) { 69| 1.87k| OQS_KEM *kem = NULL; 70| 1.87k| uint8_t *public_key = NULL; 71| 1.87k| uint8_t *secret_key = NULL; 72| 1.87k| uint8_t *ciphertext = NULL; 73| 1.87k| uint8_t *shared_secret_e = NULL; 74| 1.87k| uint8_t *shared_secret_d = NULL; 75| | 76| 1.87k| fuzz_ctx_t ctx = init_fuzz_context(data, data_len); 77| 1.87k| const char *algorithm = OQS_KEM_alg_identifier(ctx.init.algorithm_index); 78| 1.87k| kem = OQS_KEM_new(algorithm); 79| 1.87k| if (kem == NULL) { ------------------ | Branch (79:6): [True: 0, False: 1.87k] ------------------ 80| 0| printf("%s was not enabled at compile-time.\n", algorithm); 81| 0| return OQS_ERROR; 82| 0| } 83| | 84| 1.87k| public_key = OQS_MEM_malloc(kem->length_public_key); 85| 1.87k| secret_key = OQS_MEM_malloc(kem->length_secret_key); 86| 1.87k| ciphertext = OQS_MEM_malloc(kem->length_ciphertext); 87| 1.87k| shared_secret_e = OQS_MEM_malloc(kem->length_shared_secret); 88| 1.87k| shared_secret_d = OQS_MEM_malloc(kem->length_shared_secret); 89| | 90| 1.87k| if ((public_key == NULL) || (secret_key == NULL) || (ciphertext == NULL) || ------------------ | Branch (90:6): [True: 0, False: 1.87k] | Branch (90:30): [True: 0, False: 1.87k] | Branch (90:54): [True: 0, False: 1.87k] ------------------ 91| 1.87k| (shared_secret_e == NULL) || (shared_secret_d == NULL)) { ------------------ | Branch (91:10): [True: 0, False: 1.87k] | Branch (91:39): [True: 0, False: 1.87k] ------------------ 92| 0| fprintf(stderr, "ERROR: OQS_MEM_malloc failed!\n"); 93| 0| cleanup_heap(secret_key, shared_secret_e, shared_secret_d, public_key, 94| 0| ciphertext, kem); 95| | 96| 0| return OQS_ERROR; 97| 0| } 98| | 99| 1.87k| memcpy(shared_secret_e, ctx.data, min(ctx.data_len, kem->length_shared_secret)); 100| 1.87k| OQS_STATUS rc = OQS_KEM_keypair(kem, public_key, secret_key); 101| 1.87k| if (rc != OQS_SUCCESS) { ------------------ | Branch (101:6): [True: 0, False: 1.87k] ------------------ 102| 0| fprintf(stderr, "ERROR: OQS_KEM_keypair failed!\n"); 103| 0| cleanup_heap(secret_key, shared_secret_e, shared_secret_d, public_key, 104| 0| ciphertext, kem); 105| | 106| 0| return rc; 107| 0| } 108| 1.87k| rc = OQS_KEM_encaps(kem, ciphertext, shared_secret_e, public_key); 109| 1.87k| if (rc != OQS_SUCCESS) { ------------------ | Branch (109:6): [True: 0, False: 1.87k] ------------------ 110| 0| fprintf(stderr, "ERROR: OQS_KEM_encaps failed!\n"); 111| 0| cleanup_heap(secret_key, shared_secret_e, shared_secret_d, public_key, 112| 0| ciphertext, kem); 113| | 114| 0| return rc; 115| 0| } 116| 1.87k| rc = OQS_KEM_decaps(kem, shared_secret_d, ciphertext, secret_key); 117| 1.87k| if (rc != OQS_SUCCESS) { ------------------ | Branch (117:6): [True: 0, False: 1.87k] ------------------ 118| 0| fprintf(stderr, "ERROR: OQS_KEM_decaps failed! with algorithm index %u\n", ctx.init.algorithm_index); 119| 0| cleanup_heap(secret_key, shared_secret_e, shared_secret_d, public_key, 120| 0| ciphertext, kem); 121| | 122| 0| return rc; 123| 0| } 124| 1.87k| assert(memcmp(shared_secret_d, shared_secret_e, kem->length_shared_secret) == 0); 125| | 126| 1.87k| cleanup_heap(secret_key, shared_secret_e, shared_secret_d, public_key, 127| 1.87k| ciphertext, kem); 128| | 129| 1.87k| return OQS_SUCCESS; // success 130| 1.87k|}